diff --git a/src/hb-open-file-private.hh b/src/hb-open-file-private.hh
index 547cef0d3..ed9369bdf 100644
--- a/src/hb-open-file-private.hh
+++ b/src/hb-open-file-private.hh
@@ -49,7 +49,7 @@ typedef struct TableDirectory
 {
   static inline unsigned int get_size () { return sizeof (TableDirectory); }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF ();
   }
@@ -98,7 +98,7 @@ typedef struct OffsetTable
   }
 
   public:
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF () && SANITIZE_ARRAY (tableDir, TableDirectory::get_size (), numTables);
   }
@@ -124,7 +124,7 @@ struct TTCHeaderVersion1
   inline unsigned int get_face_count (void) const { return table.len; }
   inline const OpenTypeFontFace& get_face (unsigned int i) const { return this+table[i]; }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_WITH_BASE (this, table);
   }
@@ -162,12 +162,12 @@ struct TTCHeader
     }
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE (u.header.version)) return false;
     switch (u.header.version) {
     case 2: /* version 2 is compatible with version 1 */
-    case 1: return u.version1->sanitize (SANITIZE_ARG);
+    case 1: return u.version1->sanitize (context);
     default:return true;
     }
   }
@@ -224,15 +224,15 @@ struct OpenTypeFontFile
     }
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE (u.tag)) return false;
     switch (u.tag) {
     case CFFTag:	/* All the non-collection tags */
     case TrueTag:
     case Typ1Tag:
-    case TrueTypeTag:	return u.fontFace->sanitize (SANITIZE_ARG);
-    case TTCTag:	return u.ttcHeader->sanitize (SANITIZE_ARG);
+    case TrueTypeTag:	return u.fontFace->sanitize (context);
+    case TTCTag:	return u.ttcHeader->sanitize (context);
     default:		return true;
     }
   }
diff --git a/src/hb-open-type-private.hh b/src/hb-open-type-private.hh
index 2a0dccbc8..9254e4498 100644
--- a/src/hb-open-type-private.hh
+++ b/src/hb-open-type-private.hh
@@ -153,11 +153,6 @@ struct hb_trace_t<0> {
 	trace.log ("SANITIZE", HB_FUNC, this);
 
 
-#define SANITIZE_ARG_DEF \
-	hb_sanitize_context_t *context
-#define SANITIZE_ARG \
-	context
-
 struct hb_sanitize_context_t
 {
   inline void init (hb_blob_t *blob)
@@ -253,9 +248,9 @@ struct hb_sanitize_context_t
 };
 
 
-#define SANITIZE(X) likely ((X).sanitize (SANITIZE_ARG))
+#define SANITIZE(X) likely ((X).sanitize (context))
 
-#define SANITIZE_WITH_BASE(B,X) likely ((X).sanitize (SANITIZE_ARG, CharP(B)))
+#define SANITIZE_WITH_BASE(B,X) likely ((X).sanitize (context, CharP(B)))
 
 #define SANITIZE_SELF() SANITIZE_MEM(this, sizeof (*this))
 
@@ -282,7 +277,7 @@ struct Sanitizer
 
     Type *t = CastP<Type> (const_cast<char *> (context->get_start ()));
 
-    sane = t->sanitize (SANITIZE_ARG);
+    sane = t->sanitize (context);
     if (sane) {
       if (context->get_edit_count ()) {
 	if (HB_DEBUG_SANITIZE)
@@ -291,7 +286,7 @@ struct Sanitizer
 
         /* sanitize again to ensure no toe-stepping */
         context->reset_edit_count ();
-	sane = t->sanitize (SANITIZE_ARG);
+	sane = t->sanitize (context);
 	if (context->get_edit_count ()) {
 	  if (HB_DEBUG_SANITIZE)
 	    fprintf (stderr, "Sanitizer %p requested %d edits in second round; FAILLING %s\n",
@@ -373,7 +368,7 @@ struct IntType
   inline operator Type(void) const { return v; }
   inline bool operator == (const IntType<Type> &o) const { return v == o.v; }
   inline bool operator != (const IntType<Type> &o) const { return v != o.v; }
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF ();
   }
@@ -435,7 +430,7 @@ struct FixedVersion
 {
   inline operator uint32_t (void) const { return (major << 16) + minor; }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF ();
   }
@@ -462,27 +457,27 @@ struct GenericOffsetTo : OffsetType
     return StructAtOffset<Type> (*CharP(base), offset);
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF, void *base) {
+  inline bool sanitize (hb_sanitize_context_t *context, void *base) {
     TRACE_SANITIZE ();
     if (!SANITIZE_SELF ()) return false;
     unsigned int offset = *this;
     if (unlikely (!offset)) return true;
     Type &obj = StructAtOffset<Type> (*CharP(base), offset);
-    return likely (obj.sanitize (SANITIZE_ARG)) || neuter (SANITIZE_ARG);
+    return likely (obj.sanitize (context)) || neuter (context);
   }
   template <typename T>
-  inline bool sanitize (SANITIZE_ARG_DEF, void *base, T user_data) {
+  inline bool sanitize (hb_sanitize_context_t *context, void *base, T user_data) {
     TRACE_SANITIZE ();
     if (!SANITIZE_SELF ()) return false;
     unsigned int offset = *this;
     if (unlikely (!offset)) return true;
     Type &obj = StructAtOffset<Type> (*CharP(base), offset);
-    return likely (obj.sanitize (SANITIZE_ARG, user_data)) || neuter (SANITIZE_ARG);
+    return likely (obj.sanitize (context, user_data)) || neuter (context);
   }
 
   private:
   /* Set the offset to Null */
-  inline bool neuter (SANITIZE_ARG_DEF) {
+  inline bool neuter (hb_sanitize_context_t *context) {
     if (context->can_edit (CharP(this), this->get_size ())) {
       this->set (0); /* 0 is Null offset */
       return true;
@@ -530,9 +525,9 @@ struct GenericArrayOf
   inline unsigned int get_size () const
   { return len.get_size () + len * Type::get_size (); }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!likely (sanitize_shallow (SANITIZE_ARG))) return false;
+    if (!likely (sanitize_shallow (context))) return false;
     /* Note: for structs that do not reference other structs,
      * we do not need to call their sanitize() as we already did
      * a bound check on the aggregate array size, hence the return.
@@ -547,28 +542,28 @@ struct GenericArrayOf
         return false;
     return true;
   }
-  inline bool sanitize (SANITIZE_ARG_DEF, void *base) {
+  inline bool sanitize (hb_sanitize_context_t *context, void *base) {
     TRACE_SANITIZE ();
-    if (!likely (sanitize_shallow (SANITIZE_ARG))) return false;
+    if (!likely (sanitize_shallow (context))) return false;
     unsigned int count = len;
     for (unsigned int i = 0; i < count; i++)
-      if (!array()[i].sanitize (SANITIZE_ARG, base))
+      if (!array()[i].sanitize (context, base))
         return false;
     return true;
   }
   template <typename T>
-  inline bool sanitize (SANITIZE_ARG_DEF, void *base, T user_data) {
+  inline bool sanitize (hb_sanitize_context_t *context, void *base, T user_data) {
     TRACE_SANITIZE ();
-    if (!likely (sanitize_shallow (SANITIZE_ARG))) return false;
+    if (!likely (sanitize_shallow (context))) return false;
     unsigned int count = len;
     for (unsigned int i = 0; i < count; i++)
-      if (!array()[i].sanitize (SANITIZE_ARG, base, user_data))
+      if (!array()[i].sanitize (context, base, user_data))
         return false;
     return true;
   }
 
   private:
-  inline bool sanitize_shallow (SANITIZE_ARG_DEF) {
+  inline bool sanitize_shallow (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF() && SANITIZE_ARRAY (this, Type::get_size (), len);
   }
@@ -608,14 +603,14 @@ struct OffsetListOf : OffsetArrayOf<Type>
     return this+this->array()[i];
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    return OffsetArrayOf<Type>::sanitize (SANITIZE_ARG, CharP(this));
+    return OffsetArrayOf<Type>::sanitize (context, CharP(this));
   }
   template <typename T>
-  inline bool sanitize (SANITIZE_ARG_DEF, T user_data) {
+  inline bool sanitize (hb_sanitize_context_t *context, T user_data) {
     TRACE_SANITIZE ();
-    return OffsetArrayOf<Type>::sanitize (SANITIZE_ARG, CharP(this), user_data);
+    return OffsetArrayOf<Type>::sanitize (context, CharP(this), user_data);
   }
 };
 
@@ -636,13 +631,13 @@ struct HeadlessArrayOf
   inline unsigned int get_size () const
   { return len.get_size () + (len ? len - 1 : 0) * Type::get_size (); }
 
-  inline bool sanitize_shallow (SANITIZE_ARG_DEF) {
+  inline bool sanitize_shallow (hb_sanitize_context_t *context) {
     return SANITIZE_SELF() && SANITIZE_ARRAY (this, Type::get_size (), len);
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (!likely (sanitize_shallow (SANITIZE_ARG))) return false;
+    if (!likely (sanitize_shallow (context))) return false;
     /* Note: for structs that do not reference other structs,
      * we do not need to call their sanitize() as we already did
      * a bound check on the aggregate array size, hence the return.
diff --git a/src/hb-ot-layout-common-private.hh b/src/hb-ot-layout-common-private.hh
index 2c1c988f7..d9b2da332 100644
--- a/src/hb-ot-layout-common-private.hh
+++ b/src/hb-ot-layout-common-private.hh
@@ -53,7 +53,7 @@ struct Record
 {
   static inline unsigned int get_size () { return sizeof (Record<Type>); }
 
-  inline bool sanitize (SANITIZE_ARG_DEF, void *base) {
+  inline bool sanitize (hb_sanitize_context_t *context, void *base) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF ()
 	&& SANITIZE_WITH_BASE (base, offset);
@@ -110,9 +110,9 @@ struct RecordListOf : RecordArrayOf<Type>
   inline const Type& operator [] (unsigned int i) const
   { return this+RecordArrayOf<Type>::operator [](i).offset; }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    return RecordArrayOf<Type>::sanitize (SANITIZE_ARG, CharP(this));
+    return RecordArrayOf<Type>::sanitize (context, CharP(this));
   }
 };
 
@@ -164,7 +164,7 @@ struct LangSys
    return reqFeatureIndex;;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF () && SANITIZE (featureIndex);
   }
@@ -201,7 +201,7 @@ struct Script
   inline bool has_default_lang_sys (void) const { return defaultLangSys != 0; }
   inline const LangSys& get_default_lang_sys (void) const { return this+defaultLangSys; }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_WITH_BASE (this, defaultLangSys)
 	&& SANITIZE_WITH_BASE (this, langSys);
@@ -232,7 +232,7 @@ struct Feature
 					  unsigned int *lookup_tags /* OUT */) const
   { return lookupIndex.get_indexes (start_index, lookup_count, lookup_tags); }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF () && SANITIZE (lookupIndex);
   }
@@ -282,10 +282,10 @@ struct Lookup
     return flag;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     /* Real sanitize of the subtables is done by GSUB/GPOS/... */
-    if (!(SANITIZE_SELF () && likely (subTable.sanitize (SANITIZE_ARG)))) return false;
+    if (!(SANITIZE_SELF () && likely (subTable.sanitize (context)))) return false;
     if (unlikely (lookupFlag & LookupFlag::UseMarkFilteringSet))
     {
       USHORT &markFilteringSet = StructAfter<USHORT> (subTable);
@@ -331,7 +331,7 @@ struct CoverageFormat1
     return NOT_COVERED;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE (glyphArray);
   }
@@ -358,7 +358,7 @@ struct CoverageRangeRecord
   }
 
   public:
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF ();
   }
@@ -390,7 +390,7 @@ struct CoverageFormat2
     return NOT_COVERED;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE (rangeRecord);
   }
@@ -417,12 +417,12 @@ struct Coverage
     }
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE (u.format)) return false;
     switch (u.format) {
-    case 1: return u.format1->sanitize (SANITIZE_ARG);
-    case 2: return u.format2->sanitize (SANITIZE_ARG);
+    case 1: return u.format1->sanitize (context);
+    case 2: return u.format2->sanitize (context);
     default:return true;
     }
   }
@@ -452,7 +452,7 @@ struct ClassDefFormat1
     return 0;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF () && SANITIZE (classValue);
   }
@@ -479,7 +479,7 @@ struct ClassRangeRecord
   }
 
   public:
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF ();
   }
@@ -510,7 +510,7 @@ struct ClassDefFormat2
     return 0;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE (rangeRecord);
   }
@@ -535,12 +535,12 @@ struct ClassDef
     }
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE (u.format)) return false;
     switch (u.format) {
-    case 1: return u.format1->sanitize (SANITIZE_ARG);
-    case 2: return u.format2->sanitize (SANITIZE_ARG);
+    case 1: return u.format1->sanitize (context);
+    case 2: return u.format2->sanitize (context);
     default:return true;
     }
   }
@@ -592,7 +592,7 @@ struct Device
     return USHORT::get_size () * (4 + ((endSize - startSize) >> (4 - f)));
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF() && SANITIZE_MEM (this, this->get_size ());
   }
diff --git a/src/hb-ot-layout-gdef-private.hh b/src/hb-ot-layout-gdef-private.hh
index da49fac75..65b2414a0 100644
--- a/src/hb-ot-layout-gdef-private.hh
+++ b/src/hb-ot-layout-gdef-private.hh
@@ -67,7 +67,7 @@ struct AttachList
     return points.len;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_WITH_BASE (this, coverage)
 	&& SANITIZE_WITH_BASE (this, attachPoint);
@@ -98,7 +98,7 @@ struct CaretValueFormat1
     return _hb_16dot16_mul_round (context->font->x_scale, coordinate);
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF ();
   }
@@ -124,7 +124,7 @@ struct CaretValueFormat2
       return 0;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF ();
   }
@@ -146,7 +146,7 @@ struct CaretValueFormat3
 	   ((this+deviceTable).get_delta (context->font->x_ppem) << 16);
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF ()
 	&& SANITIZE_WITH_BASE (this, deviceTable);
@@ -174,13 +174,13 @@ struct CaretValue
     }
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE (u.format)) return false;
     switch (u.format) {
-    case 1: return u.format1->sanitize (SANITIZE_ARG);
-    case 2: return u.format2->sanitize (SANITIZE_ARG);
-    case 3: return u.format3->sanitize (SANITIZE_ARG);
+    case 1: return u.format1->sanitize (context);
+    case 2: return u.format2->sanitize (context);
+    case 3: return u.format3->sanitize (context);
     default:return true;
     }
   }
@@ -212,7 +212,7 @@ struct LigGlyph
     return carets.len;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_WITH_BASE (this, carets);
   }
@@ -244,7 +244,7 @@ struct LigCaretList
     return lig_glyph.get_lig_carets (context, glyph_id, start_offset, caret_count, caret_array);
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_WITH_BASE (this, coverage)
 	&& SANITIZE_WITH_BASE (this, ligGlyph);
@@ -266,7 +266,7 @@ struct MarkGlyphSetsFormat1
   inline bool covers (unsigned int set_index, hb_codepoint_t glyph_id) const
   { return (this+coverage[set_index]).get_coverage (glyph_id) != NOT_COVERED; }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_WITH_BASE (this, coverage);
   }
@@ -289,11 +289,11 @@ struct MarkGlyphSets
     }
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE (u.format)) return false;
     switch (u.format) {
-    case 1: return u.format1->sanitize (SANITIZE_ARG);
+    case 1: return u.format1->sanitize (context);
     default:return true;
     }
   }
@@ -349,7 +349,7 @@ struct GDEF
   inline bool mark_set_covers (unsigned int set_index, hb_codepoint_t glyph_id) const
   { return version >= 0x00010002 && (this+markGlyphSetsDef[0]).covers (set_index, glyph_id); }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE (version) && likely (version.major == 1)
 	&& SANITIZE_WITH_BASE (this, glyphClassDef)
diff --git a/src/hb-ot-layout-gpos-private.hh b/src/hb-ot-layout-gpos-private.hh
index 9837c0493..8c75c9ff7 100644
--- a/src/hb-ot-layout-gpos-private.hh
+++ b/src/hb-ot-layout-gpos-private.hh
@@ -129,7 +129,7 @@ struct ValueFormat : USHORT
   }
 
   private:
-  inline bool sanitize_value_devices (SANITIZE_ARG_DEF, void *base, const Value *values) {
+  inline bool sanitize_value_devices (hb_sanitize_context_t *context, void *base, const Value *values) {
     unsigned int format = *this;
 
     if (format & xPlacement) values++;
@@ -152,14 +152,14 @@ struct ValueFormat : USHORT
     return (format & devices) != 0;
   }
 
-  inline bool sanitize_value (SANITIZE_ARG_DEF, void *base, const Value *values) {
+  inline bool sanitize_value (hb_sanitize_context_t *context, void *base, const Value *values) {
     TRACE_SANITIZE ();
 
     return SANITIZE_MEM (values, get_size ()) &&
-	   (!has_device () || sanitize_value_devices (SANITIZE_ARG, base, values));
+	   (!has_device () || sanitize_value_devices (context, base, values));
   }
 
-  inline bool sanitize_values (SANITIZE_ARG_DEF, void *base, const Value *values, unsigned int count) {
+  inline bool sanitize_values (hb_sanitize_context_t *context, void *base, const Value *values, unsigned int count) {
     TRACE_SANITIZE ();
     unsigned int len = get_len ();
 
@@ -168,7 +168,7 @@ struct ValueFormat : USHORT
     if (!has_device ()) return true;
 
     for (unsigned int i = 0; i < count; i++) {
-      if (!sanitize_value_devices (SANITIZE_ARG, base, values))
+      if (!sanitize_value_devices (context, base, values))
         return false;
       values += len;
     }
@@ -177,13 +177,13 @@ struct ValueFormat : USHORT
   }
 
   /* Just sanitize referenced Device tables.  Doesn't check the values themselves. */
-  inline bool sanitize_values_stride_unsafe (SANITIZE_ARG_DEF, void *base, const Value *values, unsigned int count, unsigned int stride) {
+  inline bool sanitize_values_stride_unsafe (hb_sanitize_context_t *context, void *base, const Value *values, unsigned int count, unsigned int stride) {
     TRACE_SANITIZE ();
 
     if (!has_device ()) return true;
 
     for (unsigned int i = 0; i < count; i++) {
-      if (!sanitize_value_devices (SANITIZE_ARG, base, values))
+      if (!sanitize_value_devices (context, base, values))
         return false;
       values += stride;
     }
@@ -206,7 +206,7 @@ struct AnchorFormat1
       *y = _hb_16dot16_mul_round (layout_context->font->y_scale, yCoordinate);
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF ();
   }
@@ -237,7 +237,7 @@ struct AnchorFormat2
       *y = y_ppem && ret ? cy : _hb_16dot16_mul_round (layout_context->font->y_scale, yCoordinate);
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF ();
   }
@@ -268,7 +268,7 @@ struct AnchorFormat3
 	*y += (this+yDeviceTable).get_delta (layout_context->font->y_ppem) << 16;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF ()
 	&& SANITIZE_WITH_BASE (this, xDeviceTable)
@@ -304,13 +304,13 @@ struct Anchor
     }
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE (u.format)) return false;
     switch (u.format) {
-    case 1: return u.format1->sanitize (SANITIZE_ARG);
-    case 2: return u.format2->sanitize (SANITIZE_ARG);
-    case 3: return u.format3->sanitize (SANITIZE_ARG);
+    case 1: return u.format1->sanitize (context);
+    case 2: return u.format2->sanitize (context);
+    case 3: return u.format3->sanitize (context);
     default:return true;
     }
   }
@@ -332,7 +332,7 @@ struct AnchorMatrix
     return this+matrix[row * cols + col];
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF, unsigned int cols) {
+  inline bool sanitize (hb_sanitize_context_t *context, unsigned int cols) {
     TRACE_SANITIZE ();
     if (!SANITIZE_SELF ()) return false;
     if (unlikely (cols >= ((unsigned int) -1) / rows)) return false;
@@ -358,7 +358,7 @@ struct MarkRecord
 
   static inline unsigned int get_size () { return sizeof (MarkRecord); }
 
-  inline bool sanitize (SANITIZE_ARG_DEF, void *base) {
+  inline bool sanitize (hb_sanitize_context_t *context, void *base) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF ()
 	&& SANITIZE_WITH_BASE (base, markAnchor);
@@ -402,7 +402,7 @@ struct MarkArray
     return true;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_WITH_BASE (this, markRecord);
   }
@@ -434,11 +434,11 @@ struct SinglePosFormat1
     return true;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF ()
 	&& SANITIZE_WITH_BASE (this, coverage)
-	&& valueFormat.sanitize_value (SANITIZE_ARG, CharP(this), values);
+	&& valueFormat.sanitize_value (context, CharP(this), values);
   }
 
   private:
@@ -477,11 +477,11 @@ struct SinglePosFormat2
     return true;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF ()
 	&& SANITIZE_WITH_BASE (this, coverage)
-	&& valueFormat.sanitize_values (SANITIZE_ARG, CharP(this), values, valueCount);
+	&& valueFormat.sanitize_values (context, CharP(this), values, valueCount);
   }
 
   private:
@@ -512,12 +512,12 @@ struct SinglePos
     }
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE (u.format)) return false;
     switch (u.format) {
-    case 1: return u.format1->sanitize (SANITIZE_ARG);
-    case 2: return u.format2->sanitize (SANITIZE_ARG);
+    case 1: return u.format1->sanitize (context);
+    case 2: return u.format2->sanitize (context);
     default:return true;
     }
   }
@@ -549,7 +549,7 @@ struct PairSet
   friend struct PairPosFormat1;
 
   /* Note: Doesn't sanitize the Device entries in the ValueRecord */
-  inline bool sanitize (SANITIZE_ARG_DEF, unsigned int format_len) {
+  inline bool sanitize (hb_sanitize_context_t *context, unsigned int format_len) {
     TRACE_SANITIZE ();
     if (!SANITIZE_SELF ()) return false;
     unsigned int count = (1 + format_len) * len;
@@ -612,7 +612,7 @@ struct PairPosFormat1
     return false;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
 
     unsigned int len1 = valueFormat1.get_len ();
@@ -620,7 +620,7 @@ struct PairPosFormat1
 
     if (!(SANITIZE_SELF ()
        && SANITIZE_WITH_BASE (this, coverage)
-       && likely (pairSet.sanitize (SANITIZE_ARG, CharP(this), len1 + len2)))) return false;
+       && likely (pairSet.sanitize (context, CharP(this), len1 + len2)))) return false;
 
     if (!(valueFormat1.has_device () || valueFormat2.has_device ())) return true;
 
@@ -632,8 +632,8 @@ struct PairPosFormat1
 
       unsigned int count2 = pair_set.len;
       const PairValueRecord *record = pair_set.array;
-      if (!(valueFormat1.sanitize_values_stride_unsafe (SANITIZE_ARG, CharP(this), &record->values[0], count2, stride) &&
-	    valueFormat2.sanitize_values_stride_unsafe (SANITIZE_ARG, CharP(this), &record->values[len1], count2, stride)))
+      if (!(valueFormat1.sanitize_values_stride_unsafe (context, CharP(this), &record->values[0], count2, stride) &&
+	    valueFormat2.sanitize_values_stride_unsafe (context, CharP(this), &record->values[len1], count2, stride)))
         return false;
     }
 
@@ -701,7 +701,7 @@ struct PairPosFormat2
     return true;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!(SANITIZE_SELF ()
        && SANITIZE_WITH_BASE (this, coverage)
@@ -714,8 +714,8 @@ struct PairPosFormat2
     unsigned int record_size = valueFormat1.get_size () + valueFormat2.get_size ();
     unsigned int count = (unsigned int) class1Count * (unsigned int) class2Count;
     return SANITIZE_ARRAY (values, record_size, count) &&
-	   valueFormat1.sanitize_values_stride_unsafe (SANITIZE_ARG, CharP(this), &values[0], count, stride) &&
-	   valueFormat2.sanitize_values_stride_unsafe (SANITIZE_ARG, CharP(this), &values[len1], count, stride);
+	   valueFormat1.sanitize_values_stride_unsafe (context, CharP(this), &values[0], count, stride) &&
+	   valueFormat2.sanitize_values_stride_unsafe (context, CharP(this), &values[len1], count, stride);
   }
 
   private:
@@ -762,12 +762,12 @@ struct PairPos
     }
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE (u.format)) return false;
     switch (u.format) {
-    case 1: return u.format1->sanitize (SANITIZE_ARG);
-    case 2: return u.format2->sanitize (SANITIZE_ARG);
+    case 1: return u.format1->sanitize (context);
+    case 2: return u.format2->sanitize (context);
     default:return true;
     }
   }
@@ -785,7 +785,7 @@ struct EntryExitRecord
 {
   static inline unsigned int get_size () { return sizeof (EntryExitRecord); }
 
-  inline bool sanitize (SANITIZE_ARG_DEF, void *base) {
+  inline bool sanitize (hb_sanitize_context_t *context, void *base) {
     TRACE_SANITIZE ();
     return SANITIZE_WITH_BASE (base, entryAnchor)
 	&& SANITIZE_WITH_BASE (base, exitAnchor);
@@ -982,7 +982,7 @@ struct CursivePosFormat1
     return true;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_WITH_BASE (this, coverage)
 	&& SANITIZE_WITH_BASE (this, entryExitRecord);
@@ -1013,11 +1013,11 @@ struct CursivePos
     }
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE (u.format)) return false;
     switch (u.format) {
-    case 1: return u.format1->sanitize (SANITIZE_ARG);
+    case 1: return u.format1->sanitize (context);
     default:return true;
     }
   }
@@ -1070,13 +1070,13 @@ struct MarkBasePosFormat1
     return (this+markArray).apply (APPLY_ARG, mark_index, base_index, this+baseArray, classCount, j);
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF ()
         && SANITIZE_WITH_BASE (this, markCoverage)
 	&& SANITIZE_WITH_BASE (this, baseCoverage)
 	&& SANITIZE_WITH_BASE (this, markArray)
-	&& likely (baseArray.sanitize (SANITIZE_ARG, CharP(this), (unsigned int) classCount));
+	&& likely (baseArray.sanitize (context, CharP(this), (unsigned int) classCount));
   }
 
   private:
@@ -1111,11 +1111,11 @@ struct MarkBasePos
     }
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE (u.format)) return false;
     switch (u.format) {
-    case 1: return u.format1->sanitize (SANITIZE_ARG);
+    case 1: return u.format1->sanitize (context);
     default:return true;
     }
   }
@@ -1194,13 +1194,13 @@ struct MarkLigPosFormat1
     return (this+markArray).apply (APPLY_ARG, mark_index, comp_index, lig_attach, classCount, j);
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF ()
         && SANITIZE_WITH_BASE (this, markCoverage)
 	&& SANITIZE_WITH_BASE (this, ligatureCoverage)
 	&& SANITIZE_WITH_BASE (this, markArray)
-	&& likely (ligatureArray.sanitize (SANITIZE_ARG, CharP(this), (unsigned int) classCount));
+	&& likely (ligatureArray.sanitize (context, CharP(this), (unsigned int) classCount));
   }
 
   private:
@@ -1236,11 +1236,11 @@ struct MarkLigPos
     }
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE (u.format)) return false;
     switch (u.format) {
-    case 1: return u.format1->sanitize (SANITIZE_ARG);
+    case 1: return u.format1->sanitize (context);
     default:return true;
     }
   }
@@ -1297,13 +1297,13 @@ struct MarkMarkPosFormat1
     return (this+mark1Array).apply (APPLY_ARG, mark1_index, mark2_index, this+mark2Array, classCount, j);
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF ()
 	&& SANITIZE_WITH_BASE (this, mark1Coverage)
 	&& SANITIZE_WITH_BASE (this, mark2Coverage)
 	&& SANITIZE_WITH_BASE (this, mark1Array)
-	&& likely (mark2Array.sanitize (SANITIZE_ARG, CharP(this), (unsigned int) classCount));
+	&& likely (mark2Array.sanitize (context, CharP(this), (unsigned int) classCount));
   }
 
   private:
@@ -1340,11 +1340,11 @@ struct MarkMarkPos
     }
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE (u.format)) return false;
     switch (u.format) {
-    case 1: return u.format1->sanitize (SANITIZE_ARG);
+    case 1: return u.format1->sanitize (context);
     default:return true;
     }
   }
@@ -1398,7 +1398,7 @@ struct ExtensionPos : Extension
 
   inline bool apply (APPLY_ARG_DEF) const;
 
-  inline bool sanitize (SANITIZE_ARG_DEF);
+  inline bool sanitize (hb_sanitize_context_t *context);
 };
 
 
@@ -1441,19 +1441,19 @@ struct PosLookupSubTable
     }
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE (u.format)) return false;
     switch (u.format) {
-    case Single:		return u.single->sanitize (SANITIZE_ARG);
-    case Pair:			return u.pair->sanitize (SANITIZE_ARG);
-    case Cursive:		return u.cursive->sanitize (SANITIZE_ARG);
-    case MarkBase:		return u.markBase->sanitize (SANITIZE_ARG);
-    case MarkLig:		return u.markLig->sanitize (SANITIZE_ARG);
-    case MarkMark:		return u.markMark->sanitize (SANITIZE_ARG);
-    case Context:		return u.context->sanitize (SANITIZE_ARG);
-    case ChainContext:		return u.chainContext->sanitize (SANITIZE_ARG);
-    case Extension:		return u.extension->sanitize (SANITIZE_ARG);
+    case Single:		return u.single->sanitize (context);
+    case Pair:			return u.pair->sanitize (context);
+    case Cursive:		return u.cursive->sanitize (context);
+    case MarkBase:		return u.markBase->sanitize (context);
+    case MarkLig:		return u.markLig->sanitize (context);
+    case MarkMark:		return u.markMark->sanitize (context);
+    case Context:		return u.context->sanitize (context);
+    case ChainContext:		return u.chainContext->sanitize (context);
+    case Extension:		return u.extension->sanitize (context);
     default:return true;
     }
   }
@@ -1536,9 +1536,9 @@ struct PosLookup : Lookup
     return ret;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (unlikely (!Lookup::sanitize (SANITIZE_ARG))) return false;
+    if (unlikely (!Lookup::sanitize (context))) return false;
     OffsetArrayOf<PosLookupSubTable> &list = CastR<OffsetArrayOf<PosLookupSubTable> > (subTable);
     return SANITIZE_WITH_BASE (this, list);
   }
@@ -1564,9 +1564,9 @@ struct GPOS : GSUBGPOS
 			       hb_mask_t     mask) const
   { return get_lookup (lookup_index).apply_string (layout_context, buffer, mask); }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (unlikely (!GSUBGPOS::sanitize (SANITIZE_ARG))) return false;
+    if (unlikely (!GSUBGPOS::sanitize (context))) return false;
     OffsetTo<PosLookupList> &list = CastR<OffsetTo<PosLookupList> > (lookupList);
     return SANITIZE_WITH_BASE (this, list);
   }
@@ -1582,10 +1582,10 @@ inline bool ExtensionPos::apply (APPLY_ARG_DEF) const
   return get_subtable ().apply (APPLY_ARG, get_type ());
 }
 
-inline bool ExtensionPos::sanitize (SANITIZE_ARG_DEF)
+inline bool ExtensionPos::sanitize (hb_sanitize_context_t *context)
 {
   TRACE_SANITIZE ();
-  if (unlikely (!Extension::sanitize (SANITIZE_ARG))) return false;
+  if (unlikely (!Extension::sanitize (context))) return false;
   unsigned int offset = get_offset ();
   if (unlikely (!offset)) return true;
   return SANITIZE (StructAtOffset<PosLookupSubTable> (*this, offset));
diff --git a/src/hb-ot-layout-gsub-private.hh b/src/hb-ot-layout-gsub-private.hh
index 3632c1fa8..2dfe7c285 100644
--- a/src/hb-ot-layout-gsub-private.hh
+++ b/src/hb-ot-layout-gsub-private.hh
@@ -54,7 +54,7 @@ struct SingleSubstFormat1
     return true;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_WITH_BASE (this, coverage)
 	&& SANITIZE (deltaGlyphID);
@@ -97,7 +97,7 @@ struct SingleSubstFormat2
     return true;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_WITH_BASE (this, coverage)
 	&& SANITIZE (substitute);
@@ -130,12 +130,12 @@ struct SingleSubst
     }
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE (u.format)) return false;
     switch (u.format) {
-    case 1: return u.format1->sanitize (SANITIZE_ARG);
-    case 2: return u.format2->sanitize (SANITIZE_ARG);
+    case 1: return u.format1->sanitize (context);
+    case 2: return u.format2->sanitize (context);
     default:return true;
     }
   }
@@ -180,7 +180,7 @@ struct Sequence
   }
 
   public:
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE (substitute);
   }
@@ -208,7 +208,7 @@ struct MultipleSubstFormat1
     return (this+sequence[index]).apply (APPLY_ARG);
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_WITH_BASE (this, coverage)
 	&& SANITIZE_WITH_BASE (this, sequence);
@@ -240,11 +240,11 @@ struct MultipleSubst
     }
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE (u.format)) return false;
     switch (u.format) {
-    case 1: return u.format1->sanitize (SANITIZE_ARG);
+    case 1: return u.format1->sanitize (context);
     default:return true;
     }
   }
@@ -304,7 +304,7 @@ struct AlternateSubstFormat1
     return true;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_WITH_BASE (this, coverage)
 	&& SANITIZE_WITH_BASE (this, alternateSet);
@@ -336,11 +336,11 @@ struct AlternateSubst
     }
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE (u.format)) return false;
     switch (u.format) {
-    case 1: return u.format1->sanitize (SANITIZE_ARG);
+    case 1: return u.format1->sanitize (context);
     default:return true;
     }
   }
@@ -422,7 +422,7 @@ struct Ligature
   }
 
   public:
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE (ligGlyph) && SANITIZE (component);
   }
@@ -456,7 +456,7 @@ struct LigatureSet
   }
 
   public:
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_WITH_BASE (this, ligature);
   }
@@ -488,7 +488,7 @@ struct LigatureSubstFormat1
     return lig_set.apply (APPLY_ARG, first_is_mark);
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_WITH_BASE (this, coverage)
 	&& SANITIZE_WITH_BASE (this, ligatureSet);
@@ -519,11 +519,11 @@ struct LigatureSubst
     }
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE (u.format)) return false;
     switch (u.format) {
-    case 1: return u.format1->sanitize (SANITIZE_ARG);
+    case 1: return u.format1->sanitize (context);
     default:return true;
     }
   }
@@ -579,7 +579,7 @@ struct ExtensionSubst : Extension
 
   inline bool apply (APPLY_ARG_DEF) const;
 
-  inline bool sanitize (SANITIZE_ARG_DEF);
+  inline bool sanitize (hb_sanitize_context_t *context);
 
   inline bool is_reverse (void) const;
 };
@@ -619,7 +619,7 @@ struct ReverseChainSingleSubstFormat1
     return false;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!(SANITIZE_WITH_BASE (this, coverage)
        && SANITIZE_WITH_BASE (this, backtrack)))
@@ -664,11 +664,11 @@ struct ReverseChainSingleSubst
     }
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE (u.format)) return false;
     switch (u.format) {
-    case 1: return u.format1->sanitize (SANITIZE_ARG);
+    case 1: return u.format1->sanitize (context);
     default:return true;
     }
   }
@@ -717,18 +717,18 @@ struct SubstLookupSubTable
     }
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE (u.format)) return false;
     switch (u.format) {
-    case Single:		return u.single->sanitize (SANITIZE_ARG);
-    case Multiple:		return u.multiple->sanitize (SANITIZE_ARG);
-    case Alternate:		return u.alternate->sanitize (SANITIZE_ARG);
-    case Ligature:		return u.ligature->sanitize (SANITIZE_ARG);
-    case Context:		return u.context->sanitize (SANITIZE_ARG);
-    case ChainContext:		return u.chainContext->sanitize (SANITIZE_ARG);
-    case Extension:		return u.extension->sanitize (SANITIZE_ARG);
-    case ReverseChainSingle:	return u.reverseChainContextSingle->sanitize (SANITIZE_ARG);
+    case Single:		return u.single->sanitize (context);
+    case Multiple:		return u.multiple->sanitize (context);
+    case Alternate:		return u.alternate->sanitize (context);
+    case Ligature:		return u.ligature->sanitize (context);
+    case Context:		return u.context->sanitize (context);
+    case ChainContext:		return u.chainContext->sanitize (context);
+    case Extension:		return u.extension->sanitize (context);
+    case ReverseChainSingle:	return u.reverseChainContextSingle->sanitize (context);
     default:return true;
     }
   }
@@ -847,9 +847,9 @@ struct SubstLookup : Lookup
     return ret;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (unlikely (!Lookup::sanitize (SANITIZE_ARG))) return false;
+    if (unlikely (!Lookup::sanitize (context))) return false;
     OffsetArrayOf<SubstLookupSubTable> &list = CastR<OffsetArrayOf<SubstLookupSubTable> > (subTable);
     return SANITIZE_WITH_BASE (this, list);
   }
@@ -876,9 +876,9 @@ struct GSUB : GSUBGPOS
   { return get_lookup (lookup_index).apply_string (layout_context, buffer, mask); }
 
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
-    if (unlikely (!GSUBGPOS::sanitize (SANITIZE_ARG))) return false;
+    if (unlikely (!GSUBGPOS::sanitize (context))) return false;
     OffsetTo<SubstLookupList> &list = CastR<OffsetTo<SubstLookupList> > (lookupList);
     return SANITIZE_WITH_BASE (this, list);
   }
@@ -894,10 +894,10 @@ inline bool ExtensionSubst::apply (APPLY_ARG_DEF) const
   return get_subtable ().apply (APPLY_ARG, get_type ());
 }
 
-inline bool ExtensionSubst::sanitize (SANITIZE_ARG_DEF)
+inline bool ExtensionSubst::sanitize (hb_sanitize_context_t *context)
 {
   TRACE_SANITIZE ();
-  if (unlikely (!Extension::sanitize (SANITIZE_ARG))) return false;
+  if (unlikely (!Extension::sanitize (context))) return false;
   unsigned int offset = get_offset ();
   if (unlikely (!offset)) return true;
   return SANITIZE (StructAtOffset<SubstLookupSubTable> (*this, offset));
diff --git a/src/hb-ot-layout-gsubgpos-private.hh b/src/hb-ot-layout-gsubgpos-private.hh
index c3a622b13..71fe8a62e 100644
--- a/src/hb-ot-layout-gsubgpos-private.hh
+++ b/src/hb-ot-layout-gsubgpos-private.hh
@@ -179,7 +179,7 @@ struct LookupRecord
 {
   static inline unsigned int get_size () { return sizeof (LookupRecord); }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF ();
   }
@@ -289,7 +289,7 @@ struct Rule
   }
 
   public:
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!(SANITIZE (inputCount) && SANITIZE (lookupCount))) return false;
     return SANITIZE_MEM (input,
@@ -324,7 +324,7 @@ struct RuleSet
     return false;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_WITH_BASE (this, rule);
   }
@@ -356,7 +356,7 @@ struct ContextFormat1
     return rule_set.apply (APPLY_ARG, lookup_context);
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_WITH_BASE (this, coverage)
 	&& SANITIZE_WITH_BASE (this, ruleSet);
@@ -399,7 +399,7 @@ struct ContextFormat2
     return rule_set.apply (APPLY_ARG, lookup_context);
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_WITH_BASE (this, coverage)
         && SANITIZE_WITH_BASE (this, classDef)
@@ -444,7 +444,7 @@ struct ContextFormat3
 			   lookup_context);
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE_SELF ()) return false;
     unsigned int count = glyphCount;
@@ -482,13 +482,13 @@ struct Context
     }
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE (u.format)) return false;
     switch (u.format) {
-    case 1: return u.format1->sanitize (SANITIZE_ARG);
-    case 2: return u.format2->sanitize (SANITIZE_ARG);
-    case 3: return u.format3->sanitize (SANITIZE_ARG);
+    case 1: return u.format1->sanitize (context);
+    case 2: return u.format2->sanitize (context);
+    case 3: return u.format3->sanitize (context);
     default:return true;
     }
   }
@@ -568,7 +568,7 @@ struct ChainRule
   }
 
   public:
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE (backtrack)) return false;
     HeadlessArrayOf<USHORT> &input = StructAfter<HeadlessArrayOf<USHORT> > (backtrack);
@@ -611,7 +611,7 @@ struct ChainRuleSet
     return false;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_WITH_BASE (this, rule);
   }
@@ -643,7 +643,7 @@ struct ChainContextFormat1
     return rule_set.apply (APPLY_ARG, lookup_context);
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_WITH_BASE (this, coverage)
 	&& SANITIZE_WITH_BASE (this, ruleSet);
@@ -690,7 +690,7 @@ struct ChainContextFormat2
     return rule_set.apply (APPLY_ARG, lookup_context);
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_WITH_BASE (this, coverage)
 	&& SANITIZE_WITH_BASE (this, backtrackClassDef)
@@ -752,7 +752,7 @@ struct ChainContextFormat3
     return false;
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE_WITH_BASE (this, backtrack)) return false;
     OffsetArrayOf<Coverage> &input = StructAfter<OffsetArrayOf<Coverage> > (backtrack);
@@ -797,13 +797,13 @@ struct ChainContext
     }
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE (u.format)) return false;
     switch (u.format) {
-    case 1: return u.format1->sanitize (SANITIZE_ARG);
-    case 2: return u.format2->sanitize (SANITIZE_ARG);
-    case 3: return u.format3->sanitize (SANITIZE_ARG);
+    case 1: return u.format1->sanitize (context);
+    case 2: return u.format2->sanitize (context);
+    case 3: return u.format3->sanitize (context);
     default:return true;
     }
   }
@@ -826,7 +826,7 @@ struct ExtensionFormat1
   inline unsigned int get_type (void) const { return extensionLookupType; }
   inline unsigned int get_offset (void) const { return extensionOffset; }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE_SELF ();
   }
@@ -858,11 +858,11 @@ struct Extension
     }
   }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     if (!SANITIZE (u.format)) return false;
     switch (u.format) {
-    case 1: return u.format1->sanitize (SANITIZE_ARG);
+    case 1: return u.format1->sanitize (context);
     default:return true;
     }
   }
@@ -915,7 +915,7 @@ struct GSUBGPOS
   inline const Lookup& get_lookup (unsigned int i) const
   { return (this+lookupList)[i]; }
 
-  inline bool sanitize (SANITIZE_ARG_DEF) {
+  inline bool sanitize (hb_sanitize_context_t *context) {
     TRACE_SANITIZE ();
     return SANITIZE (version) && likely (version.major == 1)
 	&& SANITIZE_WITH_BASE (this, scriptList)