A bug in the usage of the result of a binary search causes a crash in the calculation of kerning information. Here's the patch:
Explanation: The searchRange parameter is passed to binarySearch(), but the result of binarySearch() is relative to the start of the array, not the passed-in start. So no need to add searchRange to the result. Adding causes the indexing to go off the end of the array.