When an ImageReadParam is used to decode a PNG image, and the destination
Y offset is negative, the resulting image may contain incorrect pixel
values.

  The problem is caused by the fact that some source rows are decoded
but not written to the output. In the PNG format, a prior source row may
be required in order to decode the current row. This is implemented by
reading into a pair of alternating buffers, one of which receives new,
filtered data, and the other which contains the data from the previous
row after its filtering has been reversed. In the case where a row is
read but not copied into the destination, the buffer swap is not occurring,
so when the next row is read it does not have correct data for the prior row.
The fix is to have the buffer swap occur right before the read, so that
it will always take place regardless of what occurred previously.

  This bug may be reproduced using the existing regression test in
test/javax/imageio/IRPTest.java. The test will be updated to include a
source image that exhibits the buggy behavior.