[buffer] Fix serializing of buffer with invalid direction
diff --git a/src/hb-buffer-serialize.cc b/src/hb-buffer-serialize.cc
index d7c92c6..c1e2fce 100644
--- a/src/hb-buffer-serialize.cc
+++ b/src/hb-buffer-serialize.cc
@@ -174,7 +174,7 @@
 	p += snprintf (p, ARRAY_LENGTH (b) - (p - b), "@%d,%d", pos[i].x_offset, pos[i].y_offset);
 
       *p++ = '+';
-      if (HB_DIRECTION_IS_HORIZONTAL (direction) || pos[i].x_advance)
+      if (!HB_DIRECTION_IS_VERTICAL (direction) || pos[i].x_advance)
 	p += snprintf (p, ARRAY_LENGTH (b) - (p - b), "%d", pos[i].x_advance);
       if (HB_DIRECTION_IS_VERTICAL (direction) || pos->y_advance)
 	p += snprintf (p, ARRAY_LENGTH (b) - (p - b), ",%d", pos[i].y_advance);