8273135: java/awt/color/ICC_ColorSpace/MTTransformReplacedProfile.java crashes in liblcms.dylib with NULLSeek+0x7

Reviewed-by: aivanov, azvegint

Author: mrserb

src/java.desktop/share/native/liblcms/cmsio0.c

@@ -1532,7 +1532,7 @@ cmsBool IsTypeSupported(cmsTagDescriptor* TagDescriptor, cmsTagTypeSignature Typ
 void* CMSEXPORT cmsReadTag(cmsHPROFILE hProfile, cmsTagSignature sig)
 {
     _cmsICCPROFILE* Icc = (_cmsICCPROFILE*) hProfile;
-    cmsIOHANDLER* io = Icc ->IOhandler;
+    cmsIOHANDLER* io;
     cmsTagTypeHandler* TypeHandler;
     cmsTagTypeHandler LocalTypeHandler;
     cmsTagDescriptor*  TagDescriptor;
@@ -1573,6 +1573,7 @@ void* CMSEXPORT cmsReadTag(cmsHPROFILE hProfile, cmsTagSignature sig)
 
     if (TagSize < 8) goto Error;
 
+    io = Icc ->IOhandler;
     // Seek to its location
     if (!io -> Seek(io, Offset))
         goto Error;

test/jdk/java/awt/color/ICC_ColorSpace/MTTransformReplacedProfile.java

@@ -34,7 +34,7 @@
 
 /**
  * @test
- * @bug 8271718
+ * @bug 8271718 8273135
  * @summary Verifies MT safety of color transformation while profile is changed
  */
 public final class MTTransformReplacedProfile {