From f8362c8abf538d0088100ec09e4dfb380ded861f Mon Sep 17 00:00:00 2001
From: Nico Weber <thakis@chromium.org>
Date: Sat, 27 Apr 2024 10:03:11 -0400
Subject: [PATCH] LibGfx/JPEG2000: Remove an incorrect VERIFY in TagTree
 construction

...and add a test case that shows why it's incorrect.

If one dimension is 2^n + 1 and the other side is just 1, then the
topmost node will have 2^n x 1 and 1 x 1 children. The first child will
have n levels of children. The 1 x 1 child could end immediately, or it
could require that it also has n levels of (all 1 x 1) children. The
spec isn't clear on which of the two alternatives should happen. We
currently have n levels of 1 x 1 blocks.

This test case shows that a VERIFY we had was incorrect, so remove it.

The alternative implementation is to keep the VERIFY and to add a

    if (x_count == 1 && y_count == 1)
        level = 0;

to the top of TagTreeNode::create(). Then we don't have multiple levels
of 1 x 1 nodes, and we need to read fewer bits.

The images in the spec suggest that all nodes should have the same
number of levels, so go with that interpretation for now. Once we can
actually decode images, we'll hopefully see which of the two
interpretations is correct.

(The removed VERIFY() is hit when decoding
Tests/LibGfx/test-inputs/jpeg2000/buggie-gray.jpf in a local branch that
has some image decoding implemented. That file contains a packet with
1x3 code-blocks, which hits this case.)
---
 Tests/LibGfx/TestImageDecoder.cpp             | 27 +++++++++++++++++++
 .../LibGfx/ImageFormats/JPEG2000Loader.cpp    |  1 -
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/Tests/LibGfx/TestImageDecoder.cpp b/Tests/LibGfx/TestImageDecoder.cpp
index fdf6bbb3e7b..4c144d53849 100644
--- a/Tests/LibGfx/TestImageDecoder.cpp
+++ b/Tests/LibGfx/TestImageDecoder.cpp
@@ -682,6 +682,33 @@ TEST_CASE(test_jpeg2000_tag_tree)
         EXPECT_EQ(1u, MUST(tree.read_value(2, 1, read_bit, next_layer)));
         EXPECT_EQ(index, 7u); // Didn't change!
     }
+
+    {
+        // This isn't in the spec. If one dimension is 2^n + 1 and the other side is just 1, then the topmost node will have
+        // 2^n x 1 and 1 x 1 children. The first child will have n levels of children. The 1 x 1 child could end immediately,
+        // or it could require that it also has n levels of (all 1 x 1) children. The spec isn't clear on which of
+        // the two alternatives should happen. We currently have n levels of 1 x 1 blocks.
+        constexpr auto n = 5;
+        auto tree = TRY_OR_FAIL(Gfx::JPEG2000::TagTree::create((1 << n) + 1, 1));
+        Vector<u8> bits;
+        bits.append(1); // Finalize topmost node.
+        bits.append(0); // Increment value in 1 x 1 child.
+        bits.append(1); // Finalize 1 x 1 child.
+
+        // Finalize further 1 x 1 children, if present.
+        for (size_t i = 0; i < n; ++i)
+            bits.append(1);
+
+        size_t index = 0;
+        Function<ErrorOr<bool>()> read_bit = [&]() -> bool {
+            return bits[index++];
+        };
+
+        EXPECT_EQ(1u, MUST(tree.read_value(1 << n, 0, read_bit)));
+
+        // This will read either 3 or 3 + n bits, depending on the interpretation.
+        EXPECT_EQ(index, 3u + n);
+    }
 }
 
 TEST_CASE(test_pam_rgb)
diff --git a/Userland/Libraries/LibGfx/ImageFormats/JPEG2000Loader.cpp b/Userland/Libraries/LibGfx/ImageFormats/JPEG2000Loader.cpp
index 43ba2340bcd..62b3994ba5b 100644
--- a/Userland/Libraries/LibGfx/ImageFormats/JPEG2000Loader.cpp
+++ b/Userland/Libraries/LibGfx/ImageFormats/JPEG2000Loader.cpp
@@ -942,7 +942,6 @@ struct TagTreeNode {
             return node;
         }
 
-        VERIFY(x_count > 1 || y_count > 1);
         u32 top_left_x_child_count = min(x_count, 1u << (max(level, 1) - 1));
         u32 top_left_y_child_count = min(y_count, 1u << (max(level, 1) - 1));
         for (u32 y = 0; y < 2; ++y) {