8028539: Endless loop in native code of sun.java2d.loops.ScaledBlit

Reviewed-by: flar, jgodinez

src/share/classes/sun/java2d/pipe/DrawImage.java

@@ -278,18 +278,34 @@ public class DrawImage implements DrawImagePipe
                                      Color bgColor, int interpType,
                                      double coords[])
     {
-        double dx = coords[0];
-        double dy = coords[1];
-        double dw = coords[2] - dx;
-        double dh = coords[3] - dy;
+        double dx1 = coords[0];
+        double dy1 = coords[1];
+        double dx2 = coords[2];
+        double dy2 = coords[3];
+        double dw = dx2 - dx1;
+        double dh = dy2 - dy1;
+
+        /* If any of the destination coordinates exceed the integer range,
+         * then the calculations performed in calls made here cannot be
+         * guaranteed to be correct, or to converge (terminate).
+         * So return out of here, deferring to code that can handle this.
+         */
+        if (dx1 < Integer.MIN_VALUE || dx1 > Integer.MAX_VALUE ||
+            dy1 < Integer.MIN_VALUE || dy1 > Integer.MAX_VALUE ||
+            dx2 < Integer.MIN_VALUE || dx2 > Integer.MAX_VALUE ||
+            dy2 < Integer.MIN_VALUE || dy2 > Integer.MAX_VALUE)
+        {
+            return false;
+        }
+
         // First check if width and height are very close to img w&h.
         if (closeToInteger(sx2-sx1, dw) && closeToInteger(sy2-sy1, dh)) {
             // Round location to nearest pixel and then test
             // if it will cause interpolation anomalies.
-            int idx = (int) Math.floor(dx + 0.5);
-            int idy = (int) Math.floor(dy + 0.5);
+            int idx = (int) Math.floor(dx1 + 0.5);
+            int idy = (int) Math.floor(dy1 + 0.5);
             if (interpType == AffineTransformOp.TYPE_NEAREST_NEIGHBOR ||
-                (closeToInteger(idx, dx) && closeToInteger(idy, dy)))
+                (closeToInteger(idx, dx1) && closeToInteger(idy, dy1)))
             {
                 renderImageCopy(sg, img, bgColor,
                                 idx, idy,
@@ -302,7 +318,7 @@ public class DrawImage implements DrawImagePipe
         if (dw > 0 && dh > 0) {
             if (renderImageScale(sg, img, bgColor, interpType,
                                  sx1, sy1, sx2, sy2,
-                                 coords[0], coords[1], coords[2], coords[3]))
+                                 dx1, dy1, dx2, dy2))
             {
                 return true;
             }

test/java/awt/image/DrawImage/DrawImageCoordsTest.java

+/*
+ * Copyright (c) 2014, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 8028539
+ * @summary Test that drawing a scaled image terminates.
+ * @run main/othervm/timeout=60 DrawImageCoordsTest
+*/
+
+import java.awt.Color;
+import java.awt.Graphics;
+import java.awt.Graphics2D;
+import java.awt.geom.AffineTransform;
+import java.awt.image.BufferedImage;
+
+public class DrawImageCoordsTest {
+
+    public static void main(String[] args) {
+
+        /* Create an image to draw, filled in solid red. */
+        BufferedImage srcImg =
+             new BufferedImage(200, 200, BufferedImage.TYPE_INT_RGB);
+        Graphics srcG = srcImg.createGraphics();
+        srcG.setColor(Color.red);
+        int w = srcImg.getWidth(null);
+        int h = srcImg.getHeight(null);
+        srcG.fillRect(0, 0, w, h);
+
+        /* Create a destination image */
+        BufferedImage dstImage =
+           new BufferedImage(200, 200, BufferedImage.TYPE_INT_RGB);
+        Graphics2D dstG = dstImage.createGraphics();
+        /* draw image under a scaling transform that overflows int */
+        AffineTransform tx = new AffineTransform(0.5, 0, 0, 0.5,
+                                                  0, 5.8658460197478485E9);
+        dstG.setTransform(tx);
+        dstG.drawImage(srcImg, 0, 0, null );
+        /* draw image under the same overflowing transform, cancelling
+         * out the 0.5 scale on the graphics
+         */
+        dstG.drawImage(srcImg, 0, 0, 2*w, 2*h, null);
+        if (Color.red.getRGB() == dstImage.getRGB(w/2, h/2)) {
+             throw new RuntimeException("Unexpected color: clipping failed.");
+        }
+        System.out.println("Test Thread Completed");
+    }
+}