The code change is at http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/31b8d4931a092cac4f

This has been backported and will appear in the upcoming 2.5.4 update:

http://icedtea.classpath.org/hg/release/icedtea7-forest-2.5/jdk/rev/993c08c0fcc7

FYI: with the fix for this, you may then run into bug 1212268.

The reproducer from JDK-8020190 still fails when both this and bug 1212268 are fixed.

Stack: [0x0000033fc2713000,0x0000033fc2814000],  sp=0x0000033fc2811d48,  free space=1019k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
C  [libfontmanager.so+0x332dc]  Java_sun_font_SunLayoutEngine_nativeLayout+0x22c
j  sun.font.SunLayoutEngine.nativeLayout(Lsun/font/Font2D;Lsun/font/FontStrike;[FII[CIIIIIIILjava/awt/geom/Point2D$Float;Lsun/f
ont/GlyphLayout$GVData;JJ)V+0
j  sun.font.SunLayoutEngine.layout(Lsun/font/FontStrikeDesc;[FIILsun/font/TextRecord;ILjava/awt/geom/Point2D$Float;Lsun/font/Gl
yphLayout$GVData;)V+98
j  sun.font.GlyphLayout$EngineRecord.layout()V+95
j  sun.font.GlyphLayout.layout(Ljava/awt/Font;Ljava/awt/font/FontRenderContext;[CIIILsun/font/StandardGlyphVector;)Lsun/font/St
andardGlyphVector;+541
j  sun.font.ExtendedTextSourceLabel.createGV()Lsun/font/StandardGlyphVector;+63
j  sun.font.ExtendedTextSourceLabel.getGV()Lsun/font/StandardGlyphVector;+9
j  sun.font.ExtendedTextSourceLabel.createLogicalBounds()Ljava/awt/geom/Rectangle2D;+1
j  sun.font.ExtendedTextSourceLabel.getAdvance()F+9
j  java.awt.font.TextLine.init()V+609
j  java.awt.font.TextLine.<init>(Ljava/awt/font/FontRenderContext;[Lsun/font/TextLineComponent;[F[CII[I[BZ)V+79
j  java.awt.font.TextLine.fastCreateTextLine(Ljava/awt/font/FontRenderContext;[CLjava/awt/Font;Lsun/font/CoreMetrics;Ljava/util/Map;)Ljava/awt/font/TextLine;+337
j  java.awt.font.TextLayout.fastInit([CLjava/awt/Font;Ljava/util/Map;Ljava/awt/font/FontRenderContext;)V+83
j  java.awt.font.TextLayout.<init>(Ljava/lang/String;Ljava/awt/Font;Ljava/awt/font/FontRenderContext;)V+124
j  JDK8020190.main([Ljava/lang/String;)V+41
v  ~StubRoutines::call_stub

I traced two issues:

1. LayoutEngine *engine = LayoutEngine::layoutEngineFactory(&fia, script, lang, typo_flags & TYPO_MASK, success);
can return NULL but the code never checks it. Thus, as soon as it
is dereferenced, the JVM segfaults. A fix for this is in OpenJDK
8: "8023052: JVM crash in native layout".

Because this was fixed in 8 before 8020190, this follow-on crash on 7 was missed.

2. Tracing through the code that leads to this NULL return, it
seems odd. In the LayoutEngineFactory function, the line
LEReferenceTo<GlyphSubstitutionTableHeader> gsubTable(fontInstance,gsubTableTag,success)
sets success to LE_INDEX_OUT_OF_BOUNDS_ERROR because
of an attempt to access element 12 from an array of length 10.
This return value is never checked at this point or reset.
So the same success value is used in:
LEReferenceTo<MorphTableHeader2> morxTable(fontInstance, morxTableTag, success);
LEReferenceTo<MorphTableHeader> mortTable(fontInstance, mortTableTag, success);
new LayoutEngine(fontInstance, scriptCode, languageCode, typoFlags, success);

causing them all to immediately fail, the LayoutEngine gets deleted
and NULL is returned.

Running the test on either OpenJDK 8 (with #1 fixed) or manually resetting
success on OpenJDK 7:

(gdb) print success
$31 = (LEErrorCode &) @0x3b31694bdb4: LE_INDEX_OUT_OF_BOUNDS_ERROR
(gdb) set success = LE_NO_ERROR
...
(gdb) next
717                                result = new LayoutEngine(fontInstance, scriptCode, languageCode, typoFlags, success);
(gdb) print success
$37 = (LEErrorCode &) @0x3b31694bdb4: LE_NO_ERROR
(gdb) next
724            if (result && LE_FAILURE(success)) {
(gdb) print success
$38 = (LEErrorCode &) @0x3b31694bdb4: LE_NO_ERROR

allows it to complete with "java.awt.Rectangle[x=-1,y=-1,width=2,height=2]"

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2015-1245.html

Issues in comment 9 will be fixed in http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=2509

and #2 in http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=2512