In ftxgsub.c, Chained Context Substitutions are applied even
when the input glyphs do not meet the InputCoverage. eg. I
made a contrived font in :

http://www.arbornet.org/~klchxbec/Sampige-contrived.ttf
where lookup #5 says:

      <Lookup index="5">
        <LookupType value="6"/>
        <LookupFlag value="256"/>
        <!-- SubTableCount=1 -->
        <ChainContextSubst index="0" Format="3">
          <!-- BacktrackGlyphCount=0 -->
          <!-- InputGlyphCount=1 -->
          <InputCoverage index="0" Format="2">
            <Glyph value="#10"/>
            ...
            <Glyph value="#43"/>
          </InputCoverage>

Note that glyph #9 is deliberately removed from input coverage
to illustrate this bug.

          <LookaheadCoverage index="0" Format="2">
            ...
            <Glyph value="#57"/>
          </LookaheadCoverage>
          <!-- SubstCount=1 -->
          <SubstLookupRecord index="0">
            <SequenceIndex value="0"/>
            <LookupListIndex value="14"/>

Because the loop index starts from 1 instead of 0, the input
coverage is not checked and the substitution is applied as
seen in LookupListIndex=14.

I've attached the utf testcase, and screenshots with and without
the fix. Please note that none of the screenshots are correct
rendering as far as the language is concerned. They just depict
the bug.

Also note that the fix for bug#118592 is also required to
reproduce this bug.