Merge

.hgtags

@@ -383,3 +383,4 @@ e384420383a5b79fa0012ebcb25d8f83cff7f777 jdk-9+135
 d273dfe9a126d3bffe92072547fef2cd1361b0eb jdk-9+138
 65477538bec32963dc41153d89c4417eb46c45fc jdk-9+139
 0875007901f7d364a08220b052f0c81003e9c8c5 jdk-9+140
+9aadd2163b568d76f8969ad2fb404a63733da359 jdk-9+141

.hgtags-top-repo

@@ -383,3 +383,4 @@ d7f519b004254b19e384131d9f0d0e40e31a0fd3 jdk-9+137
 67c4388142bdf58aec8fefa4475faaa8a5d7380c jdk-9+138
 7dcf453eacae79ee86a6bcc75fd0b546fc99b48a jdk-9+139
 a5815c6098a241d3a1df64d22b84b3524e4a77df jdk-9+140
+f64afae7f1a5608e438585bbf0bc23785e69cba0 jdk-9+141

common/autoconf/flags.m4

@@ -759,6 +759,10 @@ AC_DEFUN([FLAGS_SETUP_COMPILER_FLAGS_FOR_JDK_HELPER],
         # on ppc we don't prevent gcc to omit frame pointer but do prevent strict aliasing
         $2CFLAGS_JDK="${$2CFLAGS_JDK} -fno-strict-aliasing"
         ;;
+      s390 )
+        $2COMMON_CCXXFLAGS_JDK="[$]$2COMMON_CCXXFLAGS_JDK -fno-omit-frame-pointer -mbackchain -march=z10"
+        $2CFLAGS_JDK="${$2CFLAGS_JDK} -fno-strict-aliasing"
+        ;;
       * )
         $2COMMON_CCXXFLAGS_JDK="[$]$2COMMON_CCXXFLAGS_JDK -fno-omit-frame-pointer"
         $2CFLAGS_JDK="${$2CFLAGS_JDK} -fno-strict-aliasing"
@@ -895,7 +899,7 @@ AC_DEFUN([FLAGS_SETUP_COMPILER_FLAGS_FOR_JDK_HELPER],
   elif test "x$OPENJDK_$1_OS" = xsolaris; then
     $2JVM_CFLAGS="[$]$2JVM_CFLAGS -DSOLARIS"
     $2JVM_CFLAGS="[$]$2JVM_CFLAGS -template=no%extdef -features=no%split_init \
-        -D_Crun_inline_placement -library=%none -KPIC -mt -xwe -features=no%except"
+        -D_Crun_inline_placement -library=%none -KPIC -mt -features=no%except"
   elif test "x$OPENJDK_$1_OS" = xmacosx; then
     $2COMMON_CCXXFLAGS_JDK="[$]$2COMMON_CCXXFLAGS_JDK -D_ALLBSD_SOURCE -D_DARWIN_UNLIMITED_SELECT"
     $2JVM_CFLAGS="[$]$2JVM_CFLAGS -D_ALLBSD_SOURCE"
@@ -940,6 +944,10 @@ AC_DEFUN([FLAGS_SETUP_COMPILER_FLAGS_FOR_JDK_HELPER],
       # Use Power8, this is the first CPU to support PPC64 LE with ELFv2 ABI.
       $2JVM_CFLAGS="[$]$2JVM_CFLAGS -mcpu=power7 -mtune=power8"
     fi
+  elif test "x$OPENJDK_$1_CPU" = xs390x; then
+    if test "x$OPENJDK_$1_OS" = xlinux; then
+      $2JVM_CFLAGS="[$]$2JVM_CFLAGS -mbackchain -march=z10"
+    fi
   fi
 
   if test "x$OPENJDK_$1_CPU_ENDIAN" = xlittle; then

common/autoconf/generated-configure.sh

@@ -5093,7 +5093,7 @@ VS_SDK_PLATFORM_NAME_2013=
 #CUSTOM_AUTOCONF_INCLUDE
 
 # Do not change or remove the following line, it is needed for consistency checks:
-DATE_WHEN_GENERATED=1476275292
+DATE_WHEN_GENERATED=1477490418
 
 ###############################################################################
 #
@@ -49840,6 +49840,10 @@ $as_echo "$supports" >&6; }
         # on ppc we don't prevent gcc to omit frame pointer but do prevent strict aliasing
         CFLAGS_JDK="${CFLAGS_JDK} -fno-strict-aliasing"
         ;;
+      s390 )
+        COMMON_CCXXFLAGS_JDK="$COMMON_CCXXFLAGS_JDK -fno-omit-frame-pointer -mbackchain -march=z10"
+        CFLAGS_JDK="${CFLAGS_JDK} -fno-strict-aliasing"
+        ;;
       * )
         COMMON_CCXXFLAGS_JDK="$COMMON_CCXXFLAGS_JDK -fno-omit-frame-pointer"
         CFLAGS_JDK="${CFLAGS_JDK} -fno-strict-aliasing"
@@ -50077,7 +50081,7 @@ $as_echo "$as_me: GCC >= 6 detected; adding ${NO_DELETE_NULL_POINTER_CHECKS_CFLA
   elif test "x$OPENJDK_TARGET_OS" = xsolaris; then
     JVM_CFLAGS="$JVM_CFLAGS -DSOLARIS"
     JVM_CFLAGS="$JVM_CFLAGS -template=no%extdef -features=no%split_init \
-        -D_Crun_inline_placement -library=%none -KPIC -mt -xwe -features=no%except"
+        -D_Crun_inline_placement -library=%none -KPIC -mt -features=no%except"
   elif test "x$OPENJDK_TARGET_OS" = xmacosx; then
     COMMON_CCXXFLAGS_JDK="$COMMON_CCXXFLAGS_JDK -D_ALLBSD_SOURCE -D_DARWIN_UNLIMITED_SELECT"
     JVM_CFLAGS="$JVM_CFLAGS -D_ALLBSD_SOURCE"
@@ -50122,6 +50126,10 @@ $as_echo "$as_me: GCC >= 6 detected; adding ${NO_DELETE_NULL_POINTER_CHECKS_CFLA
       # Use Power8, this is the first CPU to support PPC64 LE with ELFv2 ABI.
       JVM_CFLAGS="$JVM_CFLAGS -mcpu=power7 -mtune=power8"
     fi
+  elif test "x$OPENJDK_TARGET_CPU" = xs390x; then
+    if test "x$OPENJDK_TARGET_OS" = xlinux; then
+      JVM_CFLAGS="$JVM_CFLAGS -mbackchain -march=z10"
+    fi
   fi
 
   if test "x$OPENJDK_TARGET_CPU_ENDIAN" = xlittle; then
@@ -50655,6 +50663,10 @@ $as_echo "$supports" >&6; }
         # on ppc we don't prevent gcc to omit frame pointer but do prevent strict aliasing
         OPENJDK_BUILD_CFLAGS_JDK="${OPENJDK_BUILD_CFLAGS_JDK} -fno-strict-aliasing"
         ;;
+      s390 )
+        OPENJDK_BUILD_COMMON_CCXXFLAGS_JDK="$OPENJDK_BUILD_COMMON_CCXXFLAGS_JDK -fno-omit-frame-pointer -mbackchain -march=z10"
+        OPENJDK_BUILD_CFLAGS_JDK="${OPENJDK_BUILD_CFLAGS_JDK} -fno-strict-aliasing"
+        ;;
       * )
         OPENJDK_BUILD_COMMON_CCXXFLAGS_JDK="$OPENJDK_BUILD_COMMON_CCXXFLAGS_JDK -fno-omit-frame-pointer"
         OPENJDK_BUILD_CFLAGS_JDK="${OPENJDK_BUILD_CFLAGS_JDK} -fno-strict-aliasing"
@@ -50892,7 +50904,7 @@ $as_echo "$as_me: GCC >= 6 detected; adding ${NO_DELETE_NULL_POINTER_CHECKS_CFLA
   elif test "x$OPENJDK_BUILD_OS" = xsolaris; then
     OPENJDK_BUILD_JVM_CFLAGS="$OPENJDK_BUILD_JVM_CFLAGS -DSOLARIS"
     OPENJDK_BUILD_JVM_CFLAGS="$OPENJDK_BUILD_JVM_CFLAGS -template=no%extdef -features=no%split_init \
-        -D_Crun_inline_placement -library=%none -KPIC -mt -xwe -features=no%except"
+        -D_Crun_inline_placement -library=%none -KPIC -mt -features=no%except"
   elif test "x$OPENJDK_BUILD_OS" = xmacosx; then
     OPENJDK_BUILD_COMMON_CCXXFLAGS_JDK="$OPENJDK_BUILD_COMMON_CCXXFLAGS_JDK -D_ALLBSD_SOURCE -D_DARWIN_UNLIMITED_SELECT"
     OPENJDK_BUILD_JVM_CFLAGS="$OPENJDK_BUILD_JVM_CFLAGS -D_ALLBSD_SOURCE"
@@ -50937,6 +50949,10 @@ $as_echo "$as_me: GCC >= 6 detected; adding ${NO_DELETE_NULL_POINTER_CHECKS_CFLA
       # Use Power8, this is the first CPU to support PPC64 LE with ELFv2 ABI.
       OPENJDK_BUILD_JVM_CFLAGS="$OPENJDK_BUILD_JVM_CFLAGS -mcpu=power7 -mtune=power8"
     fi
+  elif test "x$OPENJDK_BUILD_CPU" = xs390x; then
+    if test "x$OPENJDK_BUILD_OS" = xlinux; then
+      OPENJDK_BUILD_JVM_CFLAGS="$OPENJDK_BUILD_JVM_CFLAGS -mbackchain -march=z10"
+    fi
   fi
 
   if test "x$OPENJDK_BUILD_CPU_ENDIAN" = xlittle; then

common/autoconf/spec.gmk.in

@@ -265,6 +265,10 @@ IMAGES_OUTPUTDIR=$(BUILD_OUTPUT)/images
 BUNDLES_OUTPUTDIR=$(BUILD_OUTPUT)/bundles
 TESTMAKE_OUTPUTDIR=$(BUILD_OUTPUT)/test-make
 MAKESUPPORT_OUTPUTDIR=$(BUILD_OUTPUT)/make-support
+
+# By default, output javadoc directly into image
+JAVADOC_OUTPUTDIR = $(DOCS_IMAGE_DIR)
+
 # This does not get overridden in a bootcycle build
 CONFIGURESUPPORT_OUTPUTDIR:=@CONFIGURESUPPORT_OUTPUTDIR@
 BUILDJDK_OUTPUTDIR=$(BUILD_OUTPUT)/buildjdk
@@ -788,7 +792,7 @@ INTERIM_IMAGE_DIR := $(SUPPORT_OUTPUTDIR)/interim-image
 
 # Docs image
 DOCS_IMAGE_SUBDIR := docs
-DOCS_IMAGE_DIR := $(IMAGES_OUTPUTDIR)/$(DOCS_IMAGE_SUBDIR)
+DOCS_IMAGE_DIR = $(IMAGES_OUTPUTDIR)/$(DOCS_IMAGE_SUBDIR)
 
 # Macosx bundles directory definitions
 JDK_MACOSX_BUNDLE_SUBDIR=jdk-bundle

corba/.hgtags

@@ -383,3 +383,4 @@ aa053a3faf266c12b4fd5272da431a3e08e4a3e3 jdk-9+136
 27bb44be32076861a0951bcefb07a1d92509a4b6 jdk-9+138
 8c9da7fc5b07c606afd571c7012441b77dda83b2 jdk-9+139
 9f3fc931bc230f44f2a58d75f7f6360af98bb113 jdk-9+140
+b32f998da32b488ec7c4e9dbb3c750841b48e74d jdk-9+141

corba/src/java.corba/share/classes/com/sun/corba/se/impl/io/IIOPInputStream.java

@@ -31,22 +31,17 @@
 
 package com.sun.corba.se.impl.io;
 
-import java.io.InputStream;
 import java.io.IOException;
 import java.io.StreamCorruptedException;
 import java.io.ObjectInputValidation;
 import java.io.NotActiveException;
 import java.io.InvalidObjectException;
 import java.io.InvalidClassException;
-import java.io.DataInputStream;
 import java.io.OptionalDataException;
-import java.io.WriteAbortedException;
 import java.io.Externalizable;
 import java.io.EOFException;
 import java.lang.reflect.*;
 import java.util.Vector;
-import java.util.Stack;
-import java.util.Hashtable;
 import java.util.Enumeration;
 
 import sun.corba.Bridge ;
@@ -54,7 +49,6 @@ import sun.corba.Bridge ;
 import java.security.AccessController ;
 import java.security.PrivilegedAction ;
 
-import com.sun.corba.se.impl.io.ObjectStreamClass;
 import com.sun.corba.se.impl.util.Utility;
 
 import org.omg.CORBA.portable.ValueInputStream;
@@ -71,14 +65,12 @@ import org.omg.CORBA.TypeCode;
 import com.sun.org.omg.CORBA.ValueDefPackage.FullValueDescription;
 import com.sun.org.omg.SendingContext.CodeBase;
 
-import javax.rmi.PortableRemoteObject;
 import javax.rmi.CORBA.Util;
 import javax.rmi.CORBA.ValueHandler;
 
 import java.security.*;
 import java.util.*;
 
-import com.sun.corba.se.impl.orbutil.ObjectUtility ;
 import com.sun.corba.se.impl.logging.OMGSystemException ;
 import com.sun.corba.se.impl.logging.UtilSystemException ;
 
@@ -182,75 +174,6 @@ public class IIOPInputStream
 
     private byte streamFormatVersion;
 
-    // Since java.io.OptionalDataException's constructors are
-    // package private, but we need to throw it in some special
-    // cases, we try to do it by reflection.
-    private static final Constructor OPT_DATA_EXCEPTION_CTOR;
-
-    private Object[] readObjectArgList = { this } ;
-
-    static {
-        OPT_DATA_EXCEPTION_CTOR = getOptDataExceptionCtor();
-    }
-
-    // Grab the OptionalDataException boolean ctor and make
-    // it accessible.  Note that any exceptions
-    // will be wrapped in ExceptionInInitializerErrors.
-    private static Constructor getOptDataExceptionCtor() {
-
-        try {
-
-            Constructor result =
-
-                (Constructor) AccessController.doPrivileged(
-                                    new PrivilegedExceptionAction() {
-                    public java.lang.Object run()
-                        throws NoSuchMethodException,
-                        SecurityException {
-
-                        Constructor boolCtor
-                            = OptionalDataException.class.getDeclaredConstructor(
-                                                               new Class[] {
-                                Boolean.TYPE });
-
-                        boolCtor.setAccessible(true);
-
-                        return boolCtor;
-                    }});
-
-            if (result == null)
-                // XXX I18N, logging needed.
-                throw new Error("Unable to find OptionalDataException constructor");
-
-            return result;
-
-        } catch (Exception ex) {
-            // XXX I18N, logging needed.
-            throw new ExceptionInInitializerError(ex);
-        }
-    }
-
-    // Create a new OptionalDataException with the EOF marker
-    // set to true.  See handleOptionalDataMarshalException.
-    private OptionalDataException createOptionalDataException() {
-        try {
-            OptionalDataException result
-                = (OptionalDataException)
-                   OPT_DATA_EXCEPTION_CTOR.newInstance(new Object[] {
-                       Boolean.TRUE });
-
-            if (result == null)
-                // XXX I18N, logging needed.
-                throw new Error("Created null OptionalDataException");
-
-            return result;
-
-        } catch (Exception ex) {
-            // XXX I18N, logging needed.
-            throw new Error("Couldn't create OptionalDataException", ex);
-        }
-    }
-
     // Return the stream format version currently being used
     // to deserialize an object
     protected byte getStreamFormatVersion() {
@@ -395,7 +318,6 @@ public class IIOPInputStream
                                   int offset)
                                          /* throws OptionalDataException, ClassNotFoundException, IOException */
     {
-
         /* Save the current state and get ready to read an object. */
         Object prevObject = currentObject;
         ObjectStreamClass prevClassDesc = currentClassDesc;
@@ -947,7 +869,7 @@ public class IIOPInputStream
             if (!objectRead)
                 result = new EOFException("No more optional data");
             else
-                result = createOptionalDataException();
+                result = bridge.newOptionalDataExceptionForSerialization(true);
 
             result.initCause(marshalException);
 
@@ -1230,8 +1152,7 @@ public class IIOPInputStream
 
                                 readObjectState.beginUnmarshalCustomValue(this,
                                                                           calledDefaultWriteObject,
-                                                                          (currentClassDesc.readObjectMethod
-                                                                           != null));
+                                                                          currentClassDesc.hasReadObject());
                             } else {
                                 if (currentClassDesc.hasReadObject())
                                     setState(IN_READ_OBJECT_REMOTE_NOT_CUSTOM_MARSHALED);
@@ -1556,8 +1477,7 @@ public class IIOPInputStream
 
                                 readObjectState.beginUnmarshalCustomValue(this,
                                                                           calledDefaultWriteObject,
-                                                                          (currentClassDesc.readObjectMethod
-                                                                           != null));
+                                                                          currentClassDesc.hasReadObject());
                             }
 
                             boolean usedReadObject = false;
@@ -1714,13 +1634,8 @@ public class IIOPInputStream
         throws InvalidClassException, StreamCorruptedException,
                ClassNotFoundException, IOException
     {
-        if (osc.readObjectMethod == null) {
-            return false;
-        }
-
         try {
-            osc.readObjectMethod.invoke( obj, readObjectArgList ) ;
-            return true;
+            return osc.invokeReadObject( obj, this ) ;
         } catch (InvocationTargetException e) {
             Throwable t = e.getTargetException();
             if (t instanceof ClassNotFoundException)
@@ -1734,8 +1649,6 @@ public class IIOPInputStream
             else
                 // XXX I18N, logging needed.
                 throw new Error("internal error");
-        } catch (IllegalAccessException e) {
-            return false;
         }
     }
 

corba/src/java.corba/share/classes/com/sun/corba/se/impl/io/IIOPOutputStream.java

@@ -31,33 +31,23 @@
 
 package com.sun.corba.se.impl.io;
 
-import org.omg.CORBA.INTERNAL;
 import org.omg.CORBA.portable.OutputStream;
 
 import java.security.AccessController ;
 import java.security.PrivilegedAction ;
 
 import java.io.IOException;
-import java.io.DataOutputStream;
-import java.io.Serializable;
 import java.io.InvalidClassException;
-import java.io.StreamCorruptedException;
 import java.io.Externalizable;
-import java.io.ObjectStreamException;
 import java.io.NotSerializableException;
 import java.io.NotActiveException;
 
 import java.lang.reflect.InvocationTargetException;
-import java.lang.reflect.Field;
-
-import java.util.Stack;
 
 import javax.rmi.CORBA.Util;
-import javax.rmi.CORBA.ValueHandlerMultiFormat;
 
 import sun.corba.Bridge ;
 
-import com.sun.corba.se.impl.io.ObjectStreamClass;
 import com.sun.corba.se.impl.util.Utility;
 import com.sun.corba.se.impl.util.RepositoryId;
 
@@ -621,7 +611,7 @@ public class IIOPOutputStream
             writeObjectState.enterWriteObject(this);
 
             // writeObject(obj, c, this);
-            osc.writeObjectMethod.invoke( obj, writeObjectArgList ) ;
+            osc.invokeWriteObject( obj, this ) ;
 
             writeObjectState.exitWriteObject(this);
 
@@ -636,8 +626,6 @@ public class IIOPOutputStream
             else
                 // XXX I18N, Logging needed.
                 throw new Error("invokeObjectWriter internal error",e);
-        } catch (IllegalAccessException e) {
-            // cannot happen
         }
     }
 
@@ -761,59 +749,52 @@ public class IIOPOutputStream
      */
     private void outputClassFields(Object o, Class cl,
                                    ObjectStreamField[] fields)
-        throws IOException, InvalidClassException {
+        throws IOException {
 
         for (int i = 0; i < fields.length; i++) {
             if (fields[i].getField() == null)
-                // XXX I18N, Logging needed.
                 throw new InvalidClassException(cl.getName(),
                                                 "Nonexistent field " + fields[i].getName());
-
-            try {
-                switch (fields[i].getTypeCode()) {
-                    case 'B':
-                        byte byteValue = fields[i].getField().getByte( o ) ;
-                        orbStream.write_octet(byteValue);
-                        break;
-                    case 'C':
-                        char charValue = fields[i].getField().getChar( o ) ;
-                        orbStream.write_wchar(charValue);
-                        break;
-                    case 'F':
-                        float floatValue = fields[i].getField().getFloat( o ) ;
-                        orbStream.write_float(floatValue);
-                        break;
-                    case 'D' :
-                        double doubleValue = fields[i].getField().getDouble( o ) ;
-                        orbStream.write_double(doubleValue);
-                        break;
-                    case 'I':
-                        int intValue = fields[i].getField().getInt( o ) ;
-                        orbStream.write_long(intValue);
-                        break;
-                    case 'J':
-                        long longValue = fields[i].getField().getLong( o ) ;
-                        orbStream.write_longlong(longValue);
-                        break;
-                    case 'S':
-                        short shortValue = fields[i].getField().getShort( o ) ;
-                        orbStream.write_short(shortValue);
-                        break;
-                    case 'Z':
-                        boolean booleanValue = fields[i].getField().getBoolean( o ) ;
-                        orbStream.write_boolean(booleanValue);
-                        break;
-                    case '[':
-                    case 'L':
-                        Object objectValue = fields[i].getField().get( o ) ;
-                        writeObjectField(fields[i], objectValue);
-                        break;
-                    default:
-                        // XXX I18N, Logging needed.
-                        throw new InvalidClassException(cl.getName());
-                }
-            } catch (IllegalAccessException exc) {
-                throw wrapper.illegalFieldAccess( exc, fields[i].getName() ) ;
+            switch (fields[i].getTypeCode()) {
+                case 'B':
+                    byte byteValue = bridge.getByte(o, fields[i].getFieldID()) ;
+                    orbStream.write_octet(byteValue);
+                    break;
+                case 'C':
+                    char charValue = bridge.getChar(o, fields[i].getFieldID()) ;
+                    orbStream.write_wchar(charValue);
+                    break;
+                case 'F':
+                    float floatValue = bridge.getFloat(o, fields[i].getFieldID()) ;
+                    orbStream.write_float(floatValue);
+                    break;
+                case 'D' :
+                    double doubleValue = bridge.getDouble(o, fields[i].getFieldID()) ;
+                    orbStream.write_double(doubleValue);
+                    break;
+                case 'I':
+                    int intValue = bridge.getInt(o, fields[i].getFieldID()) ;
+                    orbStream.write_long(intValue);
+                    break;
+                case 'J':
+                    long longValue = bridge.getLong(o, fields[i].getFieldID()) ;
+                    orbStream.write_longlong(longValue);
+                    break;
+                case 'S':
+                    short shortValue = bridge.getShort(o, fields[i].getFieldID()) ;
+                    orbStream.write_short(shortValue);
+                    break;
+                case 'Z':
+                    boolean booleanValue = bridge.getBoolean(o, fields[i].getFieldID()) ;
+                    orbStream.write_boolean(booleanValue);
+                    break;
+                case '[':
+                case 'L':
+                    Object objectValue = bridge.getObject(o, fields[i].getFieldID()) ;
+                    writeObjectField(fields[i], objectValue);
+                    break;
+                default:
+                    throw new InvalidClassException(cl.getName());
             }
         }
     }

corba/src/java.corba/share/classes/com/sun/corba/se/impl/io/ObjectStreamClass.java

@@ -31,16 +31,16 @@
 
 package com.sun.corba.se.impl.io;
 
+import java.io.ObjectInputStream;
+import java.io.ObjectOutputStream;
+import java.lang.invoke.MethodHandle;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import java.security.DigestOutputStream;
 import java.security.AccessController;
-import java.security.PrivilegedExceptionAction;
-import java.security.PrivilegedActionException;
 import java.security.PrivilegedAction;
 
 import java.lang.reflect.Modifier;
-import java.lang.reflect.Array;
 import java.lang.reflect.Field;
 import java.lang.reflect.Member;
 import java.lang.reflect.Method;
@@ -80,9 +80,6 @@ public class ObjectStreamClass implements java.io.Serializable {
 
     public static final long kDefaultUID = -1;
 
-    private static Object noArgsList[] = {};
-    private static Class<?> noTypesList[] = {};
-
     /** true if represents enum type */
     private boolean isEnum;
 
@@ -311,12 +308,37 @@ public class ObjectStreamClass implements java.io.Serializable {
         return null;
     }
 
+    public final boolean invokeWriteObject(Object obj, ObjectOutputStream ois) throws InvocationTargetException {
+        if (!hasWriteObject()) {
+            return false;
+        }
+        try {
+            writeObjectMethod.invoke(obj, ois);
+        } catch (Throwable t) {
+            throw new InvocationTargetException(t, "writeObject");
+        }
+        return true;
+    }
+
+    public final boolean invokeReadObject(Object obj, ObjectInputStream ois) throws InvocationTargetException {
+        if (hasReadObject()) {
+            try {
+                readObjectMethod.invoke(obj, ois);
+                return true;
+            } catch (Throwable t) {
+                throw new InvocationTargetException(t, "readObject");
+            }
+        } else {
+            return false;
+        }
+    }
+
     public Serializable writeReplace(Serializable value) {
         if (writeReplaceObjectMethod != null) {
             try {
-                return (Serializable) writeReplaceObjectMethod.invoke(value,noArgsList);
-            } catch(Throwable t) {
-                throw new RuntimeException(t);
+                return (Serializable) writeReplaceObjectMethod.invoke(value);
+            } catch (Throwable t) {
+                throw new InternalError("unexpected error", t);
             }
         }
         else return value;
@@ -325,9 +347,9 @@ public class ObjectStreamClass implements java.io.Serializable {
     public Object readResolve(Object value) {
         if (readResolveObjectMethod != null) {
             try {
-                return readResolveObjectMethod.invoke(value,noArgsList);
-            } catch(Throwable t) {
-                throw new RuntimeException(t);
+                return readResolveObjectMethod.invoke(value);
+            } catch (Throwable t) {
+                throw new InternalError("unexpected error", t);
             }
         }
         else return value;
@@ -382,31 +404,34 @@ public class ObjectStreamClass implements java.io.Serializable {
          */
     }
 
-    private static final class PersistentFieldsValue
+    static final class PersistentFieldsValue
             extends ClassValue<ObjectStreamField[]> {
         PersistentFieldsValue() { }
 
         protected ObjectStreamField[] computeValue(Class<?> type) {
             try {
+                bridge.ensureClassInitialized(type);
                 Field pf = type.getDeclaredField("serialPersistentFields");
                 int mods = pf.getModifiers();
                 if (Modifier.isPrivate(mods) && Modifier.isStatic(mods) &&
                         Modifier.isFinal(mods)) {
-                    pf.setAccessible(true);
+                    long offset = bridge.staticFieldOffset(pf);
                     java.io.ObjectStreamField[] fields =
-                        (java.io.ObjectStreamField[])pf.get(type);
+                            (java.io.ObjectStreamField[])bridge.getObject(type, offset);
                     return translateFields(fields);
                 }
-            } catch (NoSuchFieldException | IllegalAccessException |
+            } catch (NoSuchFieldException |
                     IllegalArgumentException | ClassCastException e) {
             }
             return null;
         }
 
-        private static ObjectStreamField[] translateFields(
-            java.io.ObjectStreamField[] fields) {
+        private static ObjectStreamField[] translateFields(java.io.ObjectStreamField[] fields) {
+            if (fields == null) {
+                return null;
+            }
             ObjectStreamField[] translation =
-                new ObjectStreamField[fields.length];
+                    new ObjectStreamField[fields.length];
             for (int i = 0; i < fields.length; i++) {
                 translation[i] = new ObjectStreamField(fields[i].getName(),
                         fields[i].getType());
@@ -450,13 +475,11 @@ public class ObjectStreamClass implements java.io.Serializable {
                  * If it is declared, use the declared serialPersistentFields.
                  * Otherwise, extract the fields from the class itself.
                  */
-                    fields = persistentFieldsValue.get(cl);
+                fields = persistentFieldsValue.get(cl);
 
                 if (fields == null) {
-                    /* Get all of the declared fields for this
-                     * Class. setAccessible on all fields so they
-                     * can be accessed later.  Create a temporary
-                     * ObjectStreamField array to hold each
+                    /* Get all of the declared fields for this Class.
+                     * Create a temporary ObjectStreamField array to hold each
                      * non-static, non-transient field. Then copy the
                      * temporary array into an array of the correct
                      * size once the number of fields is known.
@@ -471,7 +494,6 @@ public class ObjectStreamClass implements java.io.Serializable {
                         int modifiers = fld.getModifiers();
                         if (!Modifier.isStatic(modifiers) &&
                             !Modifier.isTransient(modifiers)) {
-                            fld.setAccessible(true) ;
                             tempFields[numFields++] = new ObjectStreamField(fld);
                         }
                     }
@@ -487,7 +509,6 @@ public class ObjectStreamClass implements java.io.Serializable {
                         try {
                             Field reflField = cl.getDeclaredField(fields[j].getName());
                             if (fields[j].getType() == reflField.getType()) {
-                                reflField.setAccessible(true);
                                 fields[j].setField(reflField);
                             }
                         } catch (NoSuchFieldException e) {
@@ -527,8 +548,8 @@ public class ObjectStreamClass implements java.io.Serializable {
                         int mods = f.getModifiers();
                         // SerialBug 5:  static final SUID should be read
                         if (Modifier.isStatic(mods) && Modifier.isFinal(mods) ) {
-                            f.setAccessible(true);
-                            suid = f.getLong(cl);
+                            long offset = bridge.staticFieldOffset(f);
+                            suid = bridge.getLong(cl, offset);
                             // SerialBug 2: should be computed after writeObject
                             // actualSuid = computeStructuralUID(cl);
                         } else {
@@ -540,16 +561,12 @@ public class ObjectStreamClass implements java.io.Serializable {
                         suid = _computeSerialVersionUID(cl);
                         // SerialBug 2: should be computed after writeObject
                         // actualSuid = computeStructuralUID(cl);
-                    } catch (IllegalAccessException ex) {
-                        suid = _computeSerialVersionUID(cl);
                     }
                 }
 
-                writeReplaceObjectMethod = ObjectStreamClass.getInheritableMethod(cl,
-                    "writeReplace", noTypesList, Object.class);
+                writeReplaceObjectMethod = bridge.writeReplaceForSerialization(cl);
 
-                readResolveObjectMethod = ObjectStreamClass.getInheritableMethod(cl,
-                    "readResolve", noTypesList, Object.class);
+                readResolveObjectMethod = bridge.readResolveForSerialization(cl);
 
                 if (externalizable)
                     cons = getExternalizableConstructor(cl) ;
@@ -557,14 +574,8 @@ public class ObjectStreamClass implements java.io.Serializable {
                     cons = getSerializableConstructor(cl) ;
 
                 if (serializable && !forProxyClass) {
-                    /* Look for the writeObject method
-                     * Set the accessible flag on it here. ObjectOutputStream
-                     * will call it as necessary.
-                     */
-                    writeObjectMethod = getPrivateMethod( cl, "writeObject",
-                        new Class<?>[] { java.io.ObjectOutputStream.class }, Void.TYPE ) ;
-                    readObjectMethod = getPrivateMethod( cl, "readObject",
-                        new Class<?>[] { java.io.ObjectInputStream.class }, Void.TYPE ) ;
+                    writeObjectMethod = bridge.writeObjectForSerialization(cl) ;
+                    readObjectMethod = bridge.readObjectForSerialization(cl);
                 }
                 return null;
             }
@@ -585,27 +596,6 @@ public class ObjectStreamClass implements java.io.Serializable {
       }
     }
 
-    /**
-     * Returns non-static private method with given signature defined by given
-     * class, or null if none found.  Access checks are disabled on the
-     * returned method (if any).
-     */
-    private static Method getPrivateMethod(Class<?> cl, String name,
-                                           Class<?>[] argTypes,
-                                           Class<?> returnType)
-    {
-        try {
-            Method meth = cl.getDeclaredMethod(name, argTypes);
-            meth.setAccessible(true);
-            int mods = meth.getModifiers();
-            return ((meth.getReturnType() == returnType) &&
-                    ((mods & Modifier.STATIC) == 0) &&
-                    ((mods & Modifier.PRIVATE) != 0)) ? meth : null;
-        } catch (NoSuchMethodException ex) {
-            return null;
-        }
-    }
-
     // Specific to RMI-IIOP
     /**
      * Java to IDL ptc-02-01-12 1.5.1
@@ -848,6 +838,22 @@ public class ObjectStreamClass implements java.io.Serializable {
         return writeObjectMethod != null ;
     }
 
+    /**
+     * Returns true if represented class is serializable or externalizable and
+     * defines a conformant writeReplace method.  Otherwise, returns false.
+     */
+    boolean hasWriteReplaceMethod() {
+        return (writeReplaceObjectMethod != null);
+    }
+
+    /**
+     * Returns true if represented class is serializable or externalizable and
+     * defines a conformant readResolve method.  Otherwise, returns false.
+     */
+    boolean hasReadResolveMethod() {
+        return (readResolveObjectMethod != null);
+    }
+
     /**
      * Returns when or not this class should be custom
      * marshaled (use chunking).  This should happen if
@@ -904,7 +910,7 @@ public class ObjectStreamClass implements java.io.Serializable {
     {
         if (cons != null) {
             try {
-                return cons.newInstance(new Object[0]);
+                return cons.newInstance();
             } catch (IllegalAccessException ex) {
                 // should not occur, as access checks have been suppressed
                 InternalError ie = new InternalError();
@@ -912,7 +918,7 @@ public class ObjectStreamClass implements java.io.Serializable {
                 throw ie ;
             }
         } else {
-            throw new UnsupportedOperationException();
+            throw new UnsupportedOperationException("no constructor for " + ofClass);
         }
     }
 
@@ -921,15 +927,8 @@ public class ObjectStreamClass implements java.io.Serializable {
      * Access checks are disabled on the returned constructor (if any), since
      * the defining class may still be non-public.
      */
-    private static Constructor getExternalizableConstructor(Class<?> cl) {
-        try {
-            Constructor cons = cl.getDeclaredConstructor(new Class<?>[0]);
-            cons.setAccessible(true);
-            return ((cons.getModifiers() & Modifier.PUBLIC) != 0) ?
-                cons : null;
-        } catch (NoSuchMethodException ex) {
-            return null;
-        }
+    private static Constructor<?> getExternalizableConstructor(Class<?> cl) {
+        return bridge.newConstructorForExternalization(cl);
     }
 
     /**
@@ -937,28 +936,8 @@ public class ObjectStreamClass implements java.io.Serializable {
      * superclass, or null if none found.  Access checks are disabled on the
      * returned constructor (if any).
      */
-    private static Constructor getSerializableConstructor(Class<?> cl) {
-        Class<?> initCl = cl;
-        while (Serializable.class.isAssignableFrom(initCl)) {
-            if ((initCl = initCl.getSuperclass()) == null) {
-                return null;
-            }
-        }
-        try {
-            Constructor cons = initCl.getDeclaredConstructor(new Class<?>[0]);
-            int mods = cons.getModifiers();
-            if ((mods & Modifier.PRIVATE) != 0 ||
-                ((mods & (Modifier.PUBLIC | Modifier.PROTECTED)) == 0 &&
-                 !packageEquals(cl, initCl)))
-            {
-                return null;
-            }
-            cons = bridge.newConstructorForSerialization(cl, cons);
-            cons.setAccessible(true);
-            return cons;
-        } catch (NoSuchMethodException ex) {
-            return null;
-        }
+    private static Constructor<?> getSerializableConstructor(Class<?> cl) {
+        return bridge.newConstructorForSerialization(cl);
     }
 
     /*
@@ -1522,11 +1501,11 @@ public class ObjectStreamClass implements java.io.Serializable {
      * @since JDK 1.2
      */
     private boolean hasExternalizableBlockData;
-    Method writeObjectMethod;
-    Method readObjectMethod;
-    private transient Method writeReplaceObjectMethod;
-    private transient Method readResolveObjectMethod;
-    private Constructor cons ;
+    private transient MethodHandle writeObjectMethod;
+    private transient MethodHandle readObjectMethod;
+    private transient MethodHandle writeReplaceObjectMethod;
+    private transient MethodHandle readResolveObjectMethod;
+    private transient Constructor<?> cons;
 
     /**
      * Beginning in Java to IDL ptc/02-01-12, RMI-IIOP has a
@@ -1543,44 +1522,12 @@ public class ObjectStreamClass implements java.io.Serializable {
      */
     private ObjectStreamClass localClassDesc;
 
-    /* Find out if the class has a static class initializer <clinit> */
-    private static Method hasStaticInitializerMethod = null;
     /**
      * Returns true if the given class defines a static initializer method,
      * false otherwise.
      */
     private static boolean hasStaticInitializer(Class<?> cl) {
-        if (hasStaticInitializerMethod == null) {
-            Class<?> classWithThisMethod = null;
-
-            try {
-                if (classWithThisMethod == null)
-                    classWithThisMethod = java.io.ObjectStreamClass.class;
-
-                hasStaticInitializerMethod =
-                    classWithThisMethod.getDeclaredMethod("hasStaticInitializer",
-                                                          new Class<?>[] { Class.class });
-            } catch (NoSuchMethodException ex) {
-            }
-
-            if (hasStaticInitializerMethod == null) {
-                // XXX I18N, logging needed
-                throw new InternalError("Can't find hasStaticInitializer method on "
-                                        + classWithThisMethod.getName());
-            }
-            hasStaticInitializerMethod.setAccessible(true);
-        }
-
-        try {
-            Boolean retval = (Boolean)
-                hasStaticInitializerMethod.invoke(null, new Object[] { cl });
-            return retval.booleanValue();
-        } catch (Exception ex) {
-            // XXX I18N, logging needed
-            InternalError ie = new InternalError( "Error invoking hasStaticInitializer" ) ;
-            ie.initCause( ex ) ;
-            throw ie ;
-        }
+        return bridge.hasStaticInitializerForSerialization(cl);
     }
 
 
@@ -1754,7 +1701,6 @@ public class ObjectStreamClass implements java.io.Serializable {
         if ((meth == null) || (meth.getReturnType() != returnType)) {
             return null;
         }
-        meth.setAccessible(true);
         int mods = meth.getModifiers();
         if ((mods & (Modifier.STATIC | Modifier.ABSTRACT)) != 0) {
             return null;

corba/src/java.corba/share/classes/module-info.java

@@ -32,6 +32,7 @@ module java.corba {
     requires java.logging;
     requires java.naming;
     requires java.transaction;
+    requires jdk.unsupported;
 
     exports javax.activity;
     exports javax.rmi;

corba/src/java.corba/share/classes/sun/corba/Bridge.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2004, 2016, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -25,25 +25,24 @@
 
 package sun.corba ;
 
+import java.io.OptionalDataException;
+import java.lang.invoke.MethodHandle;
 import java.lang.reflect.Field ;
-import java.lang.reflect.Method ;
 import java.lang.reflect.Constructor ;
-import java.lang.reflect.InvocationTargetException ;
-
-import java.io.ObjectInputStream ;
 
 import java.security.AccessController;
 import java.security.Permission;
 import java.security.PrivilegedAction;
 
-import jdk.internal.misc.Unsafe ;
-import jdk.internal.reflect.ReflectionFactory;
+import sun.misc.Unsafe;
+import sun.reflect.ReflectionFactory;
 
 /** This class provides the methods for fundamental JVM operations
  * needed in the ORB that are not part of the public Java API.  This includes:
  * <ul>
  * <li>throwException, which can throw undeclared checked exceptions.
- * This is needed to handle throwing arbitrary exceptions across a standardized OMG interface that (incorrectly) does not specify appropriate exceptions.</li>
+ * This is needed to handle throwing arbitrary exceptions across a standardized
+ * OMG interface that (incorrectly) does not specify appropriate exceptions.</li>
  * <li>putXXX/getXXX methods that allow unchecked access to fields of objects.
  * This is used for setting uninitialzed non-static final fields (which is
  * impossible with reflection) and for speed.</li>
@@ -71,88 +70,28 @@ import jdk.internal.reflect.ReflectionFactory;
  */
 public final class Bridge
 {
-    private static final Class[] NO_ARGS = new Class[] {};
     private static final Permission getBridgePermission =
-        new BridgePermission( "getBridge" ) ;
+            new BridgePermission("getBridge");
     private static Bridge bridge = null ;
 
-    // latestUserDefinedLoader() is a private static method
-    // in ObjectInputStream in JDK 1.3 through 1.5.
-    // We use reflection in a doPrivileged block to get a
-    // Method reference and make it accessible.
-    private final Method latestUserDefinedLoaderMethod ;
-    private final Unsafe unsafe ;
+    /** Access to Unsafe to read/write fields. */
+    private static final Unsafe unsafe = AccessController.doPrivileged(
+            (PrivilegedAction<Unsafe>)() -> {
+                try {
+                    Field field = Unsafe.class.getDeclaredField("theUnsafe");
+                    field.setAccessible(true);
+                    return (Unsafe)field.get(null);
+
+                } catch (NoSuchFieldException |IllegalAccessException ex) {
+                    throw new InternalError("Unsafe.theUnsafe field not available", ex);
+                }
+            }
+    ) ;
+
     private final ReflectionFactory reflectionFactory ;
 
-    private Method getLatestUserDefinedLoaderMethod()
-    {
-        return (Method) AccessController.doPrivileged(
-            new PrivilegedAction()
-            {
-                public Object run()
-                {
-                    Method result = null;
-
-                    try {
-                        Class io = ObjectInputStream.class;
-                        result = io.getDeclaredMethod(
-                            "latestUserDefinedLoader", NO_ARGS);
-                        result.setAccessible(true);
-                    } catch (NoSuchMethodException nsme) {
-                        Error err = new Error( "java.io.ObjectInputStream" +
-                            " latestUserDefinedLoader " + nsme );
-                        err.initCause(nsme) ;
-                        throw err ;
-                    }
-
-                    return result;
-                }
-            }
-        );
-    }
-
-    private Unsafe getUnsafe() {
-        Field fld = (Field)AccessController.doPrivileged(
-            new PrivilegedAction()
-            {
-                public Object run()
-                {
-                    Field fld = null ;
-
-                    try {
-                        Class unsafeClass = jdk.internal.misc.Unsafe.class ;
-                        fld = unsafeClass.getDeclaredField( "theUnsafe" ) ;
-                        fld.setAccessible( true ) ;
-                        return fld ;
-                    } catch (NoSuchFieldException exc) {
-                        Error err = new Error( "Could not access Unsafe" ) ;
-                        err.initCause( exc ) ;
-                        throw err ;
-                    }
-                }
-            }
-        ) ;
-
-        Unsafe unsafe = null;
-
-        try {
-            unsafe = (Unsafe)(fld.get( null )) ;
-        } catch (Throwable t) {
-            Error err = new Error( "Could not access Unsafe" ) ;
-            err.initCause( t ) ;
-            throw err ;
-        }
-
-        return unsafe ;
-    }
-
-
-    private Bridge()
-    {
-        latestUserDefinedLoaderMethod = getLatestUserDefinedLoaderMethod();
-        unsafe = getUnsafe() ;
-        reflectionFactory = (ReflectionFactory)AccessController.doPrivileged(
-            new ReflectionFactory.GetReflectionFactoryAction());
+    private Bridge() {
+        reflectionFactory = ReflectionFactory.getReflectionFactory();
     }
 
     /** Fetch the Bridge singleton.  This requires the following
@@ -182,23 +121,8 @@ public final class Bridge
     /** Obtain the latest user defined ClassLoader from the call stack.
      * This is required by the RMI-IIOP specification.
      */
-    public final ClassLoader getLatestUserDefinedLoader()
-    {
-        try {
-            // Invoke the ObjectInputStream.latestUserDefinedLoader method
-            return (ClassLoader)latestUserDefinedLoaderMethod.invoke(null,
-                                                                     (Object[])NO_ARGS);
-        } catch (InvocationTargetException ite) {
-            Error err = new Error(
-                "sun.corba.Bridge.latestUserDefinedLoader: " + ite ) ;
-            err.initCause( ite ) ;
-            throw err ;
-        } catch (IllegalAccessException iae) {
-            Error err = new Error(
-                "sun.corba.Bridge.latestUserDefinedLoader: " + iae ) ;
-            err.initCause( iae ) ;
-            throw err ;
-        }
+    public final ClassLoader getLatestUserDefinedLoader() {
+        return jdk.internal.misc.VM.latestUserDefinedLoader();
     }
 
     /**
@@ -345,6 +269,23 @@ public final class Bridge
         return unsafe.objectFieldOffset( f ) ;
     }
 
+    /**
+     * Returns the offset of a static field.
+     */
+    public final long staticFieldOffset(Field f)
+    {
+        return unsafe.staticFieldOffset( f ) ;
+    }
+
+    /**
+     * Ensure that the class has been initalized.
+     * @param cl the class to ensure is initialized
+     */
+    public final void ensureClassInitialized(Class<?> cl) {
+        unsafe.ensureClassInitialized(cl);
+    }
+
+
     /** Throw the exception.
      * The exception may be an undeclared checked exception.
      */
@@ -353,16 +294,55 @@ public final class Bridge
         unsafe.throwException( ee ) ;
     }
 
-    /** Obtain a constructor for Class cl using constructor cons which
-     * may be the constructor defined in a superclass of cl.  This is
-     * used to create a constructor for Serializable classes that
-     * constructs an instance of the Serializable class using the
+    /**
+     * Obtain a constructor for Class cl.
+     * This is used to create a constructor for Serializable classes that
+     * construct an instance of the Serializable class using the
      * no args constructor of the first non-Serializable superclass
      * of the Serializable class.
      */
-    public final Constructor newConstructorForSerialization( Class cl,
-        Constructor cons )
-    {
-        return reflectionFactory.newConstructorForSerialization( cl, cons ) ;
+    public final Constructor<?> newConstructorForSerialization( Class<?> cl ) {
+        return reflectionFactory.newConstructorForSerialization( cl ) ;
     }
+
+    public final Constructor<?> newConstructorForExternalization(Class<?> cl) {
+        return reflectionFactory.newConstructorForExternalization( cl ) ;
+    }
+
+    /**
+     * Returns true if the given class defines a static initializer method,
+     * false otherwise.
+     */
+    public final boolean hasStaticInitializerForSerialization(Class<?> cl) {
+        return reflectionFactory.hasStaticInitializerForSerialization(cl);
+    }
+
+    public final MethodHandle writeObjectForSerialization(Class<?> cl) {
+        return reflectionFactory.writeObjectForSerialization(cl);
+    }
+
+    public final MethodHandle readObjectForSerialization(Class<?> cl) {
+        return reflectionFactory.readObjectForSerialization(cl);
+    }
+
+    public final MethodHandle readObjectNoDataForSerialization(Class<?> cl) {
+        return reflectionFactory.readObjectNoDataForSerialization(cl);
+    }
+
+    public final MethodHandle readResolveForSerialization(Class<?> cl) {
+        return reflectionFactory.readResolveForSerialization(cl);
+    }
+
+    public final MethodHandle writeReplaceForSerialization(Class<?> cl) {
+        return reflectionFactory.writeReplaceForSerialization(cl);
+    }
+
+    /**
+     * Return a new OptionalDataException instance.
+     * @return a new OptionalDataException instance
+     */
+    public final OptionalDataException newOptionalDataExceptionForSerialization(boolean bool) {
+        return reflectionFactory.newOptionalDataExceptionForSerialization(bool);
+    }
+
 }

corba/src/java.corba/share/classes/sun/corba/SharedSecrets.java

@@ -25,13 +25,13 @@
 
 package sun.corba;
 
-import com.sun.corba.se.impl.io.ValueUtility;
-import jdk.internal.misc.Unsafe;
-
 import java.lang.reflect.Field;
 import java.security.AccessController;
 import java.security.PrivilegedAction;
 
+import com.sun.corba.se.impl.io.ValueUtility;
+import sun.misc.Unsafe;
+
 /** A repository of "shared secrets", which are a mechanism for
     calling implementation-private methods in another package without
     using reflection. A package-private class implements a public
@@ -43,22 +43,22 @@ import java.security.PrivilegedAction;
 
 // SharedSecrets cloned in corba repo to avoid build issues
 public class SharedSecrets {
-    private static final Unsafe unsafe = getUnsafe();
-    private static JavaCorbaAccess javaCorbaAccess;
 
-     private static Unsafe getUnsafe() {
-          PrivilegedAction<Unsafe> pa = () -> {
-               Class<?> unsafeClass = jdk.internal.misc.Unsafe.class ;
-               try {
-                    Field f = unsafeClass.getDeclaredField("theUnsafe");
-                    f.setAccessible(true);
-                    return (Unsafe) f.get(null);
-               } catch (Exception e) {
-                    throw new Error(e);
-               }
-          };
-          return AccessController.doPrivileged(pa);
-     }
+    /** Access to Unsafe to read/write fields. */
+    private static final Unsafe unsafe = AccessController.doPrivileged(
+            (PrivilegedAction<Unsafe>)() -> {
+                try {
+                    Field field = Unsafe.class.getDeclaredField("theUnsafe");
+                    field.setAccessible(true);
+                    return (Unsafe)field.get(null);
+
+                } catch (NoSuchFieldException |IllegalAccessException ex) {
+                    throw new InternalError("Unsafe.theUnsafe field not available", ex);
+                }
+            }
+    );
+
+    private static JavaCorbaAccess javaCorbaAccess;
 
     public static JavaCorbaAccess getJavaCorbaAccess() {
         if (javaCorbaAccess == null) {

hotspot/.hgtags

@@ -543,3 +543,4 @@ dfcbf839e299e7e2bba1da69bdb347617ea4c7e8 jdk-9+137
 fc0956308c7a586267c5dd35dff74f773aa9c3eb jdk-9+138
 08492e67bf3226784dab3bf9ae967382ddbc1af5 jdk-9+139
 fec31089c2ef5a12dd64f401b0bf2e00f56ee0d0 jdk-9+140
+160a00bc6ed0af1fdf8418fc65e6bddbbc0c536d jdk-9+141

hotspot/src/cpu/ppc/vm/c1_LIRAssembler_ppc.cpp

@@ -1894,6 +1894,22 @@ void LIR_Assembler::emit_arraycopy(LIR_OpArrayCopy* op) {
     __ beq(combined_check, slow);
   }
 
+  if (flags & LIR_OpArrayCopy::type_check) {
+    if (!(flags & LIR_OpArrayCopy::LIR_OpArrayCopy::dst_objarray)) {
+      __ load_klass(tmp, dst);
+      __ lwz(tmp2, in_bytes(Klass::layout_helper_offset()), tmp);
+      __ cmpwi(CCR0, tmp2, Klass::_lh_neutral_value);
+      __ bge(CCR0, slow);
+    }
+
+    if (!(flags & LIR_OpArrayCopy::LIR_OpArrayCopy::src_objarray)) {
+      __ load_klass(tmp, src);
+      __ lwz(tmp2, in_bytes(Klass::layout_helper_offset()), tmp);
+      __ cmpwi(CCR0, tmp2, Klass::_lh_neutral_value);
+      __ bge(CCR0, slow);
+    }
+  }
+
   // Higher 32bits must be null.
   __ extsw(length, length);
 

hotspot/src/cpu/sparc/vm/c1_LIRAssembler_sparc.cpp

@@ -2034,6 +2034,27 @@ void LIR_Assembler::emit_arraycopy(LIR_OpArrayCopy* op) {
     __ delayed()->nop();
   }
 
+  // If the compiler was not able to prove that exact type of the source or the destination
+  // of the arraycopy is an array type, check at runtime if the source or the destination is
+  // an instance type.
+  if (flags & LIR_OpArrayCopy::type_check) {
+    if (!(flags & LIR_OpArrayCopy::LIR_OpArrayCopy::dst_objarray)) {
+      __ load_klass(dst, tmp);
+      __ lduw(tmp, in_bytes(Klass::layout_helper_offset()), tmp2);
+      __ cmp(tmp2, Klass::_lh_neutral_value);
+      __ br(Assembler::greaterEqual, false, Assembler::pn, *stub->entry());
+      __ delayed()->nop();
+    }
+
+    if (!(flags & LIR_OpArrayCopy::LIR_OpArrayCopy::src_objarray)) {
+      __ load_klass(src, tmp);
+      __ lduw(tmp, in_bytes(Klass::layout_helper_offset()), tmp2);
+      __ cmp(tmp2, Klass::_lh_neutral_value);
+      __ br(Assembler::greaterEqual, false, Assembler::pn, *stub->entry());
+      __ delayed()->nop();
+    }
+  }
+
   if (flags & LIR_OpArrayCopy::src_pos_positive_check) {
     // test src_pos register
     __ cmp_zero_and_br(Assembler::less, src_pos, *stub->entry());

hotspot/src/cpu/x86/vm/c1_LIRAssembler_x86.cpp

@@ -3146,6 +3146,23 @@ void LIR_Assembler::emit_arraycopy(LIR_OpArrayCopy* op) {
     __ jcc(Assembler::zero, *stub->entry());
   }
 
+  // If the compiler was not able to prove that exact type of the source or the destination
+  // of the arraycopy is an array type, check at runtime if the source or the destination is
+  // an instance type.
+  if (flags & LIR_OpArrayCopy::type_check) {
+    if (!(flags & LIR_OpArrayCopy::dst_objarray)) {
+      __ load_klass(tmp, dst);
+      __ cmpl(Address(tmp, in_bytes(Klass::layout_helper_offset())), Klass::_lh_neutral_value);
+      __ jcc(Assembler::greaterEqual, *stub->entry());
+    }
+
+    if (!(flags & LIR_OpArrayCopy::src_objarray)) {
+      __ load_klass(tmp, src);
+      __ cmpl(Address(tmp, in_bytes(Klass::layout_helper_offset())), Klass::_lh_neutral_value);
+      __ jcc(Assembler::greaterEqual, *stub->entry());
+    }
+  }
+
   // check if negative
   if (flags & LIR_OpArrayCopy::src_pos_positive_check) {
     __ testl(src_pos, src_pos);

hotspot/src/share/vm/classfile/classFileParser.cpp

@@ -5859,6 +5859,11 @@ void ClassFileParser::post_process_parsed_stream(const ClassFileStream* const st
   assert(cp != NULL, "invariant");
   assert(_loader_data != NULL, "invariant");
 
+  if (_class_name == vmSymbols::java_lang_Object()) {
+    check_property(_local_interfaces == Universe::the_empty_klass_array(),
+                   "java.lang.Object cannot implement an interface in class file %s",
+                   CHECK);
+  }
   // We check super class after class file is parsed and format is checked
   if (_super_class_index > 0 && NULL ==_super_klass) {
     Symbol* const super_class_name = cp->klass_name_at(_super_class_index);

hotspot/src/share/vm/classfile/stackMapTableFormat.hpp

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010, 2012, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2010, 2016, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -203,6 +203,7 @@ class stack_map_frame {
   inline bool verify(address start, address end) const;
 
   inline void print_on(outputStream* st, int current_offset) const;
+  inline void print_truncated(outputStream* st, int current_offset) const;
 
   // Create as_xxx and is_xxx methods for the subtypes
 #define FRAME_TYPE_DECL(stackmap_frame_type, arg1, arg2) \
@@ -263,6 +264,10 @@ class same_frame : public stack_map_frame {
   void print_on(outputStream* st, int current_offset = -1) const {
     st->print("same_frame(@%d)", offset_delta() + current_offset);
   }
+
+  void print_truncated(outputStream* st, int current_offset = -1) const {
+    print_on(st, current_offset);
+  }
 };
 
 class same_frame_extended : public stack_map_frame {
@@ -309,6 +314,10 @@ class same_frame_extended : public stack_map_frame {
   void print_on(outputStream* st, int current_offset = -1) const {
     st->print("same_frame_extended(@%d)", offset_delta() + current_offset);
   }
+
+  void print_truncated(outputStream* st, int current_offset = -1) const {
+    print_on(st, current_offset);
+  }
 };
 
 class same_locals_1_stack_item_frame : public stack_map_frame {
@@ -381,6 +390,11 @@ class same_locals_1_stack_item_frame : public stack_map_frame {
     types()->print_on(st);
     st->print(")");
   }
+
+  void print_truncated(outputStream* st, int current_offset = -1) const {
+    st->print("same_locals_1_stack_item_frame(@%d), output truncated, Stackmap exceeds table size.",
+              offset_delta() + current_offset);
+  }
 };
 
 class same_locals_1_stack_item_extended : public stack_map_frame {
@@ -446,6 +460,11 @@ class same_locals_1_stack_item_extended : public stack_map_frame {
     types()->print_on(st);
     st->print(")");
   }
+
+  void print_truncated(outputStream* st, int current_offset = -1) const {
+    st->print("same_locals_1_stack_item_extended(@%d), output truncated, Stackmap exceeds table size.",
+              offset_delta() + current_offset);
+  }
 };
 
 class chop_frame : public stack_map_frame {
@@ -511,6 +530,10 @@ class chop_frame : public stack_map_frame {
   void print_on(outputStream* st, int current_offset = -1) const {
     st->print("chop_frame(@%d,%d)", offset_delta() + current_offset, chops());
   }
+
+  void print_truncated(outputStream* st, int current_offset = -1) const {
+    print_on(st, current_offset);
+  }
 };
 
 class append_frame : public stack_map_frame {
@@ -619,6 +642,11 @@ class append_frame : public stack_map_frame {
     }
     st->print(")");
   }
+
+  void print_truncated(outputStream* st, int current_offset = -1) const {
+    st->print("append_frame(@%d), output truncated, Stackmap exceeds table size.",
+              offset_delta() + current_offset);
+  }
 };
 
 class full_frame : public stack_map_frame {
@@ -784,6 +812,11 @@ class full_frame : public stack_map_frame {
     }
     st->print("})");
   }
+
+  void print_truncated(outputStream* st, int current_offset = -1) const {
+    st->print("full_frame(@%d), output truncated, Stackmap exceeds table size.",
+              offset_delta() + current_offset);
+  }
 };
 
 #define VIRTUAL_DISPATCH(stack_frame_type, func_name, args) \
@@ -841,6 +874,10 @@ void stack_map_frame::print_on(outputStream* st, int offs = -1) const {
   FOR_EACH_STACKMAP_FRAME_TYPE(VOID_VIRTUAL_DISPATCH, print_on, (st, offs));
 }
 
+void stack_map_frame::print_truncated(outputStream* st, int offs = -1) const {
+  FOR_EACH_STACKMAP_FRAME_TYPE(VOID_VIRTUAL_DISPATCH, print_truncated, (st, offs));
+}
+
 #undef VIRTUAL_DISPATCH
 #undef VOID_VIRTUAL_DISPATCH
 

hotspot/src/share/vm/classfile/verifier.cpp

@@ -541,8 +541,19 @@ void ErrorContext::stackmap_details(outputStream* ss, const Method* method) cons
     stack_map_frame* sm_frame = sm_table->entries();
     streamIndentor si2(ss);
     int current_offset = -1;
+    // Subtract two from StackMapAttribute length because the length includes
+    // two bytes for number of table entries.
+    size_t sm_table_space = method->stackmap_data()->length() - 2;
     for (u2 i = 0; i < sm_table->number_of_entries(); ++i) {
       ss->indent();
+      size_t sm_frame_size = sm_frame->size();
+      // If the size of the next stackmap exceeds the length of the entire
+      // stackmap table then print a truncated message and return.
+      if (sm_frame_size > sm_table_space) {
+        sm_frame->print_truncated(ss, current_offset);
+        return;
+      }
+      sm_table_space -= sm_frame_size;
       sm_frame->print_on(ss, current_offset);
       ss->cr();
       current_offset += sm_frame->offset_delta();

hotspot/src/share/vm/prims/jvm.cpp

@@ -2524,7 +2524,6 @@ JVM_ENTRY(const char*, JVM_GetCPMethodNameUTF(JNIEnv *env, jclass cls, jint cp_i
   switch (cp->tag_at(cp_index).value()) {
     case JVM_CONSTANT_InterfaceMethodref:
     case JVM_CONSTANT_Methodref:
-    case JVM_CONSTANT_NameAndType:  // for invokedynamic
       return cp->uncached_name_ref_at(cp_index)->as_utf8();
     default:
       fatal("JVM_GetCPMethodNameUTF: illegal constant");
@@ -2542,7 +2541,6 @@ JVM_ENTRY(const char*, JVM_GetCPMethodSignatureUTF(JNIEnv *env, jclass cls, jint
   switch (cp->tag_at(cp_index).value()) {
     case JVM_CONSTANT_InterfaceMethodref:
     case JVM_CONSTANT_Methodref:
-    case JVM_CONSTANT_NameAndType:  // for invokedynamic
       return cp->uncached_signature_ref_at(cp_index)->as_utf8();
     default:
       fatal("JVM_GetCPMethodSignatureUTF: illegal constant");

hotspot/src/share/vm/runtime/arguments.cpp

@@ -794,9 +794,10 @@ static bool append_to_string_flag(const char* name, const char* new_value, Flag:
   } else if (new_len == 0) {
     value = old_value;
   } else {
-    char* buf = NEW_C_HEAP_ARRAY(char, old_len + 1 + new_len + 1, mtArguments);
+     size_t length = old_len + 1 + new_len + 1;
+     char* buf = NEW_C_HEAP_ARRAY(char, length, mtArguments);
     // each new setting adds another LINE to the switch:
-    sprintf(buf, "%s\n%s", old_value, new_value);
+    jio_snprintf(buf, length, "%s\n%s", old_value, new_value);
     value = buf;
     free_this_too = buf;
   }
@@ -1014,15 +1015,17 @@ const char* Arguments::build_resource_string(char** args, int count) {
   if (args == NULL || count == 0) {
     return NULL;
   }
-  size_t length = strlen(args[0]) + 1; // add 1 for the null terminator
-  for (int i = 1; i < count; i++) {
-    length += strlen(args[i]) + 1; // add 1 for a space
+  size_t length = 0;
+  for (int i = 0; i < count; i++) {
+    length += strlen(args[i]) + 1; // add 1 for a space or NULL terminating character
   }
   char* s = NEW_RESOURCE_ARRAY(char, length);
-  strcpy(s, args[0]);
-  for (int j = 1; j < count; j++) {
-    strcat(s, " ");
-    strcat(s, args[j]);
+  char* dst = s;
+  for (int j = 0; j < count; j++) {
+    size_t offset = strlen(args[j]) + 1; // add 1 for a space or NULL terminating character
+    jio_snprintf(dst, length, "%s ", args[j]); // jio_snprintf will replace the last space character with NULL character
+    dst += offset;
+    length -= offset;
   }
   return (const char*) s;
 }
@@ -1106,9 +1109,8 @@ bool Arguments::process_argument(const char* arg,
   // Only make the obsolete check for valid arguments.
   if (arg_len <= BUFLEN) {
     // Construct a string which consists only of the argument name without '+', '-', or '='.
-    char stripped_argname[BUFLEN+1];
-    strncpy(stripped_argname, argname, arg_len);
-    stripped_argname[arg_len] = '\0';  // strncpy may not null terminate.
+    char stripped_argname[BUFLEN+1]; // +1 for '\0'
+    jio_snprintf(stripped_argname, arg_len+1, "%s", argname); // +1 for '\0'
     if (is_obsolete_flag(stripped_argname, &since)) {
       char version[256];
       since.to_string(version, sizeof(version));
@@ -1260,8 +1262,7 @@ bool Arguments::add_property(const char* prop, PropertyWriteable writeable, Prop
     size_t key_len = eq - prop;
     char* tmp_key = AllocateHeap(key_len + 1, mtArguments);
 
-    strncpy(tmp_key, prop, key_len);
-    tmp_key[key_len] = '\0';
+    jio_snprintf(tmp_key, key_len + 1, "%s", prop);
     key = tmp_key;
 
     value = &prop[key_len + 1];
@@ -2256,7 +2257,7 @@ jint Arguments::set_aggressive_opts_flags() {
 
     // Feed the cache size setting into the JDK
     char buffer[1024];
-    sprintf(buffer, "java.lang.Integer.IntegerCache.high=" INTX_FORMAT, AutoBoxCacheMax);
+    jio_snprintf(buffer, 1024, "java.lang.Integer.IntegerCache.high=" INTX_FORMAT, AutoBoxCacheMax);
     if (!add_property(buffer)) {
       return JNI_ENOMEM;
     }
@@ -2777,8 +2778,8 @@ jint Arguments::parse_each_vm_init_arg(const JavaVMInitArgs* args, bool* patch_m
       if (tail != NULL) {
         const char* pos = strchr(tail, ':');
         size_t len = (pos == NULL) ? strlen(tail) : pos - tail;
-        char* name = (char*)memcpy(NEW_C_HEAP_ARRAY(char, len + 1, mtArguments), tail, len);
-        name[len] = '\0';
+        char* name = NEW_C_HEAP_ARRAY(char, len + 1, mtArguments);
+        jio_snprintf(name, len + 1, "%s", tail);
 
         char *options = NULL;
         if(pos != NULL) {
@@ -2854,7 +2855,9 @@ jint Arguments::parse_each_vm_init_arg(const JavaVMInitArgs* args, bool* patch_m
       return JNI_ERR;
 #else
       if (tail != NULL) {
-        char *options = strcpy(NEW_C_HEAP_ARRAY(char, strlen(tail) + 1, mtArguments), tail);
+        size_t length = strlen(tail) + 1;
+        char *options = NEW_C_HEAP_ARRAY(char, length, mtArguments);
+        jio_snprintf(options, length, "%s", tail);
         add_init_agent("instrument", options, false);
         // java agents need module java.instrument
         if (!create_numbered_property("jdk.module.addmods", "java.instrument", addmods_count++)) {
@@ -3512,7 +3515,7 @@ jint Arguments::finalize_vm_init_args() {
   // check if the default lib/endorsed directory exists; if so, error
   char path[JVM_MAXPATHLEN];
   const char* fileSep = os::file_separator();
-  sprintf(path, "%s%slib%sendorsed", Arguments::get_java_home(), fileSep, fileSep);
+  jio_snprintf(path, JVM_MAXPATHLEN, "%s%slib%sendorsed", Arguments::get_java_home(), fileSep, fileSep);
 
   if (CheckEndorsedAndExtDirs) {
     int nonEmptyDirs = 0;
@@ -3534,7 +3537,7 @@ jint Arguments::finalize_vm_init_args() {
     return JNI_ERR;
   }
 
-  sprintf(path, "%s%slib%sext", Arguments::get_java_home(), fileSep, fileSep);
+  jio_snprintf(path, JVM_MAXPATHLEN, "%s%slib%sext", Arguments::get_java_home(), fileSep, fileSep);
   dir = os::opendir(path);
   if (dir != NULL) {
     jio_fprintf(defaultStream::output_stream(),
@@ -3899,6 +3902,13 @@ jint Arguments::parse_options_buffer(const char* name, char* buffer, const size_
 
 void Arguments::set_shared_spaces_flags() {
   if (DumpSharedSpaces) {
+    if (FailOverToOldVerifier) {
+      // Don't fall back to the old verifier on verification failure. If a
+      // class fails verification with the split verifier, it might fail the
+      // CDS runtime verifier constraint check. In that case, we don't want
+      // to share the class. We only archive classes that pass the split verifier.
+      FLAG_SET_DEFAULT(FailOverToOldVerifier, false);
+    }
 
     if (RequireSharedSpaces) {
       warning("Cannot dump shared archive while using shared archive");

hotspot/src/share/vm/runtime/sharedRuntime.cpp

@@ -2881,8 +2881,6 @@ VMRegPair *SharedRuntime::find_callee_arguments(Symbol* sig, bool has_receiver,
   char *s = sig->as_C_string();
   int len = (int)strlen(s);
   s++; len--;                   // Skip opening paren
-  char *t = s+len;
-  while (*(--t) != ')');      // Find close paren
 
   BasicType *sig_bt = NEW_RESOURCE_ARRAY(BasicType, 256);
   VMRegPair *regs = NEW_RESOURCE_ARRAY(VMRegPair, 256);
@@ -2891,7 +2889,7 @@ VMRegPair *SharedRuntime::find_callee_arguments(Symbol* sig, bool has_receiver,
     sig_bt[cnt++] = T_OBJECT; // Receiver is argument 0; not in signature
   }
 
-  while (s < t) {
+  while (*s != ')') {          // Find closing right paren
     switch (*s++) {            // Switch on signature character
     case 'B': sig_bt[cnt++] = T_BYTE;    break;
     case 'C': sig_bt[cnt++] = T_CHAR;    break;

hotspot/src/share/vm/runtime/signature.cpp

@@ -224,7 +224,49 @@ void SignatureIterator::iterate_returntype() {
   _index = 0;
   expect('(');
   Symbol* sig = _signature;
-  while (sig->byte_at(_index) != ')') _index++;
+  // Need to skip over each type in the signature's argument list until a
+  // closing ')' is found., then get the return type.  We cannot just scan
+  // for the first ')' because ')' is a legal character in a type name.
+  while (sig->byte_at(_index) != ')') {
+    switch(sig->byte_at(_index)) {
+      case 'B':
+      case 'C':
+      case 'D':
+      case 'F':
+      case 'I':
+      case 'J':
+      case 'S':
+      case 'Z':
+      case 'V':
+        {
+          _index++;
+        }
+        break;
+      case 'L':
+        {
+          while (sig->byte_at(_index++) != ';') ;
+        }
+        break;
+      case '[':
+        {
+          int begin = ++_index;
+          skip_optional_size();
+          while (sig->byte_at(_index) == '[') {
+            _index++;
+            skip_optional_size();
+          }
+          if (sig->byte_at(_index) == 'L') {
+            while (sig->byte_at(_index++) != ';') ;
+          } else {
+            _index++;
+          }
+        }
+        break;
+      default:
+        ShouldNotReachHere();
+        break;
+    }
+  }
   expect(')');
   // Parse return type
   _parameter_index = -1;

hotspot/test/compiler/c1/TestArrayCopyToFromObject.java

@@ -0,0 +1,64 @@
+/*
+ * Copyright (c) 2016, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 8160591
+ * @summary C1-generated code for System.arraycopy() does not throw an ArrayStoreException if 'dst' is no a "proper" array (i.e., it is java.lang.Object)
+ * @run main/othervm -XX:+IgnoreUnrecognizedVMOptions -XX:+TieredCompilation -XX:TieredStopAtLevel=1 -Xcomp -XX:-UseCompressedClassPointers -XX:CompileOnly=TestArrayCopyToFromObject.test TestArrayCopyToFromObject
+ * @run main/othervm -XX:+IgnoreUnrecognizedVMOptions -XX:+TieredCompilation -XX:TieredStopAtLevel=1 -Xcomp -XX:+UseCompressedClassPointers -XX:CompileOnly=TestArrayCopyToFromObject.test TestArrayCopyToFromObject
+ */
+public class TestArrayCopyToFromObject {
+
+    public void test(Object aArray[]) {
+        Object a = new Object();
+
+        try {
+            System.arraycopy(aArray, 0, a, 0, 1);
+            throw new RuntimeException ("FAILED: Expected ArrayStoreException " +
+                                        "(due to destination not being an array) " +
+                                        "was not thrown");
+        } catch (ArrayStoreException e) {
+            System.out.println("PASSED: Expected ArrayStoreException was thrown");
+        }
+
+        try {
+            System.arraycopy(a, 0, aArray, 0, 1);
+            throw new RuntimeException ("FAILED: Expected ArrayStoreException " +
+                                        "(due to source not being an array) " +
+                                        "was not thrown");
+        } catch (ArrayStoreException e) {
+            System.out.println("PASSED: Expected ArrayStoreException was thrown");
+        }
+
+    }
+
+    public static void main(String args[]) {
+        System.out.println("TestArrayCopyToFromObject");
+        Object aArray[] = new Object[10];
+        for (int i = 0; i < 10; i++) {
+            aArray[i] = new Object();
+        }
+        new TestArrayCopyToFromObject().test(aArray);
+    }
+}

jaxp/.hgtags

@@ -383,3 +383,4 @@ a8d5fe567ae72b4931040e59dd4478363f9004f5 jdk-9+137
 69c3b12ba75b2e321dee731ac545e7fbff608451 jdk-9+138
 8991d71c5316bde259e6a417c1199b008ca3cdf0 jdk-9+139
 8d100cb9b04819b5bd09f33c7fd5b8628d1a456f jdk-9+140
+037c095ba0c345edbeaaab52fda913a76c3930c0 jdk-9+141

jaxp/src/java.xml/share/classes/com/sun/org/apache/xalan/internal/xsltc/compiler/Stylesheet.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007, 2015, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2007, 2016, Oracle and/or its affiliates. All rights reserved.
  */
 /*
  * Licensed to the Apache Software Foundation (ASF) under one or more
@@ -31,6 +31,7 @@ import com.sun.org.apache.bcel.internal.generic.GETFIELD;
 import com.sun.org.apache.bcel.internal.generic.GETSTATIC;
 import com.sun.org.apache.bcel.internal.generic.INVOKEINTERFACE;
 import com.sun.org.apache.bcel.internal.generic.INVOKESPECIAL;
+import com.sun.org.apache.bcel.internal.generic.INVOKESTATIC;
 import com.sun.org.apache.bcel.internal.generic.INVOKEVIRTUAL;
 import com.sun.org.apache.bcel.internal.generic.ISTORE;
 import com.sun.org.apache.bcel.internal.generic.InstructionHandle;
@@ -1252,6 +1253,10 @@ public final class Stylesheet extends SyntaxTreeNode {
                                 classGen.getConstantPool());
         transf.addException("com.sun.org.apache.xalan.internal.xsltc.TransletException");
 
+        // call resetPrefixIndex at the beginning of transform
+        final int check = cpg.addMethodref(BASIS_LIBRARY_CLASS, "resetPrefixIndex", "()V");
+        il.append(new INVOKESTATIC(check));
+
         // Define and initialize current with the root node
         final LocalVariableGen current =
             transf.addLocalVariable("current",

jaxp/src/java.xml/share/classes/com/sun/org/apache/xalan/internal/xsltc/runtime/BasisLibrary.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007, 2015, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2007, 2016, Oracle and/or its affiliates. All rights reserved.
  */
 /*
  * Licensed to the Apache Software Foundation (ASF) under one or more
@@ -31,6 +31,7 @@ import java.text.MessageFormat;
 import java.text.NumberFormat;
 import java.util.Locale;
 import java.util.ResourceBundle;
+import java.util.concurrent.atomic.AtomicInteger;
 import javax.xml.transform.dom.DOMSource;
 
 import com.sun.org.apache.xalan.internal.xsltc.DOM;
@@ -1533,16 +1534,25 @@ public final class BasisLibrary {
     }
 
     /**
-     * This function is used in the execution of xsl:element
+     * These functions are used in the execution of xsl:element to generate
+     * and reset namespace prefix index local to current transformation process
      */
-    private static int prefixIndex = 0;
-
     public static String generatePrefix() {
-        synchronized (BasisLibrary.class) {
-            return ("ns" + prefixIndex++);
-        }
+        return ("ns" + threadLocalPrefixIndex.get().getAndIncrement());
     }
 
+    public static void resetPrefixIndex() {
+        threadLocalPrefixIndex.get().set(0);
+    }
+
+    private static final ThreadLocal<AtomicInteger> threadLocalPrefixIndex =
+        new ThreadLocal<AtomicInteger>() {
+            @Override
+            protected AtomicInteger initialValue() {
+                return new AtomicInteger();
+            }
+        };
+
     public static final String RUN_TIME_INTERNAL_ERR =
                                            "RUN_TIME_INTERNAL_ERR";
     public static final String RUN_TIME_COPY_ERR =

jaxp/test/javax/xml/jaxp/unittest/transform/NamespacePrefixTest.java

@@ -0,0 +1,193 @@
+/*
+ * Copyright (c) 2016, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package transform;
+
+import java.io.StringReader;
+import java.io.StringWriter;
+import java.util.concurrent.CyclicBarrier;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicBoolean;
+
+import javax.xml.transform.Source;
+import javax.xml.transform.Templates;
+import javax.xml.transform.Transformer;
+import javax.xml.transform.TransformerFactory;
+import javax.xml.transform.stream.StreamResult;
+import javax.xml.transform.stream.StreamSource;
+
+import org.testng.annotations.Test;
+import static org.testng.Assert.assertTrue;
+import static jaxp.library.JAXPTestUtilities.runWithAllPerm;
+
+/*
+ * @test
+ * @bug 8167179
+ * @library /javax/xml/jaxp/libs
+ * @run testng/othervm -DrunSecMngr=true transform.NamespacePrefixTest
+ * @run testng/othervm transform.NamespacePrefixTest
+ * @summary This class tests the generation of namespace prefixes
+ */
+public class NamespacePrefixTest {
+
+    @Test
+    public void testReuseTemplates() throws Exception {
+        final TransformerFactory tf = TransformerFactory.newInstance();
+        final Source xslsrc = new StreamSource(new StringReader(XSL));
+        final Templates tmpl = tf.newTemplates(xslsrc);
+        for (int i = 0; i < TRANSF_COUNT; i++) {
+            checkResult(doTransformation(tmpl.newTransformer()));
+        }
+    }
+
+    @Test
+    public void testReuseTransformer() throws Exception {
+        final TransformerFactory tf = TransformerFactory.newInstance();
+        final Source xslsrc = new StreamSource(new StringReader(XSL));
+        final Transformer t = tf.newTransformer(xslsrc);
+        for (int i = 0; i < TRANSF_COUNT; i++) {
+            checkResult(doTransformation(t));
+        }
+    }
+
+    @Test
+    public void testConcurrentTransformations() throws Exception {
+        final TransformerFactory tf = TransformerFactory.newInstance();
+        final Source xslsrc = new StreamSource(new StringReader(XSL));
+        final Templates tmpl = tf.newTemplates(xslsrc);
+        concurrentTestPassed.set(true);
+
+        // Execute multiple TestWorker tasks
+        for (int id = 0; id < THREADS_COUNT; id++) {
+            EXECUTOR.execute(new TransformerThread(tmpl.newTransformer(), id));
+        }
+        // Initiate shutdown of previously submitted task
+        runWithAllPerm(EXECUTOR::shutdown);
+        // Wait for termination of submitted tasks
+        if (!EXECUTOR.awaitTermination(THREADS_COUNT, TimeUnit.SECONDS)) {
+            // If not all tasks terminates during the time out force them to shutdown
+            runWithAllPerm(EXECUTOR::shutdownNow);
+        }
+        // Check if all transformation threads generated the correct namespace prefix
+        assertTrue(concurrentTestPassed.get());
+    }
+
+    // Do one transformation with the provided transformer
+    private static String doTransformation(Transformer t) throws Exception {
+        StringWriter resWriter = new StringWriter();
+        Source xmlSrc = new StreamSource(new StringReader(XML));
+        t.transform(xmlSrc, new StreamResult(resWriter));
+        return resWriter.toString();
+    }
+
+    // Check if the transformation result string contains the
+    // element with the exact namespace prefix generated.
+    private static void checkResult(String result) {
+        // Check prefix of 'Element2' element, it should always be the same
+        assertTrue(result.contains(EXPECTED_CONTENT));
+    }
+
+    // Check if the transformation result string contains the element with
+    // the exact namespace prefix generated by current thread.
+    // If the expected prefix is not found and there was no failures observed by
+    // other test threads then mark concurrent test as failed.
+    private static void checkThreadResult(String result, int id) {
+        boolean res = result.contains(EXPECTED_CONTENT);
+        System.out.printf("%d: transformation result: %s%n", id, res ? "Pass" : "Fail");
+        if (!res) {
+            System.out.printf("%d result:%s%n", id, result);
+        }
+        concurrentTestPassed.compareAndSet(true, res);
+    }
+
+    // TransformerThread task that does the transformation similar
+    // to testReuseTransformer test method
+    private class TransformerThread implements Runnable {
+
+        private final Transformer transformer;
+        private final int id;
+
+        TransformerThread(Transformer transformer, int id) {
+            this.transformer = transformer;
+            this.id = id;
+        }
+
+        @Override
+        public void run() {
+            try {
+                System.out.printf("%d: waiting for barrier%n", id);
+                //Synchronize startup of all tasks
+                BARRIER.await();
+                System.out.printf("%d: starting transformation%n", id);
+                checkThreadResult(doTransformation(transformer), id);
+            } catch (Exception ex) {
+                throw new RuntimeException("TransformerThread " + id + " failed", ex);
+            }
+        }
+    }
+
+    // Number of subsequent transformations
+    private static final int TRANSF_COUNT = 10;
+
+    // Number of transformer threads running concurently
+    private static final int THREADS_COUNT = 10;
+
+    // Variable for storing the concurrent transformation test result. It is
+    // updated by transformer threads
+    private static final AtomicBoolean concurrentTestPassed = new AtomicBoolean(true);
+
+    // Cyclic barrier for threads startup synchronization
+    private static final CyclicBarrier BARRIER = new CyclicBarrier(THREADS_COUNT);
+
+    // Thread pool
+    private static final ExecutorService EXECUTOR = Executors.newCachedThreadPool();
+
+    // XSL that transforms XML and produces unique namespace prefixes for each element
+    private final static String XSL = "<xsl:stylesheet version=\"1.0\" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\">\n"
+            + " <xsl:template match=\"node()|@*\" priority=\"1\">\n"
+            + "     <xsl:copy>\n"
+            + "       <xsl:apply-templates select=\"node()|@*\"/>\n"
+            + "     </xsl:copy>\n"
+            + " </xsl:template>\n"
+            + " <xsl:template match=\"*\" priority=\"2\">\n"
+            + "  <xsl:element name=\"{name()}\" namespace=\"{namespace-uri()}\">\n"
+            + "   <xsl:apply-templates select=\"node()|@*\"/>\n"
+            + "  </xsl:element>\n"
+            + " </xsl:template>\n"
+            + "</xsl:stylesheet>";
+
+    // Simple XML content with root and two child elements
+    private final static String XML = "<TestRoot xmlns=\"test.xmlns\">\n"
+            + "  <Element1 xmlns=\"test.xmlns\">\n"
+            + "  </Element1>\n"
+            + "  <Element2 xmlns=\"test.xmlns\">\n"
+            + "  </Element2>\n"
+            + "</TestRoot>";
+
+    // With thread local namespace prefix index each transformation result should
+    // be the same and contain the same prefix for Element2
+    private final static String EXPECTED_CONTENT = "</ns2:Element2>";
+
+}

jaxws/.hgtags

@@ -386,3 +386,4 @@ ab1d78d395d4cb8be426ff181211da1a4085cf01 jdk-9+134
 7d3a8f52b124db26ba8425c2931b748dd9d2791b jdk-9+138
 7a7aadf3c4500cc273c889aa1172d4fe3844bb6b jdk-9+139
 9004617323fe99cbe4fad48f373cb2ed4fc50aa6 jdk-9+140
+b2c18f755228d1d19a86cd7d5fa1abb6b1495dfb jdk-9+141

jdk/.hgtags

@@ -383,3 +383,4 @@ e72df94364e3686e7d62059ce0d6b187b82da713 jdk-9+137
 665096863382bf23ce891307cf2a7511e77c1c88 jdk-9+138
 5518ac2f2ead5e594bd983f2047178136aafdfd0 jdk-9+139
 e93b7ea559759f036c9f69fd2ddaf47bb4e98385 jdk-9+140
+8d752af5f61d41f226adf2cda72a20faa9ad620a jdk-9+141

jdk/src/java.base/share/classes/java/io/ObjectStreamClass.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 2015, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2016, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -1413,27 +1413,7 @@ public class ObjectStreamClass implements Serializable {
      * returned constructor (if any).
      */
     private static Constructor<?> getSerializableConstructor(Class<?> cl) {
-        Class<?> initCl = cl;
-        while (Serializable.class.isAssignableFrom(initCl)) {
-            if ((initCl = initCl.getSuperclass()) == null) {
-                return null;
-            }
-        }
-        try {
-            Constructor<?> cons = initCl.getDeclaredConstructor((Class<?>[]) null);
-            int mods = cons.getModifiers();
-            if ((mods & Modifier.PRIVATE) != 0 ||
-                ((mods & (Modifier.PUBLIC | Modifier.PROTECTED)) == 0 &&
-                 !packageEquals(cl, initCl)))
-            {
-                return null;
-            }
-            cons = reflFactory.newConstructorForSerialization(cl, cons);
-            cons.setAccessible(true);
-            return cons;
-        } catch (NoSuchMethodException ex) {
-            return null;
-        }
+        return reflFactory.newConstructorForSerialization(cl);
     }
 
     /**

jdk/src/java.base/share/classes/java/lang/Class.java

@@ -557,7 +557,7 @@ public final class Class<T> implements java.io.Serializable,
         Class<?> caller = Reflection.getCallerClass();
         if (newInstanceCallerCache != caller) {
             int modifiers = tmpConstructor.getModifiers();
-            Reflection.ensureMemberAccess(caller, this, null, modifiers);
+            Reflection.ensureMemberAccess(caller, this, this, modifiers);
             newInstanceCallerCache = caller;
         }
         // Run constructor

jdk/src/java.base/share/classes/java/lang/Deprecated.java

@@ -79,7 +79,7 @@ public @interface Deprecated {
     /**
      * Returns the version in which the annotated element became deprecated.
      * The version string is in the same format and namespace as the value of
-     * the {@code @since} javadoc tag. The default value is the empty
+     * the {@code @since} javadoc tag. The default value is the empty
      * string.
      *
      * @return the version string

jdk/src/java.base/share/classes/java/lang/Thread.java

@@ -504,11 +504,12 @@ class Thread implements Runnable {
     }
 
     /**
-     * Creates a new Thread that inherits the given AccessControlContext.
+     * Creates a new Thread that inherits the given AccessControlContext
+     * but thread-local variables are not inherited.
      * This is not a public constructor.
      */
     Thread(Runnable target, AccessControlContext acc) {
-        init(null, target, "Thread-" + nextThreadNum(), 0, acc, true);
+        init(null, target, "Thread-" + nextThreadNum(), 0, acc, false);
     }
 
     /**

jdk/src/java.base/share/classes/java/lang/module/SystemModuleFinder.java

@@ -44,6 +44,8 @@ import java.util.function.Supplier;
 import jdk.internal.jimage.ImageLocation;
 import jdk.internal.jimage.ImageReader;
 import jdk.internal.jimage.ImageReaderFactory;
+import jdk.internal.misc.JavaNetUriAccess;
+import jdk.internal.misc.SharedSecrets;
 import jdk.internal.module.ModuleHashes;
 import jdk.internal.module.ModuleHashes.HashSupplier;
 import jdk.internal.module.SystemModules;
@@ -71,6 +73,8 @@ class SystemModuleFinder implements ModuleFinder {
     // ImageReader used to access all modules in the image
     private static final ImageReader imageReader;
 
+    private static final JavaNetUriAccess jnua = SharedSecrets.getJavaNetUriAccess();
+
     // the set of modules in the run-time image
     private static final Set<ModuleReference> modules;
 
@@ -166,7 +170,8 @@ class SystemModuleFinder implements ModuleFinder {
                                                      HashSupplier hash)
     {
         String mn = md.name();
-        URI uri = URI.create("jrt:/" + mn);
+
+        URI uri = jnua.create("jrt", "/".concat(mn));
 
         Supplier<ModuleReader> readerSupplier = new Supplier<>() {
             @Override

jdk/src/java.base/share/classes/java/lang/reflect/AccessibleObject.java

@@ -312,22 +312,22 @@ public class AccessibleObject implements AnnotatedElement {
     // (See also Class.newInstance(), which uses a similar method.)
     //
     // A more complicated security check cache is needed for Method and Field
-    // The cache can be either null (empty cache), a 2-array of {caller,target},
-    // or a caller (with target implicitly equal to this.clazz).
-    // In the 2-array case, the target is always different from the clazz.
+    // The cache can be either null (empty cache), a 2-array of {caller,targetClass},
+    // or a caller (with targetClass implicitly equal to memberClass).
+    // In the 2-array case, the targetClass is always different from the memberClass.
     volatile Object securityCheckCache;
 
-    void checkAccess(Class<?> caller, Class<?> clazz, Object obj, int modifiers)
+    final void checkAccess(Class<?> caller, Class<?> memberClass,
+                           Class<?> targetClass, int modifiers)
         throws IllegalAccessException
     {
-        if (caller == clazz) {  // quick check
+        if (caller == memberClass) {  // quick check
             return;             // ACCESS IS OK
         }
         Object cache = securityCheckCache;  // read volatile
-        Class<?> targetClass = clazz;
-        if (obj != null
+        if (targetClass != null // instance member or constructor
             && Modifier.isProtected(modifiers)
-            && ((targetClass = obj.getClass()) != clazz)) {
+            && targetClass != memberClass) {
             // Must match a 2-list of { caller, targetClass }.
             if (cache instanceof Class[]) {
                 Class<?>[] cache2 = (Class<?>[]) cache;
@@ -339,25 +339,27 @@ public class AccessibleObject implements AnnotatedElement {
                 // subsumes range check for [0].)
             }
         } else if (cache == caller) {
-            // Non-protected case (or obj.class == this.clazz).
+            // Non-protected case (or targetClass == memberClass or static member).
             return;             // ACCESS IS OK
         }
 
         // If no return, fall through to the slow path.
-        slowCheckMemberAccess(caller, clazz, obj, modifiers, targetClass);
+        slowCheckMemberAccess(caller, memberClass, targetClass, modifiers);
     }
 
     // Keep all this slow stuff out of line:
-    void slowCheckMemberAccess(Class<?> caller, Class<?> clazz, Object obj, int modifiers,
-                               Class<?> targetClass)
+    void slowCheckMemberAccess(Class<?> caller, Class<?> memberClass,
+                               Class<?> targetClass, int modifiers)
         throws IllegalAccessException
     {
-        Reflection.ensureMemberAccess(caller, clazz, obj, modifiers);
+        Reflection.ensureMemberAccess(caller, memberClass, targetClass, modifiers);
 
         // Success: Update the cache.
-        Object cache = ((targetClass == clazz)
-                        ? caller
-                        : new Class<?>[] { caller, targetClass });
+        Object cache = (targetClass != null
+                        && Modifier.isProtected(modifiers)
+                        && targetClass != memberClass)
+                        ? new Class<?>[] { caller, targetClass }
+                        : caller;
 
         // Note:  The two cache elements are not volatile,
         // but they are effectively final.  The Java memory model

jdk/src/java.base/share/classes/java/lang/reflect/Constructor.java

@@ -443,7 +443,7 @@ public final class Constructor<T> extends Executable {
     {
         if (!override) {
             Class<?> caller = Reflection.getCallerClass();
-            checkAccess(caller, clazz, null, modifiers);
+            checkAccess(caller, clazz, clazz, modifiers);
         }
         if ((clazz.getModifiers() & Modifier.ENUM) != 0)
             throw new IllegalArgumentException("Cannot reflectively create enum objects");

jdk/src/java.base/share/classes/java/lang/reflect/Field.java

@@ -403,7 +403,7 @@ class Field extends AccessibleObject implements Member {
     {
         if (!override) {
             Class<?> caller = Reflection.getCallerClass();
-            checkAccess(caller, clazz, obj, modifiers);
+            checkAccess(caller, obj);
         }
         return getFieldAccessor(obj).get(obj);
     }
@@ -437,7 +437,7 @@ class Field extends AccessibleObject implements Member {
     {
         if (!override) {
             Class<?> caller = Reflection.getCallerClass();
-            checkAccess(caller, clazz, obj, modifiers);
+            checkAccess(caller, obj);
         }
         return getFieldAccessor(obj).getBoolean(obj);
     }
@@ -471,7 +471,7 @@ class Field extends AccessibleObject implements Member {
     {
         if (!override) {
             Class<?> caller = Reflection.getCallerClass();
-            checkAccess(caller, clazz, obj, modifiers);
+            checkAccess(caller, obj);
         }
         return getFieldAccessor(obj).getByte(obj);
     }
@@ -507,7 +507,7 @@ class Field extends AccessibleObject implements Member {
     {
         if (!override) {
             Class<?> caller = Reflection.getCallerClass();
-            checkAccess(caller, clazz, obj, modifiers);
+            checkAccess(caller, obj);
         }
         return getFieldAccessor(obj).getChar(obj);
     }
@@ -543,7 +543,7 @@ class Field extends AccessibleObject implements Member {
     {
         if (!override) {
             Class<?> caller = Reflection.getCallerClass();
-            checkAccess(caller, clazz, obj, modifiers);
+            checkAccess(caller, obj);
         }
         return getFieldAccessor(obj).getShort(obj);
     }
@@ -579,7 +579,7 @@ class Field extends AccessibleObject implements Member {
     {
         if (!override) {
             Class<?> caller = Reflection.getCallerClass();
-            checkAccess(caller, clazz, obj, modifiers);
+            checkAccess(caller, obj);
         }
         return getFieldAccessor(obj).getInt(obj);
     }
@@ -615,7 +615,7 @@ class Field extends AccessibleObject implements Member {
     {
         if (!override) {
             Class<?> caller = Reflection.getCallerClass();
-            checkAccess(caller, clazz, obj, modifiers);
+            checkAccess(caller, obj);
         }
         return getFieldAccessor(obj).getLong(obj);
     }
@@ -651,7 +651,7 @@ class Field extends AccessibleObject implements Member {
     {
         if (!override) {
             Class<?> caller = Reflection.getCallerClass();
-            checkAccess(caller, clazz, obj, modifiers);
+            checkAccess(caller, obj);
         }
         return getFieldAccessor(obj).getFloat(obj);
     }
@@ -687,7 +687,7 @@ class Field extends AccessibleObject implements Member {
     {
         if (!override) {
             Class<?> caller = Reflection.getCallerClass();
-            checkAccess(caller, clazz, obj, modifiers);
+            checkAccess(caller, obj);
         }
         return getFieldAccessor(obj).getDouble(obj);
     }
@@ -765,7 +765,7 @@ class Field extends AccessibleObject implements Member {
     {
         if (!override) {
             Class<?> caller = Reflection.getCallerClass();
-            checkAccess(caller, clazz, obj, modifiers);
+            checkAccess(caller, obj);
         }
         getFieldAccessor(obj).set(obj, value);
     }
@@ -801,7 +801,7 @@ class Field extends AccessibleObject implements Member {
     {
         if (!override) {
             Class<?> caller = Reflection.getCallerClass();
-            checkAccess(caller, clazz, obj, modifiers);
+            checkAccess(caller, obj);
         }
         getFieldAccessor(obj).setBoolean(obj, z);
     }
@@ -837,7 +837,7 @@ class Field extends AccessibleObject implements Member {
     {
         if (!override) {
             Class<?> caller = Reflection.getCallerClass();
-            checkAccess(caller, clazz, obj, modifiers);
+            checkAccess(caller, obj);
         }
         getFieldAccessor(obj).setByte(obj, b);
     }
@@ -873,7 +873,7 @@ class Field extends AccessibleObject implements Member {
     {
         if (!override) {
             Class<?> caller = Reflection.getCallerClass();
-            checkAccess(caller, clazz, obj, modifiers);
+            checkAccess(caller, obj);
         }
         getFieldAccessor(obj).setChar(obj, c);
     }
@@ -909,7 +909,7 @@ class Field extends AccessibleObject implements Member {
     {
         if (!override) {
             Class<?> caller = Reflection.getCallerClass();
-            checkAccess(caller, clazz, obj, modifiers);
+            checkAccess(caller, obj);
         }
         getFieldAccessor(obj).setShort(obj, s);
     }
@@ -945,7 +945,7 @@ class Field extends AccessibleObject implements Member {
     {
         if (!override) {
             Class<?> caller = Reflection.getCallerClass();
-            checkAccess(caller, clazz, obj, modifiers);
+            checkAccess(caller, obj);
         }
         getFieldAccessor(obj).setInt(obj, i);
     }
@@ -981,7 +981,7 @@ class Field extends AccessibleObject implements Member {
     {
         if (!override) {
             Class<?> caller = Reflection.getCallerClass();
-            checkAccess(caller, clazz, obj, modifiers);
+            checkAccess(caller, obj);
         }
         getFieldAccessor(obj).setLong(obj, l);
     }
@@ -1017,7 +1017,7 @@ class Field extends AccessibleObject implements Member {
     {
         if (!override) {
             Class<?> caller = Reflection.getCallerClass();
-            checkAccess(caller, clazz, obj, modifiers);
+            checkAccess(caller, obj);
         }
         getFieldAccessor(obj).setFloat(obj, f);
     }
@@ -1053,11 +1053,20 @@ class Field extends AccessibleObject implements Member {
     {
         if (!override) {
             Class<?> caller = Reflection.getCallerClass();
-            checkAccess(caller, clazz, obj, modifiers);
+            checkAccess(caller, obj);
         }
         getFieldAccessor(obj).setDouble(obj, d);
     }
 
+    // check access to field
+    private void checkAccess(Class<?> caller, Object obj)
+        throws IllegalAccessException
+    {
+        checkAccess(caller, clazz,
+                    Modifier.isStatic(modifiers) ? null : obj.getClass(),
+                    modifiers);
+    }
+
     // security check is done before calling this method
     private FieldAccessor getFieldAccessor(Object obj)
         throws IllegalAccessException

jdk/src/java.base/share/classes/java/lang/reflect/Method.java

@@ -526,7 +526,9 @@ public final class Method extends Executable {
     {
         if (!override) {
             Class<?> caller = Reflection.getCallerClass();
-            checkAccess(caller, clazz, obj, modifiers);
+            checkAccess(caller, clazz,
+                        Modifier.isStatic(modifiers) ? null : obj.getClass(),
+                        modifiers);
         }
         MethodAccessor ma = methodAccessor;             // read volatile
         if (ma == null) {

jdk/src/java.base/share/classes/java/net/InetAddress.java

@@ -321,6 +321,13 @@ class InetAddress implements java.io.Serializable {
                     public String getOriginalHostName(InetAddress ia) {
                         return ia.holder.getOriginalHostName();
                     }
+
+                    public InetAddress getByName(String hostName,
+                                                 InetAddress hostAddress)
+                            throws UnknownHostException
+                    {
+                        return InetAddress.getByName(hostName, hostAddress);
+                    }
                 }
         );
         init();

jdk/src/java.base/share/classes/java/net/URI.java

@@ -37,6 +37,9 @@ import java.nio.charset.CoderResult;
 import java.nio.charset.CodingErrorAction;
 import java.nio.charset.CharacterCodingException;
 import java.text.Normalizer;
+import jdk.internal.loader.URLClassPath;
+import jdk.internal.misc.JavaNetUriAccess;
+import jdk.internal.misc.SharedSecrets;
 import sun.nio.cs.ThreadLocalCoders;
 
 import java.lang.Character;             // for javadoc
@@ -819,6 +822,25 @@ public final class URI
             .parse(false);
     }
 
+    /**
+     * Constructs a simple URI consisting of only a scheme and a pre-validated
+     * path. Provides a fast-path for some internal cases.
+     */
+    URI(String scheme, String path) {
+        assert validSchemeAndPath(scheme, path);
+        this.scheme = scheme;
+        this.path = path;
+    }
+
+    private static boolean validSchemeAndPath(String scheme, String path) {
+        try {
+            URI u = new URI(scheme + ":" + path);
+            return scheme.equals(u.scheme) && path.equals(u.path);
+        } catch (URISyntaxException e) {
+            return false;
+        }
+    }
+
     /**
      * Creates a URI by parsing the given string.
      *
@@ -3571,5 +3593,13 @@ public final class URI
         }
 
     }
-
+    static {
+        SharedSecrets.setJavaNetUriAccess(
+            new JavaNetUriAccess() {
+                public URI create(String scheme, String path) {
+                    return new URI(scheme, path);
+                }
+            }
+        );
+    }
 }

jdk/src/java.base/share/classes/java/net/URLClassLoader.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2015, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2016, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -51,7 +51,7 @@ import java.util.jar.Manifest;
 
 import jdk.internal.loader.Resource;
 import jdk.internal.loader.URLClassPath;
-import jdk.internal.misc.JavaNetAccess;
+import jdk.internal.misc.JavaNetURLClassLoaderAccess;
 import jdk.internal.misc.SharedSecrets;
 import jdk.internal.perf.PerfCounter;
 import sun.net.www.ParseUtil;
@@ -767,10 +767,11 @@ public class URLClassLoader extends SecureClassLoader implements Closeable {
     }
 
     static {
-        SharedSecrets.setJavaNetAccess(
-            new JavaNetAccess() {
-                public URLClassPath getURLClassPath(URLClassLoader u) {
-                    return u.ucp;
+        SharedSecrets.setJavaNetURLClassLoaderAccess(
+            new JavaNetURLClassLoaderAccess() {
+                @Override
+                public AccessControlContext getAccessControlContext(URLClassLoader u) {
+                    return u.acc;
                 }
             }
         );

jdk/src/java.base/share/classes/java/security/ProtectionDomain.java

@@ -89,6 +89,11 @@ public class ProtectionDomain {
                 AccessController.getContext(), context);
         }
 
+        @Override
+        public ProtectionDomain[] getProtectDomains(AccessControlContext context) {
+            return context.getContext();
+        }
+
         private static AccessControlContext getCombinedACC(
             AccessControlContext context, AccessControlContext stack) {
             AccessControlContext acc =

jdk/src/java.base/share/classes/java/time/chrono/HijrahDate.java

@@ -368,7 +368,7 @@ public final class HijrahDate
         if (field instanceof ChronoField) {
             switch ((ChronoField) field) {
                 case DAY_OF_WEEK: return getDayOfWeek();
-                case ALIGNED_DAY_OF_WEEK_IN_MONTH: return ((getDayOfWeek() - 1) % 7) + 1;
+                case ALIGNED_DAY_OF_WEEK_IN_MONTH: return ((dayOfMonth - 1) % 7) + 1;
                 case ALIGNED_DAY_OF_WEEK_IN_YEAR: return ((getDayOfYear() - 1) % 7) + 1;
                 case DAY_OF_MONTH: return this.dayOfMonth;
                 case DAY_OF_YEAR: return this.getDayOfYear();

jdk/src/java.base/share/classes/java/time/format/DateTimeTextProvider.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, 2016, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -349,25 +349,40 @@ class DateTimeTextProvider {
 
         if (field == MONTH_OF_YEAR) {
             for (TextStyle textStyle : TextStyle.values()) {
-                Map<String, Integer> displayNames = CalendarDataUtility.retrieveJavaTimeFieldValueNames(
-                        "gregory", Calendar.MONTH, textStyle.toCalendarStyle(), locale);
                 Map<Long, String> map = new HashMap<>();
-                if (displayNames != null) {
-                    for (Entry<String, Integer> entry : displayNames.entrySet()) {
-                        map.put((long) (entry.getValue() + 1), entry.getKey());
-                    }
-
-                } else {
-                    // Narrow names may have duplicated names, such as "J" for January, Jun, July.
-                    // Get names one by one in that case.
+                // Narrow names may have duplicated names, such as "J" for January, June, July.
+                // Get names one by one in that case.
+                if ((textStyle.equals(TextStyle.NARROW) ||
+                        textStyle.equals(TextStyle.NARROW_STANDALONE))) {
                     for (int month = Calendar.JANUARY; month <= Calendar.DECEMBER; month++) {
                         String name;
                         name = CalendarDataUtility.retrieveJavaTimeFieldValueName(
-                                "gregory", Calendar.MONTH, month, textStyle.toCalendarStyle(), locale);
+                                "gregory", Calendar.MONTH,
+                                month, textStyle.toCalendarStyle(), locale);
                         if (name == null) {
                             break;
                         }
-                        map.put((long) (month + 1), name);
+                        map.put((month + 1L), name);
+                    }
+                } else {
+                    Map<String, Integer> displayNames = CalendarDataUtility.retrieveJavaTimeFieldValueNames(
+                            "gregory", Calendar.MONTH, textStyle.toCalendarStyle(), locale);
+                    if (displayNames != null) {
+                        for (Entry<String, Integer> entry : displayNames.entrySet()) {
+                            map.put((long)(entry.getValue() + 1), entry.getKey());
+                        }
+                    } else {
+                        // Although probability is very less, but if other styles have duplicate names.
+                        // Get names one by one in that case.
+                        for (int month = Calendar.JANUARY; month <= Calendar.DECEMBER; month++) {
+                            String name;
+                            name = CalendarDataUtility.retrieveJavaTimeFieldValueName(
+                                    "gregory", Calendar.MONTH, month, textStyle.toCalendarStyle(), locale);
+                            if (name == null) {
+                                break;
+                            }
+                            map.put((month + 1L), name);
+                        }
                     }
                 }
                 if (!map.isEmpty()) {
@@ -379,26 +394,41 @@ class DateTimeTextProvider {
 
         if (field == DAY_OF_WEEK) {
             for (TextStyle textStyle : TextStyle.values()) {
-                Map<String, Integer> displayNames = CalendarDataUtility.retrieveJavaTimeFieldValueNames(
-                        "gregory", Calendar.DAY_OF_WEEK, textStyle.toCalendarStyle(), locale);
                 Map<Long, String> map = new HashMap<>();
-                if (displayNames != null) {
-                    for (Entry<String, Integer> entry : displayNames.entrySet()) {
-                        map.put((long)toWeekDay(entry.getValue()), entry.getKey());
-                    }
-
-                } else {
-                    // Narrow names may have duplicated names, such as "S" for Sunday and Saturday.
-                    // Get names one by one in that case.
+                // Narrow names may have duplicated names, such as "S" for Sunday and Saturday.
+                // Get names one by one in that case.
+                if ((textStyle.equals(TextStyle.NARROW) ||
+                        textStyle.equals(TextStyle.NARROW_STANDALONE))) {
                     for (int wday = Calendar.SUNDAY; wday <= Calendar.SATURDAY; wday++) {
                         String name;
                         name = CalendarDataUtility.retrieveJavaTimeFieldValueName(
-                            "gregory", Calendar.DAY_OF_WEEK, wday, textStyle.toCalendarStyle(), locale);
+                                "gregory", Calendar.DAY_OF_WEEK,
+                                wday, textStyle.toCalendarStyle(), locale);
                         if (name == null) {
                             break;
                         }
                         map.put((long)toWeekDay(wday), name);
                     }
+                } else {
+                    Map<String, Integer> displayNames = CalendarDataUtility.retrieveJavaTimeFieldValueNames(
+                            "gregory", Calendar.DAY_OF_WEEK, textStyle.toCalendarStyle(), locale);
+                    if (displayNames != null) {
+                        for (Entry<String, Integer> entry : displayNames.entrySet()) {
+                            map.put((long)toWeekDay(entry.getValue()), entry.getKey());
+                        }
+                    } else {
+                        // Although probability is very less, but if other styles have duplicate names.
+                        // Get names one by one in that case.
+                        for (int wday = Calendar.SUNDAY; wday <= Calendar.SATURDAY; wday++) {
+                            String name;
+                            name = CalendarDataUtility.retrieveJavaTimeFieldValueName(
+                                    "gregory", Calendar.DAY_OF_WEEK, wday, textStyle.toCalendarStyle(), locale);
+                            if (name == null) {
+                                break;
+                            }
+                            map.put((long)toWeekDay(wday), name);
+                        }
+                    }
                 }
                 if (!map.isEmpty()) {
                     styleMap.put(textStyle, map);

jdk/src/java.base/share/classes/java/util/Optional.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012, 2015, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, 2016, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -236,7 +236,7 @@ public final class Optional<T> {
      *         present, otherwise an empty {@code Optional}
      * @throws NullPointerException if the mapping function is {@code null}
      */
-    public<U> Optional<U> map(Function<? super T, ? extends U> mapper) {
+    public <U> Optional<U> map(Function<? super T, ? extends U> mapper) {
         Objects.requireNonNull(mapper);
         if (!isPresent()) {
             return empty();
@@ -264,12 +264,14 @@ public final class Optional<T> {
      * @throws NullPointerException if the mapping function is {@code null} or
      *         returns a {@code null} result
      */
-    public<U> Optional<U> flatMap(Function<? super T, Optional<U>> mapper) {
+    public <U> Optional<U> flatMap(Function<? super T, ? extends Optional<? extends U>> mapper) {
         Objects.requireNonNull(mapper);
         if (!isPresent()) {
             return empty();
         } else {
-            return Objects.requireNonNull(mapper.apply(value));
+            @SuppressWarnings("unchecked")
+            Optional<U> r = (Optional<U>) mapper.apply(value);
+            return Objects.requireNonNull(r);
         }
     }
 
@@ -286,12 +288,14 @@ public final class Optional<T> {
      *         produces a {@code null} result
      * @since 9
      */
-    public Optional<T> or(Supplier<Optional<T>> supplier) {
+    public Optional<T> or(Supplier<? extends Optional<? extends T>> supplier) {
         Objects.requireNonNull(supplier);
         if (isPresent()) {
             return this;
         } else {
-            return Objects.requireNonNull(supplier.get());
+            @SuppressWarnings("unchecked")
+            Optional<T> r = (Optional<T>) supplier.get();
+            return Objects.requireNonNull(r);
         }
     }
 

jdk/src/java.base/share/classes/java/util/PropertyResourceBundle.java

@@ -63,7 +63,7 @@ import sun.util.ResourceBundleEnumeration;
  * files containing the resource data.  <code>ResourceBundle.getBundle</code>
  * will automatically look for the appropriate properties file and create a
  * <code>PropertyResourceBundle</code> that refers to it. See
- * {@link ResourceBundle#getBundle(java.lang.String, java.util.Locale, java.lang.ClassLoader) ResourceBundle.getBundle}
+ * {@link ResourceBundle#getBundle(String, Locale, ClassLoader) ResourceBundle.getBundle}
  * for a complete description of the search and instantiation strategy.
  *
  * <p>
@@ -105,19 +105,14 @@ import sun.util.ResourceBundleEnumeration;
  * </pre>
  * </blockquote>
  *
- * <p>
- * The implementation of a {@code PropertyResourceBundle} subclass must be
- * thread-safe if it's simultaneously used by multiple threads. The default
- * implementations of the non-abstract methods in this class are thread-safe.
- *
- * <p>
- * <strong>Note:</strong> PropertyResourceBundle can be constructed either
- * from an InputStream or a Reader, which represents a property file.
- * Constructing a PropertyResourceBundle instance from an InputStream requires
- * that the input stream be encoded in UTF-8. By default, if a
+ * @apiNote
+ * {@code PropertyResourceBundle} can be constructed either
+ * from an {@code InputStream} or a {@code Reader}, which represents a property file.
+ * Constructing a {@code PropertyResourceBundle} instance from an {@code InputStream}
+ * requires that the input stream be encoded in {@code UTF-8}. By default, if a
  * {@link java.nio.charset.MalformedInputException} or an
  * {@link java.nio.charset.UnmappableCharacterException} occurs on reading the
- * input stream, then the PropertyResourceBundle instance resets to the state
+ * input stream, then the {@code PropertyResourceBundle} instance resets to the state
  * before the exception, re-reads the input stream in {@code ISO-8859-1}, and
  * continues reading. If the system property
  * {@code java.util.PropertyResourceBundle.encoding} is set to either
@@ -126,8 +121,15 @@ import sun.util.ResourceBundleEnumeration;
  * If "ISO-8859-1" is specified, characters that cannot be represented in
  * ISO-8859-1 encoding must be represented by Unicode Escapes as defined in section
  * 3.3 of <cite>The Java&trade; Language Specification</cite>
- * whereas the other constructor which takes a Reader does not have that limitation.
+ * whereas the other constructor which takes a {@code Reader} does not have that limitation.
  * Other encoding values are ignored for this system property.
+ * The system property is read and evaluated when initializing this class.
+ * Changing or removing the property has no effect after the initialization.
+ *
+ * @implSpec
+ * The implementation of a {@code PropertyResourceBundle} subclass must be
+ * thread-safe if it's simultaneously used by multiple threads. The default
+ * implementations of the non-abstract methods in this class are thread-safe.
  *
  * @see ResourceBundle
  * @see ListResourceBundle
@@ -144,16 +146,18 @@ public class PropertyResourceBundle extends ResourceBundle {
 
     /**
      * Creates a property resource bundle from an {@link java.io.InputStream
-    * InputStream}. This constructor reads the property file in UTF-8 by default.
-    * If a {@link java.nio.charset.MalformedInputException} or an
-    * {@link java.nio.charset.UnmappableCharacterException} occurs on reading the
-    * input stream, then the PropertyResourceBundle instance resets to the state
-    * before the exception, re-reads the input stream in {@code ISO-8859-1} and
-    * continues reading. If the system property
-    * {@code java.util.PropertyResourceBundle.encoding} is set to either
-    * "ISO-8859-1" or "UTF-8", the input stream is solely read in that encoding,
-    * and throws the exception if it encounters an invalid sequence. Other
-    * encoding values are ignored for this system property.
+     * InputStream}. This constructor reads the property file in UTF-8 by default.
+     * If a {@link java.nio.charset.MalformedInputException} or an
+     * {@link java.nio.charset.UnmappableCharacterException} occurs on reading the
+     * input stream, then the PropertyResourceBundle instance resets to the state
+     * before the exception, re-reads the input stream in {@code ISO-8859-1} and
+     * continues reading. If the system property
+     * {@code java.util.PropertyResourceBundle.encoding} is set to either
+     * "ISO-8859-1" or "UTF-8", the input stream is solely read in that encoding,
+     * and throws the exception if it encounters an invalid sequence. Other
+     * encoding values are ignored for this system property.
+     * The system property is read and evaluated when initializing this class.
+     * Changing or removing the property has no effect after the initialization.
      *
      * @param stream an InputStream that represents a property file
      *        to read from.

jdk/src/java.base/share/classes/jdk/internal/jmod/JmodFile.java

@@ -71,7 +71,9 @@ public class JmodFile implements AutoCloseable {
         NATIVE_LIBS("native"),
         NATIVE_CMDS("bin"),
         CLASSES("classes"),
-        CONFIG("conf");
+        CONFIG("conf"),
+        HEADER_FILES("include"),
+        MAN_PAGES("man");
 
         private final String jmodDir;
         private Section(String jmodDir) {
@@ -151,6 +153,10 @@ public class JmodFile implements AutoCloseable {
                     return Section.CLASSES;
                 case "conf":
                     return Section.CONFIG;
+                case "include":
+                    return Section.HEADER_FILES;
+                case "man":
+                    return Section.MAN_PAGES;
                 default:
                     throw new IllegalArgumentException("invalid section: " + s);
             }

jdk/src/java.base/share/classes/jdk/internal/misc/JavaNetInetAddressAccess.java

@@ -26,6 +26,7 @@
 package jdk.internal.misc;
 
 import java.net.InetAddress;
+import java.net.UnknownHostException;
 
 public interface JavaNetInetAddressAccess {
     /**
@@ -33,4 +34,13 @@ public interface JavaNetInetAddressAccess {
      * the given InetAddress object.
      */
     String getOriginalHostName(InetAddress ia);
+
+    /**
+     * Get the InetAddress of the provided host. If an InetAddress is provided
+     * then it will be the default address returned for all calls to either
+     * form of getByName. This is required to maintain consistency when
+     * caching addresses and hostnames.
+     */
+    InetAddress getByName(String hostName, InetAddress hostAddress)
+            throws UnknownHostException;
 }

jdk/src/java.base/share/classes/jdk/internal/misc/JavaNetURLClassLoaderAccess.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006, 2015, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2016, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -26,11 +26,8 @@
 package jdk.internal.misc;
 
 import java.net.URLClassLoader;
-import jdk.internal.loader.URLClassPath;
+import java.security.AccessControlContext;
 
-public interface JavaNetAccess {
-    /**
-     * return the URLClassPath belonging to the given loader
-     */
-    URLClassPath getURLClassPath (URLClassLoader u);
+public interface JavaNetURLClassLoaderAccess {
+    AccessControlContext getAccessControlContext(URLClassLoader u);;
 }

jdk/src/java.base/share/classes/jdk/internal/misc/JavaNetUriAccess.java

@@ -0,0 +1,35 @@
+/*
+ * Copyright (c) 2006, 2016, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package jdk.internal.misc;
+
+import java.net.URI;
+
+public interface JavaNetUriAccess {
+    /**
+     * Create a URI of pre-validated scheme and path.
+     */
+    URI create(String scheme, String path);
+}

jdk/src/java.base/share/classes/jdk/internal/misc/JavaSecurityAccess.java

@@ -27,6 +27,7 @@ package jdk.internal.misc;
 
 import java.security.AccessControlContext;
 import java.security.PrivilegedAction;
+import java.security.ProtectionDomain;
 
 public interface JavaSecurityAccess {
 
@@ -37,4 +38,5 @@ public interface JavaSecurityAccess {
     <T> T doIntersectionPrivilege(PrivilegedAction<T> action,
                                   AccessControlContext context);
 
+    ProtectionDomain[] getProtectDomains(AccessControlContext context);
 }

jdk/src/java.base/share/classes/jdk/internal/misc/SharedSecrets.java

@@ -53,10 +53,11 @@ public class SharedSecrets {
     private static JavaLangInvokeAccess javaLangInvokeAccess;
     private static JavaLangRefAccess javaLangRefAccess;
     private static JavaIOAccess javaIOAccess;
-    private static JavaNetAccess javaNetAccess;
     private static JavaNetInetAddressAccess javaNetInetAddressAccess;
     private static JavaNetHttpCookieAccess javaNetHttpCookieAccess;
     private static JavaNetSocketAccess javaNetSocketAccess;
+    private static JavaNetUriAccess javaNetUriAccess;
+    private static JavaNetURLClassLoaderAccess javaNetURLClassLoaderAccess;
     private static JavaNioAccess javaNioAccess;
     private static JavaIOFileDescriptorAccess javaIOFileDescriptorAccess;
     private static JavaIOFilePermissionAccess javaIOFilePermissionAccess;
@@ -134,14 +135,24 @@ public class SharedSecrets {
         return javaLangRefAccess;
     }
 
-    public static void setJavaNetAccess(JavaNetAccess jna) {
-        javaNetAccess = jna;
+    public static void setJavaNetUriAccess(JavaNetUriAccess jnua) {
+        javaNetUriAccess = jnua;
     }
 
-    public static JavaNetAccess getJavaNetAccess() {
-        if (javaNetAccess == null)
+    public static JavaNetUriAccess getJavaNetUriAccess() {
+        if (javaNetUriAccess == null)
+            unsafe.ensureClassInitialized(java.net.URI.class);
+        return javaNetUriAccess;
+    }
+
+    public static void setJavaNetURLClassLoaderAccess(JavaNetURLClassLoaderAccess jnua) {
+        javaNetURLClassLoaderAccess = jnua;
+    }
+
+    public static JavaNetURLClassLoaderAccess getJavaNetURLClassLoaderAccess() {
+        if (javaNetURLClassLoaderAccess == null)
             unsafe.ensureClassInitialized(java.net.URLClassLoader.class);
-        return javaNetAccess;
+        return javaNetURLClassLoaderAccess;
     }
 
     public static void setJavaNetInetAddressAccess(JavaNetInetAddressAccess jna) {

jdk/src/java.base/share/classes/jdk/internal/reflect/Reflection.java

@@ -84,9 +84,22 @@ public class Reflection {
     public static native int getClassAccessFlags(Class<?> c);
 
 
+    /**
+     * Ensures that access to a member is granted and throws
+     * IllegalAccessException if not.
+     *
+     * @param currentClass the class performing the access
+     * @param memberClass the declaring class of the member being accessed
+     * @param targetClass the class of target object if accessing instance
+     *                    field or method;
+     *                    or the declaring class if accessing constructor;
+     *                    or null if accessing static field or method
+     * @param modifiers the member's access modifiers
+     * @throws IllegalAccessException if access to member is denied
+     */
     public static void ensureMemberAccess(Class<?> currentClass,
                                           Class<?> memberClass,
-                                          Object target,
+                                          Class<?> targetClass,
                                           int modifiers)
         throws IllegalAccessException
     {
@@ -94,18 +107,15 @@ public class Reflection {
             throw new InternalError();
         }
 
-        if (!verifyMemberAccess(currentClass, memberClass, target, modifiers)) {
-            throwIllegalAccessException(currentClass, memberClass, target, modifiers);
+        if (!verifyMemberAccess(currentClass, memberClass, targetClass, modifiers)) {
+            throwIllegalAccessException(currentClass, memberClass, targetClass, modifiers);
         }
     }
 
-    public static boolean verifyMemberAccess(Class<?> currentClass,
-                                             // Declaring class of field
-                                             // or method
-                                             Class<?> memberClass,
-                                             // May be NULL in case of statics
-                                             Object   target,
-                                             int      modifiers)
+    private static boolean verifyMemberAccess(Class<?> currentClass,
+                                              Class<?> memberClass,
+                                              Class<?> targetClass,
+                                              int modifiers)
     {
         // Verify that currentClass can access a field, method, or
         // constructor of memberClass, where that member's access bits are
@@ -162,18 +172,18 @@ public class Reflection {
             return false;
         }
 
-        if (Modifier.isProtected(modifiers)) {
-            // Additional test for protected members: JLS 6.6.2
-            Class<?> targetClass = (target == null ? memberClass : target.getClass());
-            if (targetClass != currentClass) {
-                if (!gotIsSameClassPackage) {
-                    isSameClassPackage = isSameClassPackage(currentClass, memberClass);
-                    gotIsSameClassPackage = true;
-                }
-                if (!isSameClassPackage) {
-                    if (!isSubclassOf(targetClass, currentClass)) {
-                        return false;
-                    }
+        // Additional test for protected instance members
+        // and protected constructors: JLS 6.6.2
+        if (targetClass != null && Modifier.isProtected(modifiers) &&
+            targetClass != currentClass)
+        {
+            if (!gotIsSameClassPackage) {
+                isSameClassPackage = isSameClassPackage(currentClass, memberClass);
+                gotIsSameClassPackage = true;
+            }
+            if (!isSameClassPackage) {
+                if (!isSubclassOf(targetClass, currentClass)) {
+                    return false;
                 }
             }
         }

jdk/src/java.base/share/classes/jdk/internal/reflect/ReflectionFactory.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2001, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2001, 2016, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -25,14 +25,25 @@
 
 package jdk.internal.reflect;
 
+import java.io.Externalizable;
+import java.io.ObjectInputStream;
+import java.io.ObjectOutputStream;
+import java.io.ObjectStreamClass;
+import java.io.OptionalDataException;
+import java.io.Serializable;
+import java.lang.invoke.MethodHandle;
+import java.lang.invoke.MethodHandles;
 import java.lang.reflect.Field;
 import java.lang.reflect.Executable;
+import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.lang.reflect.Constructor;
 import java.lang.reflect.Modifier;
 import java.security.Permission;
 import java.security.PrivilegedAction;
+import java.util.Objects;
 import java.util.Properties;
+
 import sun.reflect.misc.ReflectUtil;
 import sun.security.action.GetPropertyAction;
 
@@ -57,6 +68,9 @@ public class ReflectionFactory {
     // Provides access to package-private mechanisms in java.lang.reflect
     private static volatile LangReflectAccess langReflectAccess;
 
+    /* Method for static class initializer <clinit>, or null */
+    private static volatile Method hasStaticInitializerMethod;
+
     //
     // "Inflation" mechanism. Loading bytecodes to implement
     // Method.invoke() and Constructor.newInstance() currently costs
@@ -337,16 +351,41 @@ public class ReflectionFactory {
     //
     //
 
-    public Constructor<?> newConstructorForSerialization
-        (Class<?> classToInstantiate, Constructor<?> constructorToCall)
-    {
-        // Fast path
-        if (constructorToCall.getDeclaringClass() == classToInstantiate) {
-            return constructorToCall;
+    public final Constructor<?> newConstructorForExternalization(Class<?> cl) {
+        if (!Externalizable.class.isAssignableFrom(cl)) {
+            return null;
+        }
+        try {
+            Constructor<?> cons = cl.getConstructor();
+            cons.setAccessible(true);
+            return cons;
+        } catch (NoSuchMethodException ex) {
+            return null;
+        }
+    }
+
+    public final Constructor<?> newConstructorForSerialization(Class<?> cl) {
+        Class<?> initCl = cl;
+        while (Serializable.class.isAssignableFrom(initCl)) {
+            if ((initCl = initCl.getSuperclass()) == null) {
+                return null;
+            }
+        }
+        Constructor<?> constructorToCall;
+        try {
+            constructorToCall = initCl.getDeclaredConstructor();
+            int mods = constructorToCall.getModifiers();
+            if ((mods & Modifier.PRIVATE) != 0 ||
+                    ((mods & (Modifier.PUBLIC | Modifier.PROTECTED)) == 0 &&
+                            !packageEquals(cl, initCl))) {
+                return null;
+            }
+        } catch (NoSuchMethodException ex) {
+            return null;
         }
 
         ConstructorAccessor acc = new MethodAccessorGenerator().
-            generateSerializationConstructor(classToInstantiate,
+            generateSerializationConstructor(cl,
                                              constructorToCall.getParameterTypes(),
                                              constructorToCall.getExceptionTypes(),
                                              constructorToCall.getModifiers(),
@@ -364,9 +403,151 @@ public class ReflectionFactory {
                                           langReflectAccess().
                                           getConstructorParameterAnnotations(constructorToCall));
         setConstructorAccessor(c, acc);
+        c.setAccessible(true);
         return c;
     }
 
+    public final MethodHandle readObjectForSerialization(Class<?> cl) {
+        return findReadWriteObjectForSerialization(cl, "readObject", ObjectInputStream.class);
+    }
+
+    public final MethodHandle readObjectNoDataForSerialization(Class<?> cl) {
+        return findReadWriteObjectForSerialization(cl, "readObjectNoData", ObjectInputStream.class);
+    }
+
+    public final MethodHandle writeObjectForSerialization(Class<?> cl) {
+        return findReadWriteObjectForSerialization(cl, "writeObject", ObjectOutputStream.class);
+    }
+
+    private final MethodHandle findReadWriteObjectForSerialization(Class<?> cl,
+                                                                   String methodName,
+                                                                   Class<?> streamClass) {
+        if (!Serializable.class.isAssignableFrom(cl)) {
+            return null;
+        }
+
+        try {
+            Method meth = cl.getDeclaredMethod(methodName, streamClass);
+            int mods = meth.getModifiers();
+            if (meth.getReturnType() != Void.TYPE ||
+                    Modifier.isStatic(mods) ||
+                    !Modifier.isPrivate(mods)) {
+                return null;
+            }
+            meth.setAccessible(true);
+            return MethodHandles.lookup().unreflect(meth);
+        } catch (NoSuchMethodException ex) {
+            return null;
+        } catch (IllegalAccessException ex1) {
+            throw new InternalError("Error", ex1);
+        }
+    }
+
+    /**
+     * Returns a MethodHandle for {@code writeReplace} on the serializable class
+     * or null if no match found.
+     * @param cl a serializable class
+     * @returnss the {@code writeReplace} MethodHandle or {@code null} if not found
+     */
+    public final MethodHandle writeReplaceForSerialization(Class<?> cl) {
+        return getReplaceResolveForSerialization(cl, "writeReplace");
+    }
+
+    /**
+     * Returns a MethodHandle for {@code readResolve} on the serializable class
+     * or null if no match found.
+     * @param cl a serializable class
+     * @returns the {@code writeReplace} MethodHandle or {@code null} if not found
+     */
+    public final MethodHandle readResolveForSerialization(Class<?> cl) {
+        return getReplaceResolveForSerialization(cl, "readResolve");
+    }
+
+    /**
+     * Lookup readResolve or writeReplace on a class with specified
+     * signature constraints.
+     * @param cl a serializable class
+     * @param methodName the method name to find
+     * @returns a MethodHandle for the method or {@code null} if not found or
+     *       has the wrong signature.
+     */
+    private MethodHandle getReplaceResolveForSerialization(Class<?> cl,
+                                                           String methodName) {
+        if (!Serializable.class.isAssignableFrom(cl)) {
+            return null;
+        }
+
+        Class<?> defCl = cl;
+        while (defCl != null) {
+            try {
+                Method m = defCl.getDeclaredMethod(methodName);
+                if (m.getReturnType() != Object.class) {
+                    return null;
+                }
+                int mods = m.getModifiers();
+                if (Modifier.isStatic(mods) | Modifier.isAbstract(mods)) {
+                    return null;
+                } else if (Modifier.isPublic(mods) | Modifier.isProtected(mods)) {
+                    // fall through
+                } else if (Modifier.isPrivate(mods) && (cl != defCl)) {
+                    return null;
+                } else if (!packageEquals(cl, defCl)) {
+                    return null;
+                }
+                try {
+                    // Normal return
+                    m.setAccessible(true);
+                    return MethodHandles.lookup().unreflect(m);
+                } catch (IllegalAccessException ex0) {
+                    // setAccessible should prevent IAE
+                    throw new InternalError("Error", ex0);
+                }
+            } catch (NoSuchMethodException ex) {
+                defCl = defCl.getSuperclass();
+            }
+        }
+        return null;
+    }
+
+    /**
+     * Returns true if the given class defines a static initializer method,
+     * false otherwise.
+     */
+    public final boolean hasStaticInitializerForSerialization(Class<?> cl) {
+        Method m = hasStaticInitializerMethod;
+        if (m == null) {
+            try {
+                m = ObjectStreamClass.class.getDeclaredMethod("hasStaticInitializer",
+                        new Class<?>[]{Class.class});
+                m.setAccessible(true);
+                hasStaticInitializerMethod = m;
+            } catch (NoSuchMethodException ex) {
+                throw new InternalError("No such method hasStaticInitializer on "
+                        + ObjectStreamClass.class, ex);
+            }
+        }
+        try {
+            return (Boolean) m.invoke(null, cl);
+        } catch (InvocationTargetException | IllegalAccessException ex) {
+            throw new InternalError("Exception invoking hasStaticInitializer", ex);
+        }
+    }
+
+    /**
+     * Return the accessible constructor for OptionalDataException signaling eof.
+     * @returns the eof constructor for OptionalDataException
+     */
+    public final Constructor<OptionalDataException> newOptionalDataExceptionForSerialization() {
+        try {
+            Constructor<OptionalDataException> boolCtor =
+                    OptionalDataException.class.getDeclaredConstructor(Boolean.TYPE);
+            boolCtor.setAccessible(true);
+            return boolCtor;
+        } catch (NoSuchMethodException ex) {
+            throw new InternalError("Constructor not found", ex);
+        }
+    }
+
     //--------------------------------------------------------------------------
     //
     // Internals only below this point
@@ -426,4 +607,17 @@ public class ReflectionFactory {
         }
         return langReflectAccess;
     }
+
+    /**
+     * Returns true if classes are defined in the classloader and same package, false
+     * otherwise.
+     * @param cl1 a class
+     * @param cl2 another class
+     * @returns true if the two classes are in the same classloader and package
+     */
+    private static boolean packageEquals(Class<?> cl1, Class<?> cl2) {
+        return cl1.getClassLoader() == cl2.getClassLoader() &&
+                Objects.equals(cl1.getPackage(), cl2.getPackage());
+    }
+
 }

jdk/src/java.base/share/classes/module-info.java

@@ -171,8 +171,10 @@ module java.base {
         jdk.jartool,
         jdk.jdeps,
         jdk.jlink,
+        jdk.jshell,
         jdk.net,
         jdk.scripting.nashorn,
+        jdk.scripting.nashorn.shell,
         jdk.unsupported,
         jdk.vm.ci;
     exports jdk.internal.perf to
@@ -238,8 +240,7 @@ module java.base {
         java.xml.ws;
     exports sun.security.action to
         java.desktop,
-        java.security.jgss,
-        jdk.crypto.pkcs11;
+        java.security.jgss;
     exports sun.security.internal.interfaces to
         jdk.crypto.pkcs11;
     exports sun.security.internal.spec to
@@ -265,6 +266,8 @@ module java.base {
         jdk.crypto.pkcs11;
     exports sun.security.ssl to
         java.security.jgss;
+    exports sun.security.timestamp to
+        jdk.jartool;
     exports sun.security.tools to
         jdk.jartool;
     exports sun.security.util to

jdk/src/java.base/share/classes/sun/net/www/protocol/http/AuthenticationHeader.java

@@ -25,8 +25,11 @@
 
 package sun.net.www.protocol.http;
 
+import java.util.Collections;
 import java.util.Iterator;
 import java.util.HashMap;
+import java.util.Set;
+
 import sun.net.www.*;
 import sun.security.action.GetPropertyAction;
 
@@ -67,8 +70,8 @@ import sun.security.action.GetPropertyAction;
  *      -Dhttp.auth.preference="scheme"
  *
  * which in this case, specifies that "scheme" should be used as the auth scheme when offered
- * disregarding the default prioritisation. If scheme is not offered then the default priority
- * is used.
+ * disregarding the default prioritisation. If scheme is not offered, or explicitly
+ * disabled, by {@code disabledSchemes}, then the default priority is used.
  *
  * Attention: when http.auth.preference is set as SPNEGO or Kerberos, it's actually "Negotiate
  * with SPNEGO" or "Negotiate with Kerberos", which means the user will prefer the Negotiate
@@ -113,17 +116,32 @@ public class AuthenticationHeader {
     String hdrname; // Name of the header to look for
 
     /**
-     * parse a set of authentication headers and choose the preferred scheme
-     * that we support for a given host
+     * Parses a set of authentication headers and chooses the preferred scheme
+     * that is supported for a given host.
      */
     public AuthenticationHeader (String hdrname, MessageHeader response,
             HttpCallerInfo hci, boolean dontUseNegotiate) {
+        this(hdrname, response, hci, dontUseNegotiate, Collections.emptySet());
+    }
+
+    /**
+     * Parses a set of authentication headers and chooses the preferred scheme
+     * that is supported for a given host.
+     *
+     * <p> The {@code disabledSchemes} parameter is a, possibly empty, set of
+     * authentication schemes that are disabled.
+     */
+    public AuthenticationHeader(String hdrname,
+                                MessageHeader response,
+                                HttpCallerInfo hci,
+                                boolean dontUseNegotiate,
+                                Set<String> disabledSchemes) {
         this.hci = hci;
         this.dontUseNegotiate = dontUseNegotiate;
-        rsp = response;
+        this.rsp = response;
         this.hdrname = hdrname;
-        schemes = new HashMap<>();
-        parse();
+        this.schemes = new HashMap<>();
+        parse(disabledSchemes);
     }
 
     public HttpCallerInfo getHttpCallerInfo() {
@@ -143,10 +161,11 @@ public class AuthenticationHeader {
      * then the last one will be used. The
      * preferred scheme that we support will be used.
      */
-    private void parse () {
+    private void parse(Set<String> disabledSchemes) {
         Iterator<String> iter = rsp.multiValueIterator(hdrname);
         while (iter.hasNext()) {
             String raw = iter.next();
+            // HeaderParser lower cases everything, so can be used case-insensitively
             HeaderParser hp = new HeaderParser(raw);
             Iterator<String> keys = hp.keys();
             int i, lastSchemeIndex;
@@ -156,7 +175,8 @@ public class AuthenticationHeader {
                     if (lastSchemeIndex != -1) {
                         HeaderParser hpn = hp.subsequence (lastSchemeIndex, i);
                         String scheme = hpn.findKey(0);
-                        schemes.put (scheme, new SchemeMapValue (hpn, raw));
+                        if (!disabledSchemes.contains(scheme))
+                            schemes.put(scheme, new SchemeMapValue (hpn, raw));
                     }
                     lastSchemeIndex = i;
                 }
@@ -164,7 +184,8 @@ public class AuthenticationHeader {
             if (i > lastSchemeIndex) {
                 HeaderParser hpn = hp.subsequence (lastSchemeIndex, i);
                 String scheme = hpn.findKey(0);
-                schemes.put(scheme, new SchemeMapValue (hpn, raw));
+                if (!disabledSchemes.contains(scheme))
+                    schemes.put(scheme, new SchemeMapValue (hpn, raw));
             }
         }
 

jdk/src/java.base/share/classes/sun/net/www/protocol/http/HttpURLConnection.java

@@ -25,6 +25,7 @@
 
 package sun.net.www.protocol.http;
 
+import java.security.PrivilegedAction;
 import java.util.Arrays;
 import java.net.URL;
 import java.net.URLConnection;
@@ -109,6 +110,14 @@ public class HttpURLConnection extends java.net.HttpURLConnection {
     static final boolean validateProxy;
     static final boolean validateServer;
 
+    /** A, possibly empty, set of authentication schemes that are disabled
+     *  when proxying plain HTTP ( not HTTPS ). */
+    static final Set<String> disabledProxyingSchemes;
+
+    /** A, possibly empty, set of authentication schemes that are disabled
+     *  when setting up a tunnel for HTTPS ( HTTP CONNECT ). */
+    static final Set<String> disabledTunnelingSchemes;
+
     private StreamingOutputStream strOutputStream;
     private static final String RETRY_MSG1 =
         "cannot retry due to proxy authentication, in streaming mode";
@@ -206,6 +215,22 @@ public class HttpURLConnection extends java.net.HttpURLConnection {
         "Via"
     };
 
+    private static String getNetProperty(String name) {
+        PrivilegedAction<String> pa = () -> NetProperties.get(name);
+        return AccessController.doPrivileged(pa);
+    }
+
+    private static Set<String> schemesListToSet(String list) {
+        if (list == null || list.isEmpty())
+            return Collections.emptySet();
+
+        Set<String> s = new HashSet<>();
+        String[] parts = list.split("\\s*,\\s*");
+        for (String part : parts)
+            s.add(part.toLowerCase(Locale.ROOT));
+        return s;
+    }
+
     static {
         Properties props = GetPropertyAction.privilegedGetProperties();
         maxRedirects = GetIntegerAction.privilegedGetProperty(
@@ -218,6 +243,14 @@ public class HttpURLConnection extends java.net.HttpURLConnection {
             agent = agent + " Java/"+version;
         }
         userAgent = agent;
+
+        // A set of net properties to control the use of authentication schemes
+        // when proxing/tunneling.
+        String p = getNetProperty("jdk.http.auth.tunneling.disabledSchemes");
+        disabledTunnelingSchemes = schemesListToSet(p);
+        p = getNetProperty("jdk.http.auth.proxying.disabledSchemes");
+        disabledProxyingSchemes = schemesListToSet(p);
+
         validateProxy = Boolean.parseBoolean(
                 props.getProperty("http.auth.digest.validateProxy"));
         validateServer = Boolean.parseBoolean(
@@ -1575,10 +1608,13 @@ public class HttpURLConnection extends java.net.HttpURLConnection {
                     // altered in similar ways.
 
                     AuthenticationHeader authhdr = new AuthenticationHeader (
-                            "Proxy-Authenticate", responses,
-                            new HttpCallerInfo(url, http.getProxyHostUsed(),
-                                http.getProxyPortUsed()),
-                            dontUseNegotiate
+                            "Proxy-Authenticate",
+                            responses,
+                            new HttpCallerInfo(url,
+                                               http.getProxyHostUsed(),
+                                               http.getProxyPortUsed()),
+                            dontUseNegotiate,
+                            disabledProxyingSchemes
                     );
 
                     if (!doingNTLMp2ndStage) {
@@ -2024,11 +2060,14 @@ public class HttpURLConnection extends java.net.HttpURLConnection {
                         }
                     }
 
-                    AuthenticationHeader authhdr = new AuthenticationHeader (
-                            "Proxy-Authenticate", responses,
-                            new HttpCallerInfo(url, http.getProxyHostUsed(),
-                                http.getProxyPortUsed()),
-                            dontUseNegotiate
+                    AuthenticationHeader authhdr = new AuthenticationHeader(
+                            "Proxy-Authenticate",
+                            responses,
+                            new HttpCallerInfo(url,
+                                               http.getProxyHostUsed(),
+                                               http.getProxyPortUsed()),
+                            dontUseNegotiate,
+                            disabledTunnelingSchemes
                     );
                     if (!doingNTLMp2ndStage) {
                         proxyAuthentication =

jdk/src/java.base/share/classes/sun/reflect/misc/ReflectUtil.java

@@ -44,9 +44,21 @@ public final class ReflectUtil {
         return Class.forName(name);
     }
 
-    /*
-     * Reflection.ensureMemberAccess is overly-restrictive
-     * due to a bug. We awkwardly work around it for now.
+    /**
+     * Ensures that access to a method or field is granted and throws
+     * IllegalAccessException if not. This method is not suitable for checking
+     * access to constructors.
+     *
+     * @param currentClass the class performing the access
+     * @param memberClass the declaring class of the member being accessed
+     * @param target the target object if accessing instance field or method;
+     *               or null if accessing static field or method or if target
+     *               object access rights will be checked later
+     * @param modifiers the member's access modifiers
+     * @throws IllegalAccessException if access to member is denied
+     * @implNote Delegates directly to
+     *           {@link Reflection#ensureMemberAccess(Class, Class, Class, int)}
+     *           which should be used instead.
      */
     public static void ensureMemberAccess(Class<?> currentClass,
                                           Class<?> memberClass,
@@ -54,62 +66,10 @@ public final class ReflectUtil {
                                           int modifiers)
         throws IllegalAccessException
     {
-        if (target == null && Modifier.isProtected(modifiers)) {
-            int mods = modifiers;
-            mods = mods & (~Modifier.PROTECTED);
-            mods = mods | Modifier.PUBLIC;
-
-            /*
-             * See if we fail because of class modifiers
-             */
-            Reflection.ensureMemberAccess(currentClass,
-                                          memberClass,
-                                          target,
-                                          mods);
-            try {
-                /*
-                 * We're still here so class access was ok.
-                 * Now try with default field access.
-                 */
-                mods = mods & (~Modifier.PUBLIC);
-                Reflection.ensureMemberAccess(currentClass,
-                                              memberClass,
-                                              target,
-                                              mods);
-                /*
-                 * We're still here so access is ok without
-                 * checking for protected.
-                 */
-                return;
-            } catch (IllegalAccessException e) {
-                /*
-                 * Access failed but we're 'protected' so
-                 * if the test below succeeds then we're ok.
-                 */
-                if (isSubclassOf(currentClass, memberClass)) {
-                    return;
-                } else {
-                    throw e;
-                }
-            }
-        } else {
-            Reflection.ensureMemberAccess(currentClass,
-                                          memberClass,
-                                          target,
-                                          modifiers);
-        }
-    }
-
-    private static boolean isSubclassOf(Class<?> queryClass,
-                                        Class<?> ofClass)
-    {
-        while (queryClass != null) {
-            if (queryClass == ofClass) {
-                return true;
-            }
-            queryClass = queryClass.getSuperclass();
-        }
-        return false;
+        Reflection.ensureMemberAccess(currentClass,
+                                      memberClass,
+                                      target == null ? null : target.getClass(),
+                                      modifiers);
     }
 
     /**

jdk/src/java.base/share/classes/sun/security/pkcs/SignerInfo.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 2015, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2016, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -28,20 +28,38 @@ package sun.security.pkcs;
 import java.io.OutputStream;
 import java.io.IOException;
 import java.math.BigInteger;
+import java.security.CryptoPrimitive;
+import java.security.InvalidKeyException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.Principal;
+import java.security.PublicKey;
+import java.security.Signature;
+import java.security.SignatureException;
+import java.security.Timestamp;
 import java.security.cert.CertificateException;
 import java.security.cert.CertificateFactory;
 import java.security.cert.CertPath;
 import java.security.cert.X509Certificate;
-import java.security.*;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Collections;
+import java.util.EnumSet;
+import java.util.Set;
 
 import sun.security.timestamp.TimestampToken;
-import sun.security.util.*;
+import sun.security.util.Debug;
+import sun.security.util.DerEncoder;
+import sun.security.util.DerInputStream;
+import sun.security.util.DerOutputStream;
+import sun.security.util.DerValue;
+import sun.security.util.DisabledAlgorithmConstraints;
+import sun.security.util.HexDumpEncoder;
+import sun.security.util.KeyUtil;
+import sun.security.util.ObjectIdentifier;
 import sun.security.x509.AlgorithmId;
 import sun.security.x509.X500Name;
 import sun.security.x509.KeyUsageExtension;
-import sun.security.util.HexDumpEncoder;
 
 /**
  * A SignerInfo, as defined in PKCS#7's signedData type.
@@ -50,6 +68,17 @@ import sun.security.util.HexDumpEncoder;
  */
 public class SignerInfo implements DerEncoder {
 
+    // Digest and Signature restrictions
+    private static final Set<CryptoPrimitive> DIGEST_PRIMITIVE_SET =
+            Collections.unmodifiableSet(EnumSet.of(CryptoPrimitive.MESSAGE_DIGEST));
+
+    private static final Set<CryptoPrimitive> SIG_PRIMITIVE_SET =
+            Collections.unmodifiableSet(EnumSet.of(CryptoPrimitive.SIGNATURE));
+
+    private static final DisabledAlgorithmConstraints JAR_DISABLED_CHECK =
+            new DisabledAlgorithmConstraints(
+                    DisabledAlgorithmConstraints.PROPERTY_JAR_DISABLED_ALGS);
+
     BigInteger version;
     X500Name issuerName;
     BigInteger certificateSerialNumber;
@@ -318,6 +347,13 @@ public class SignerInfo implements DerEncoder {
                 if (messageDigest == null) // fail if there is no message digest
                     return null;
 
+                // check that algorithm is not restricted
+                if (!JAR_DISABLED_CHECK.permits(DIGEST_PRIMITIVE_SET,
+                        digestAlgname, null)) {
+                    throw new SignatureException("Digest check failed. " +
+                            "Disabled algorithm used: " + digestAlgname);
+                }
+
                 MessageDigest md = MessageDigest.getInstance(digestAlgname);
                 byte[] computedMessageDigest = md.digest(data);
 
@@ -349,12 +385,26 @@ public class SignerInfo implements DerEncoder {
             String algname = AlgorithmId.makeSigAlg(
                     digestAlgname, encryptionAlgname);
 
-            Signature sig = Signature.getInstance(algname);
-            X509Certificate cert = getCertificate(block);
+            // check that algorithm is not restricted
+            if (!JAR_DISABLED_CHECK.permits(SIG_PRIMITIVE_SET, algname, null)) {
+                throw new SignatureException("Signature check failed. " +
+                        "Disabled algorithm used: " + algname);
+            }
 
+            X509Certificate cert = getCertificate(block);
+            PublicKey key = cert.getPublicKey();
             if (cert == null) {
                 return null;
             }
+
+            // check if the public key is restricted
+            if (!JAR_DISABLED_CHECK.permits(SIG_PRIMITIVE_SET, key)) {
+                throw new SignatureException("Public key check failed. " +
+                        "Disabled key used: " +
+                        KeyUtil.getKeySize(key) + " bit " +
+                        key.getAlgorithm());
+            }
+
             if (cert.hasUnsupportedCriticalExtension()) {
                 throw new SignatureException("Certificate has unsupported "
                                              + "critical extension(s)");
@@ -391,11 +441,9 @@ public class SignerInfo implements DerEncoder {
                 }
             }
 
-            PublicKey key = cert.getPublicKey();
+            Signature sig = Signature.getInstance(algname);
             sig.initVerify(key);
-
             sig.update(dataSigned);
-
             if (sig.verify(encryptedDigest)) {
                 return this;
             }
@@ -450,6 +498,23 @@ public class SignerInfo implements DerEncoder {
         return unauthenticatedAttributes;
     }
 
+    /**
+     * Returns the timestamp PKCS7 data unverified.
+     * @return a PKCS7 object
+     */
+    public PKCS7 getTsToken() throws IOException {
+        if (unauthenticatedAttributes == null) {
+            return null;
+        }
+        PKCS9Attribute tsTokenAttr =
+                unauthenticatedAttributes.getAttribute(
+                        PKCS9Attribute.SIGNATURE_TIMESTAMP_TOKEN_OID);
+        if (tsTokenAttr == null) {
+            return null;
+        }
+        return new PKCS7((byte[])tsTokenAttr.getValue());
+    }
+
     /*
      * Extracts a timestamp from a PKCS7 SignerInfo.
      *
@@ -477,19 +542,12 @@ public class SignerInfo implements DerEncoder {
         if (timestamp != null || !hasTimestamp)
             return timestamp;
 
-        if (unauthenticatedAttributes == null) {
-            hasTimestamp = false;
-            return null;
-        }
-        PKCS9Attribute tsTokenAttr =
-            unauthenticatedAttributes.getAttribute(
-                PKCS9Attribute.SIGNATURE_TIMESTAMP_TOKEN_OID);
-        if (tsTokenAttr == null) {
+        PKCS7 tsToken = getTsToken();
+        if (tsToken == null) {
             hasTimestamp = false;
             return null;
         }
 
-        PKCS7 tsToken = new PKCS7((byte[])tsTokenAttr.getValue());
         // Extract the content (an encoded timestamp token info)
         byte[] encTsTokenInfo = tsToken.getContentInfo().getData();
         // Extract the signer (the Timestamping Authority)
@@ -515,9 +573,16 @@ public class SignerInfo implements DerEncoder {
      */
     private void verifyTimestamp(TimestampToken token)
         throws NoSuchAlgorithmException, SignatureException {
+        String digestAlgname = token.getHashAlgorithm().getName();
+        // check that algorithm is not restricted
+        if (!JAR_DISABLED_CHECK.permits(DIGEST_PRIMITIVE_SET, digestAlgname,
+                null)) {
+            throw new SignatureException("Timestamp token digest check failed. " +
+                    "Disabled algorithm used: " + digestAlgname);
+        }
 
         MessageDigest md =
-            MessageDigest.getInstance(token.getHashAlgorithm().getName());
+            MessageDigest.getInstance(digestAlgname);
 
         if (!Arrays.equals(token.getHashedMessage(),
             md.digest(encryptedDigest))) {

jdk/src/java.base/share/classes/sun/security/provider/certpath/AlgorithmChecker.java

@@ -185,20 +185,22 @@ public final class AlgorithmChecker extends PKIXCertPathChecker {
             AlgorithmConstraints constraints,
             Date pkixdate) {
 
-        if (anchor == null) {
-            throw new IllegalArgumentException(
-                    "The trust anchor cannot be null");
-        }
-
-        if (anchor.getTrustedCert() != null) {
-            this.trustedPubKey = anchor.getTrustedCert().getPublicKey();
-            // Check for anchor certificate restrictions
-            trustedMatch = checkFingerprint(anchor.getTrustedCert());
-            if (trustedMatch && debug != null) {
-                debug.println("trustedMatch = true");
+        if (anchor != null) {
+            if (anchor.getTrustedCert() != null) {
+                this.trustedPubKey = anchor.getTrustedCert().getPublicKey();
+                // Check for anchor certificate restrictions
+                trustedMatch = checkFingerprint(anchor.getTrustedCert());
+                if (trustedMatch && debug != null) {
+                    debug.println("trustedMatch = true");
+                }
+            } else {
+                this.trustedPubKey = anchor.getCAPublicKey();
             }
         } else {
-            this.trustedPubKey = anchor.getCAPublicKey();
+            this.trustedPubKey = null;
+            if (debug != null) {
+                debug.println("TrustAnchor is null, trustedMatch is false.");
+            }
         }
 
         this.prevPubKey = trustedPubKey;

jdk/src/java.base/share/classes/sun/security/provider/certpath/ForwardBuilder.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -816,18 +816,22 @@ class ForwardBuilder extends Builder {
 
     /**
      * Verifies whether the input certificate completes the path.
-     * Checks the cert against each trust anchor that was specified, in order,
-     * and returns true as soon as it finds a valid anchor.
-     * Returns true if the cert matches a trust anchor specified as a
-     * certificate or if the cert verifies with a trust anchor that
-     * was specified as a trusted {pubkey, caname} pair. Returns false if none
-     * of the trust anchors are valid for this cert.
+     * First checks the cert against each trust anchor that was specified,
+     * in order, and returns true if the cert matches the trust anchor
+     * specified as a certificate or has the same key and subject of an anchor
+     * specified as a trusted {pubkey, caname} pair.
+     * If no match has been found, does a second check of the cert against
+     * anchors specified as a trusted {pubkey, caname} pair to see if the cert
+     * was issued by that anchor.
+     * Returns false if none of the trust anchors are valid for this cert.
      *
      * @param cert the certificate to test
      * @return a boolean value indicating whether the cert completes the path.
      */
     @Override
     boolean isPathCompleted(X509Certificate cert) {
+        List<TrustAnchor> otherAnchors = new ArrayList<>();
+        // first, check if cert is already trusted
         for (TrustAnchor anchor : trustAnchors) {
             if (anchor.getTrustedCert() != null) {
                 if (cert.equals(anchor.getTrustedCert())) {
@@ -849,7 +853,12 @@ class ForwardBuilder extends Builder {
                 }
                 // else, it is a self-issued certificate of the anchor
             }
-
+            otherAnchors.add(anchor);
+        }
+        // next, check if cert is issued by anchor specified by key/name
+        for (TrustAnchor anchor : otherAnchors) {
+            X500Principal principal = anchor.getCA();
+            PublicKey publicKey = anchor.getCAPublicKey();
             // Check subject/issuer name chaining
             if (principal == null ||
                     !principal.equals(cert.getIssuerX500Principal())) {

jdk/src/java.base/share/classes/sun/security/provider/certpath/OCSP.java

@@ -35,6 +35,7 @@ import java.security.cert.CertPathValidatorException;
 import java.security.cert.CertPathValidatorException.BasicReason;
 import java.security.cert.CRLReason;
 import java.security.cert.Extension;
+import java.security.cert.TrustAnchor;
 import java.security.cert.X509Certificate;
 import java.util.Arrays;
 import java.util.Collections;
@@ -163,6 +164,15 @@ public final class OCSP {
                                          X509Certificate responderCert,
                                          Date date, List<Extension> extensions)
         throws IOException, CertPathValidatorException
+    {
+        return check(cert, responderURI, null, issuerCert, responderCert, date, extensions);
+    }
+
+    public static RevocationStatus check(X509Certificate cert,
+            URI responderURI, TrustAnchor anchor, X509Certificate issuerCert,
+            X509Certificate responderCert, Date date,
+            List<Extension> extensions)
+            throws IOException, CertPathValidatorException
     {
         CertId certId = null;
         try {
@@ -173,8 +183,8 @@ public final class OCSP {
                 ("Exception while encoding OCSPRequest", e);
         }
         OCSPResponse ocspResponse = check(Collections.singletonList(certId),
-            responderURI, new OCSPResponse.IssuerInfo(issuerCert),
-            responderCert, date, extensions);
+                responderURI, new OCSPResponse.IssuerInfo(anchor, issuerCert),
+                responderCert, date, extensions);
         return (RevocationStatus) ocspResponse.getSingleResponse(certId);
     }
 

jdk/src/java.base/share/classes/sun/security/provider/certpath/OCSPResponse.java

@@ -507,9 +507,8 @@ public final class OCSPResponse {
 
                 // Check algorithm constraints specified in security property
                 // "jdk.certpath.disabledAlgorithms".
-                AlgorithmChecker algChecker = new AlgorithmChecker(
-                        new TrustAnchor(issuerInfo.getName(),
-                                issuerInfo.getPublicKey(), null));
+                AlgorithmChecker algChecker =
+                        new AlgorithmChecker(issuerInfo.getAnchor(), date);
                 algChecker.init(false);
                 algChecker.check(signerCert, Collections.<String>emptySet());
 
@@ -982,36 +981,38 @@ public final class OCSPResponse {
     /**
      * Helper class that allows consumers to pass in issuer information.  This
      * will always consist of the issuer's name and public key, but may also
-     * contain a certificate if the originating data is in that form.
+     * contain a certificate if the originating data is in that form.  The
+     * trust anchor for the certificate chain will be included for certpath
+     * disabled algorithm checking.
      */
     static final class IssuerInfo {
+        private final TrustAnchor anchor;
         private final X509Certificate certificate;
         private final X500Principal name;
         private final PublicKey pubKey;
 
-        IssuerInfo(X509Certificate issuerCert) {
-            certificate = Objects.requireNonNull(issuerCert,
-                    "Constructor requires non-null certificate");
-            name = certificate.getSubjectX500Principal();
-            pubKey = certificate.getPublicKey();
-        }
-
-        IssuerInfo(X500Principal subjectName, PublicKey key) {
-            certificate = null;
-            name = Objects.requireNonNull(subjectName,
-                    "Constructor requires non-null subject");
-            pubKey = Objects.requireNonNull(key,
-                    "Constructor requires non-null public key");
-        }
-
         IssuerInfo(TrustAnchor anchor) {
-            certificate = anchor.getTrustedCert();
-            if (certificate != null) {
-                name = certificate.getSubjectX500Principal();
-                pubKey = certificate.getPublicKey();
+            this(anchor, (anchor != null) ? anchor.getTrustedCert() : null);
+        }
+
+        IssuerInfo(X509Certificate issuerCert) {
+            this(null, issuerCert);
+        }
+
+        IssuerInfo(TrustAnchor anchor, X509Certificate issuerCert) {
+            if (anchor == null && issuerCert == null) {
+                throw new NullPointerException("TrustAnchor and issuerCert " +
+                        "cannot be null");
+            }
+            this.anchor = anchor;
+            if (issuerCert != null) {
+                name = issuerCert.getSubjectX500Principal();
+                pubKey = issuerCert.getPublicKey();
+                certificate = issuerCert;
             } else {
                 name = anchor.getCA();
                 pubKey = anchor.getCAPublicKey();
+                certificate = anchor.getTrustedCert();
             }
         }
 
@@ -1046,6 +1047,15 @@ public final class OCSPResponse {
             return pubKey;
         }
 
+        /**
+         * Get the TrustAnchor for the certificate chain.
+         *
+         * @return a {@code TrustAnchor}.
+         */
+        TrustAnchor getAnchor() {
+            return anchor;
+        }
+
         /**
          * Create a string representation of this IssuerInfo.
          *

jdk/src/java.base/share/classes/sun/security/provider/certpath/RevocationChecker.java

@@ -437,7 +437,7 @@ class RevocationChecker extends PKIXRevocationChecker {
     private void updateState(X509Certificate cert)
         throws CertPathValidatorException
     {
-        issuerInfo = new OCSPResponse.IssuerInfo(cert);
+        issuerInfo = new OCSPResponse.IssuerInfo(anchor, cert);
 
         // Make new public key if parameters are missing
         PublicKey pubKey = cert.getPublicKey();
@@ -740,8 +740,8 @@ class RevocationChecker extends PKIXRevocationChecker {
                 }
 
                 response = OCSP.check(Collections.singletonList(certId),
-                                      responderURI, issuerInfo,
-                                      responderCert, null, ocspExtensions);
+                        responderURI, issuerInfo, responderCert, params.date(),
+                        ocspExtensions);
             }
         } catch (IOException e) {
             throw new CertPathValidatorException(

jdk/src/java.base/share/classes/sun/security/util/CurveDB.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006, 2014, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2006, 2016, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -664,6 +664,74 @@ public class CurveDB {
             0xFF70, nameSplitPattern);
 */
 
+        /*
+         * Brainpool curves (RFC 5639)
+         * (Twisted curves are not included)
+         */
+
+        add("brainpoolP160r1", "1.3.36.3.3.2.8.1.1.1", P,
+            "E95E4A5F737059DC60DFC7AD95B3D8139515620F",
+            "340E7BE2A280EB74E2BE61BADA745D97E8F7C300",
+            "1E589A8595423412134FAA2DBDEC95C8D8675E58",
+            "BED5AF16EA3F6A4F62938C4631EB5AF7BDBCDBC3",
+            "1667CB477A1A8EC338F94741669C976316DA6321",
+            "E95E4A5F737059DC60DF5991D45029409E60FC09",
+            1, nameSplitPattern);
+
+        add("brainpoolP192r1", "1.3.36.3.3.2.8.1.1.3", P,
+            "C302F41D932A36CDA7A3463093D18DB78FCE476DE1A86297",
+            "6A91174076B1E0E19C39C031FE8685C1CAE040E5C69A28EF",
+            "469A28EF7C28CCA3DC721D044F4496BCCA7EF4146FBF25C9",
+            "C0A0647EAAB6A48753B033C56CB0F0900A2F5C4853375FD6",
+            "14B690866ABD5BB88B5F4828C1490002E6773FA2FA299B8F",
+            "C302F41D932A36CDA7A3462F9E9E916B5BE8F1029AC4ACC1",
+            1, nameSplitPattern);
+
+        add("brainpoolP224r1", "1.3.36.3.3.2.8.1.1.5", P,
+            "D7C134AA264366862A18302575D1D787B09F075797DA89F57EC8C0FF",
+            "68A5E62CA9CE6C1C299803A6C1530B514E182AD8B0042A59CAD29F43",
+            "2580F63CCFE44138870713B1A92369E33E2135D266DBB372386C400B",
+            "0D9029AD2C7E5CF4340823B2A87DC68C9E4CE3174C1E6EFDEE12C07D",
+            "58AA56F772C0726F24C6B89E4ECDAC24354B9E99CAA3F6D3761402CD",
+            "D7C134AA264366862A18302575D0FB98D116BC4B6DDEBCA3A5A7939F",
+            1, nameSplitPattern);
+
+        add("brainpoolP256r1", "1.3.36.3.3.2.8.1.1.7", P,
+            "A9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377",
+            "7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9",
+            "26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6",
+            "8BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262",
+            "547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997",
+            "A9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7",
+            1, nameSplitPattern);
+
+        add("brainpoolP320r1", "1.3.36.3.3.2.8.1.1.9", P,
+            "D35E472036BC4FB7E13C785ED201E065F98FCFA6F6F40DEF4F92B9EC7893EC28FCD412B1F1B32E27",
+            "3EE30B568FBAB0F883CCEBD46D3F3BB8A2A73513F5EB79DA66190EB085FFA9F492F375A97D860EB4",
+            "520883949DFDBC42D3AD198640688A6FE13F41349554B49ACC31DCCD884539816F5EB4AC8FB1F1A6",
+            "43BD7E9AFB53D8B85289BCC48EE5BFE6F20137D10A087EB6E7871E2A10A599C710AF8D0D39E20611",
+            "14FDD05545EC1CC8AB4093247F77275E0743FFED117182EAA9C77877AAAC6AC7D35245D1692E8EE1",
+            "D35E472036BC4FB7E13C785ED201E065F98FCFA5B68F12A32D482EC7EE8658E98691555B44C59311",
+            1, nameSplitPattern);
+
+        add("brainpoolP384r1", "1.3.36.3.3.2.8.1.1.11", P,
+            "8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B412B1DA197FB71123ACD3A729901D1A71874700133107EC53",
+            "7BC382C63D8C150C3C72080ACE05AFA0C2BEA28E4FB22787139165EFBA91F90F8AA5814A503AD4EB04A8C7DD22CE2826",
+            "04A8C7DD22CE28268B39B55416F0447C2FB77DE107DCD2A62E880EA53EEB62D57CB4390295DBC9943AB78696FA504C11",
+            "1D1C64F068CF45FFA2A63A81B7C13F6B8847A3E77EF14FE3DB7FCAFE0CBD10E8E826E03436D646AAEF87B2E247D4AF1E",
+            "8ABE1D7520F9C2A45CB1EB8E95CFD55262B70B29FEEC5864E19C054FF99129280E4646217791811142820341263C5315",
+            "8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B31F166E6CAC0425A7CF3AB6AF6B7FC3103B883202E9046565",
+            1, nameSplitPattern);
+
+        add("brainpoolP512r1", "1.3.36.3.3.2.8.1.1.13", P,
+            "AADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA703308717D4D9B009BC66842AECDA12AE6A380E62881FF2F2D82C68528AA6056583A48F3",
+            "7830A3318B603B89E2327145AC234CC594CBDD8D3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CA",
+            "3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CADC083E67984050B75EBAE5DD2809BD638016F723",
+            "81AEE4BDD82ED9645A21322E9C4C6A9385ED9F70B5D916C1B43B62EEF4D0098EFF3B1F78E2D0D48D50D1687B93B97D5F7C6D5047406A5E688B352209BCB9F822",
+            "7DDE385D566332ECC0EABFA9CF7822FDF209F70024A57B1AA000C55B881F8111B2DCDE494A5F485E5BCA4BD88A2763AED1CA2B2FA8F0540678CD1E0F3AD80892",
+            "AADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA70330870553E5C414CA92619418661197FAC10471DB1D381085DDADDB58796829CA90069",
+            1, nameSplitPattern);
+
         specCollection = Collections.unmodifiableCollection(oidMap.values());
     }
 }

jdk/src/java.base/share/classes/sun/security/util/DisabledAlgorithmConstraints.java

@@ -60,6 +60,10 @@ public class DisabledAlgorithmConstraints extends AbstractAlgorithmConstraints {
     public static final String PROPERTY_TLS_DISABLED_ALGS =
             "jdk.tls.disabledAlgorithms";
 
+    // the known security property, jdk.jar.disabledAlgorithms
+    public static final String PROPERTY_JAR_DISABLED_ALGS =
+            "jdk.jar.disabledAlgorithms";
+
     private final String[] disabledAlgorithms;
     private final Constraints algorithmConstraints;
 
@@ -73,6 +77,14 @@ public class DisabledAlgorithmConstraints extends AbstractAlgorithmConstraints {
         this(propertyName, new AlgorithmDecomposer());
     }
 
+    /**
+     * Initialize algorithm constraints with the specified security property
+     * for a specific usage type.
+     *
+     * @param propertyName the security property name that define the disabled
+     *        algorithm constraints
+     * @param decomposer an alternate AlgorithmDecomposer.
+     */
     public DisabledAlgorithmConstraints(String propertyName,
             AlgorithmDecomposer decomposer) {
         super(decomposer);
@@ -530,7 +542,8 @@ public class DisabledAlgorithmConstraints extends AbstractAlgorithmConstraints {
                 }
                 throw new CertPathValidatorException(
                         "Algorithm constraints check failed on certificate " +
-                                "anchor limits",
+                                "anchor limits. " + algorithm + " used with " +
+                                cp.getCertificate().getSubjectX500Principal(),
                         null, null, -1, BasicReason.ALGORITHM_CONSTRAINED);
             }
         }
@@ -611,8 +624,8 @@ public class DisabledAlgorithmConstraints extends AbstractAlgorithmConstraints {
                      return;
                  }
                  throw new CertPathValidatorException(
-                         "denyAfter constraint check failed.  " +
-                                 "Constraint date: " +
+                         "denyAfter constraint check failed: " + algorithm +
+                                 " used with Constraint date: " +
                                  dateFormat.format(denyAfterDate) + "; "
                                  + errmsg + dateFormat.format(currentDate),
                          null, null, -1, BasicReason.ALGORITHM_CONSTRAINED);
@@ -644,6 +657,7 @@ public class DisabledAlgorithmConstraints extends AbstractAlgorithmConstraints {
         private int minSize;            // the minimal available key size
         private int maxSize;            // the maximal available key size
         private int prohibitedSize = -1;    // unavailable key sizes
+        private int size;
 
         public KeySizeConstraint(String algo, Operator operator, int length) {
             algorithm = algo;
@@ -695,7 +709,9 @@ public class DisabledAlgorithmConstraints extends AbstractAlgorithmConstraints {
                     return;
                 }
                 throw new CertPathValidatorException(
-                        "Algorithm constraints check failed on keysize limits",
+                        "Algorithm constraints check failed on keysize limits. "
+                                + algorithm + " " + size + "bit key used with "
+                                + cp.getCertificate().getSubjectX500Principal(),
                         null, null, -1, BasicReason.ALGORITHM_CONSTRAINED);
             }
         }
@@ -722,7 +738,7 @@ public class DisabledAlgorithmConstraints extends AbstractAlgorithmConstraints {
                 return true;
             }
 
-            int size = KeyUtil.getKeySize(key);
+            size = KeyUtil.getKeySize(key);
             if (size == 0) {
                 return false;    // we don't allow any key of size 0.
             } else if (size > 0) {

jdk/src/java.base/share/classes/sun/security/util/SignatureFileVerifier.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2016, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -25,26 +25,49 @@
 
 package sun.security.util;
 
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.security.CodeSigner;
+import java.security.CryptoPrimitive;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.SignatureException;
 import java.security.cert.CertPath;
 import java.security.cert.X509Certificate;
 import java.security.cert.CertificateException;
 import java.security.cert.CertificateFactory;
-import java.security.*;
-import java.io.*;
-import java.util.*;
-import java.util.jar.*;
-
-import sun.security.pkcs.*;
+import java.util.ArrayList;
 import java.util.Base64;
+import java.util.Collections;
+import java.util.EnumSet;
+import java.util.HashMap;
+import java.util.Hashtable;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Set;
+import java.util.jar.Attributes;
+import java.util.jar.JarException;
+import java.util.jar.JarFile;
+import java.util.jar.Manifest;
 
 import sun.security.jca.Providers;
+import sun.security.pkcs.PKCS7;
+import sun.security.pkcs.SignerInfo;
 
 public class SignatureFileVerifier {
 
     /* Are we debugging ? */
     private static final Debug debug = Debug.getInstance("jar");
 
-    /* cache of CodeSigner objects */
+    private static final Set<CryptoPrimitive> DIGEST_PRIMITIVE_SET =
+            Collections.unmodifiableSet(EnumSet.of(CryptoPrimitive.MESSAGE_DIGEST));
+
+    private static final DisabledAlgorithmConstraints JAR_DISABLED_CHECK =
+            new DisabledAlgorithmConstraints(
+                    DisabledAlgorithmConstraints.PROPERTY_JAR_DISABLED_ALGS);
+
     private ArrayList<CodeSigner[]> signerCache;
 
     private static final String ATTR_DIGEST =
@@ -199,8 +222,15 @@ public class SignatureFileVerifier {
 
     /** get digest from cache */
 
-    private MessageDigest getDigest(String algorithm)
-    {
+    private MessageDigest getDigest(String algorithm) throws SignatureException {
+        // check that algorithm is not restricted
+        if (!JAR_DISABLED_CHECK.permits(DIGEST_PRIMITIVE_SET, algorithm, null)) {
+            SignatureException e =
+                    new SignatureException("SignatureFile check failed. " +
+                            "Disabled algorithm used: " + algorithm);
+            throw e;
+        }
+
         if (createdDigests == null)
             createdDigests = new HashMap<>();
 
@@ -320,7 +350,7 @@ public class SignatureFileVerifier {
     private boolean verifyManifestHash(Manifest sf,
                                        ManifestDigester md,
                                        List<Object> manifestDigests)
-         throws IOException
+         throws IOException, SignatureException
     {
         Attributes mattr = sf.getMainAttributes();
         boolean manifestSigned = false;
@@ -364,7 +394,7 @@ public class SignatureFileVerifier {
 
     private boolean verifyManifestMainAttrs(Manifest sf,
                                         ManifestDigester md)
-         throws IOException
+         throws IOException, SignatureException
     {
         Attributes mattr = sf.getMainAttributes();
         boolean attrsVerified = true;
@@ -430,14 +460,14 @@ public class SignatureFileVerifier {
     private boolean verifySection(Attributes sfAttr,
                                   String name,
                                   ManifestDigester md)
-         throws IOException
+         throws IOException, SignatureException
     {
         boolean oneDigestVerified = false;
         ManifestDigester.Entry mde = md.get(name,block.isOldStyle());
 
         if (mde == null) {
             throw new SecurityException(
-                  "no manifiest section for signature file entry "+name);
+                  "no manifest section for signature file entry "+name);
         }
 
         if (sfAttr != null) {

jdk/src/java.base/share/conf/net.properties

@@ -72,3 +72,30 @@ ftp.nonProxyHosts=localhost|127.*|[::1]
 # value is 10).
 # http.KeepAlive.remainingData=512
 # http.KeepAlive.queuedConnections=10
+
+# Authentication Scheme restrictions for HTTP and HTTPS.
+#
+# In some environments certain authentication schemes may be undesirable
+# when proxying HTTP or HTTPS.  For example, "Basic" results in effectively the
+# cleartext transmission of the user's password over the physical network.
+# This section describes the mechanism for disabling authentication schemes
+# based on the scheme name. Disabled schemes will be treated as if they are not
+# supported by the implementation.
+#
+# The 'jdk.http.auth.tunneling.disabledSchemes' property lists the authentication
+# schemes that will be disabled when tunneling HTTPS over a proxy, HTTP CONNECT.
+# The 'jdk.http.auth.proxying.disabledSchemes' property lists the authentication
+# schemes that will be disabled when proxying HTTP.
+#
+# In both cases the property is a comma-separated list of, case-insensitive,
+# authentication scheme names, as defined by their relevant RFCs. An
+# implementation may, but is not required to, support common schemes whose names
+# include: 'Basic', 'Digest', 'NTLM', 'Kerberos', 'Negotiate'.  A scheme that
+# is not known, or not supported, by the implementation is ignored.
+#
+# Note: This property is currently used by the JDK Reference implementation. It
+# is not guaranteed to be examined and used by other implementations.
+#
+#jdk.http.auth.proxying.disabledSchemes=
+jdk.http.auth.tunneling.disabledSchemes=Basic
+

jdk/src/java.base/share/conf/security/java.security

@@ -655,6 +655,44 @@ krb5.kdc.bad.policy = tryLast
 jdk.certpath.disabledAlgorithms=MD2, MD5, SHA1 jdkCA & denyAfter 2017-01-01, \
     RSA keySize < 1024, DSA keySize < 1024, EC keySize < 224
 
+# Algorithm restrictions for signed JAR files
+#
+# In some environments, certain algorithms or key lengths may be undesirable
+# for signed JAR validation.  For example, "MD2" is generally no longer
+# considered to be a secure hash algorithm.  This section describes the
+# mechanism for disabling algorithms based on algorithm name and/or key length.
+# JARs signed with any of the disabled algorithms or key sizes will be treated
+# as unsigned.
+#
+# The syntax of the disabled algorithm string is described as follows:
+#   DisabledAlgorithms:
+#       " DisabledAlgorithm { , DisabledAlgorithm } "
+#
+#   DisabledAlgorithm:
+#       AlgorithmName [Constraint]
+#
+#   AlgorithmName:
+#       (see below)
+#
+#   Constraint:
+#       KeySizeConstraint
+#
+#   KeySizeConstraint:
+#       keySize Operator KeyLength
+#
+#   Operator:
+#       <= | < | == | != | >= | >
+#
+#   KeyLength:
+#       Integer value of the algorithm's key length in bits
+#
+# Note: This property is currently used by the JDK Reference
+# implementation. It is not guaranteed to be examined and used by other
+# implementations.
+#
+jdk.jar.disabledAlgorithms=MD2, MD5, RSA keySize < 1024, \
+      DSA keySize < 1024
+
 # Algorithm restrictions for Secure Socket Layer/Transport Layer Security
 # (SSL/TLS/DTLS) processing
 #
@@ -935,3 +973,4 @@ jdk.xml.dsig.secureValidationPolicy=\
 # Otherwise, the status is UNDECIDED.
 #
 #jdk.serialFilter=pattern;pattern
+

jdk/src/java.base/share/lib/security/default.policy

@@ -103,7 +103,6 @@ grant codeBase "jrt:/jdk.crypto.ec" {
     permission java.lang.RuntimePermission
                    "accessClassInPackage.sun.security.*";
     permission java.lang.RuntimePermission "loadLibrary.sunec";
-    permission java.util.PropertyPermission "*", "read";
     permission java.security.SecurityPermission "putProviderProperty.SunEC";
     permission java.security.SecurityPermission "clearProviderProperties.SunEC";
     permission java.security.SecurityPermission "removeProviderProperty.SunEC";
@@ -112,11 +111,11 @@ grant codeBase "jrt:/jdk.crypto.ec" {
 grant codeBase "jrt:/jdk.crypto.pkcs11" {
     permission java.lang.RuntimePermission
                    "accessClassInPackage.sun.security.*";
-    permission java.lang.RuntimePermission "accessClassInPackage.sun.misc";
     permission java.lang.RuntimePermission "accessClassInPackage.sun.nio.ch";
     permission java.lang.RuntimePermission "loadLibrary.j2pkcs11";
-    // needs "security.pkcs11.allowSingleThreadedModules"
-    permission java.util.PropertyPermission "*", "read";
+    permission java.util.PropertyPermission "sun.security.pkcs11.allowSingleThreadedModules", "read";
+    permission java.util.PropertyPermission "os.name", "read";
+    permission java.util.PropertyPermission "os.arch", "read";
     permission java.security.SecurityPermission "putProviderProperty.*";
     permission java.security.SecurityPermission "clearProviderProperties.*";
     permission java.security.SecurityPermission "removeProviderProperty.*";

jdk/src/java.base/share/native/libverify/check_code.c

@@ -1293,14 +1293,13 @@ verify_opcode_operands(context_type *context, unsigned int inumber, int offset)
     case JVM_OPC_invokevirtual:
     case JVM_OPC_invokespecial:
     case JVM_OPC_invokestatic:
-    case JVM_OPC_invokedynamic:
     case JVM_OPC_invokeinterface: {
         /* Make sure the constant pool item is the right type. */
         int key = (code[offset + 1] << 8) + code[offset + 2];
         const char *methodname;
         jclass cb = context->class;
         fullinfo_type clazz_info;
-        int is_constructor, is_internal, is_invokedynamic;
+        int is_constructor, is_internal;
         int kind;
 
         switch (opcode ) {
@@ -1309,9 +1308,6 @@ verify_opcode_operands(context_type *context, unsigned int inumber, int offset)
                        ? (1 << JVM_CONSTANT_Methodref)
                        : ((1 << JVM_CONSTANT_InterfaceMethodref) | (1 << JVM_CONSTANT_Methodref)));
             break;
-        case JVM_OPC_invokedynamic:
-            kind = 1 << JVM_CONSTANT_NameAndType;
-            break;
         case JVM_OPC_invokeinterface:
             kind = 1 << JVM_CONSTANT_InterfaceMethodref;
             break;
@@ -1319,7 +1315,6 @@ verify_opcode_operands(context_type *context, unsigned int inumber, int offset)
             kind = 1 << JVM_CONSTANT_Methodref;
         }
 
-        is_invokedynamic = opcode == JVM_OPC_invokedynamic;
         /* Make sure the constant pool item is the right type. */
         verify_constant_pool_type(context, key, kind);
         methodname = JVM_GetCPMethodNameUTF(env, cb, key);
@@ -1328,11 +1323,8 @@ verify_opcode_operands(context_type *context, unsigned int inumber, int offset)
         is_internal = methodname[0] == '<';
         pop_and_free(context);
 
-        if (is_invokedynamic)
-          clazz_info = context->object_info;  // anything will do
-        else
-          clazz_info = cp_index_to_class_fullinfo(context, key,
-                                                  JVM_CONSTANT_Methodref);
+        clazz_info = cp_index_to_class_fullinfo(context, key,
+                                                JVM_CONSTANT_Methodref);
         this_idata->operand.i = key;
         this_idata->operand2.fi = clazz_info;
         if (is_constructor) {
@@ -1387,17 +1379,15 @@ verify_opcode_operands(context_type *context, unsigned int inumber, int offset)
                         "Fourth operand byte of invokeinterface must be zero");
             }
             pop_and_free(context);
-        } else if (opcode == JVM_OPC_invokedynamic) {
-            if (code[offset + 3] != 0 || code[offset + 4] != 0) {
-                CCerror(context,
-                        "Third and fourth operand bytes of invokedynamic must be zero");
-            }
         } else if (opcode == JVM_OPC_invokevirtual
                       || opcode == JVM_OPC_invokespecial)
             set_protected(context, inumber, key, opcode);
         break;
     }
 
+    case JVM_OPC_invokedynamic:
+        CCerror(context,
+                "invokedynamic bytecode is not supported in this class file version");
 
     case JVM_OPC_instanceof:
     case JVM_OPC_checkcast:
@@ -2085,7 +2075,6 @@ pop_stack(context_type *context, unsigned int inumber, stack_info_type *new_stac
 
         case JVM_OPC_invokevirtual: case JVM_OPC_invokespecial:
         case JVM_OPC_invokeinit:    /* invokespecial call to <init> */
-        case JVM_OPC_invokedynamic:
         case JVM_OPC_invokestatic: case JVM_OPC_invokeinterface: {
             /* The top stuff on the stack depends on the method signature */
             int operand = this_idata->operand.i;
@@ -2101,8 +2090,7 @@ pop_stack(context_type *context, unsigned int inumber, stack_info_type *new_stac
                 print_formatted_methodname(context, operand);
             }
 #endif
-            if (opcode != JVM_OPC_invokestatic &&
-                opcode != JVM_OPC_invokedynamic)
+            if (opcode != JVM_OPC_invokestatic)
                 /* First, push the object */
                 *ip++ = (opcode == JVM_OPC_invokeinit ? '@' : 'A');
             for (p = signature + 1; *p != JVM_SIGNATURE_ENDFUNC; ) {
@@ -2388,7 +2376,6 @@ pop_stack(context_type *context, unsigned int inumber, stack_info_type *new_stac
 
         case JVM_OPC_invokevirtual: case JVM_OPC_invokespecial:
         case JVM_OPC_invokeinit:
-        case JVM_OPC_invokedynamic:
         case JVM_OPC_invokeinterface: case JVM_OPC_invokestatic: {
             int operand = this_idata->operand.i;
             const char *signature =
@@ -2398,8 +2385,7 @@ pop_stack(context_type *context, unsigned int inumber, stack_info_type *new_stac
             int item;
             const char *p;
             check_and_push(context, signature, VM_STRING_UTF);
-            if (opcode == JVM_OPC_invokestatic ||
-                opcode == JVM_OPC_invokedynamic) {
+            if (opcode == JVM_OPC_invokestatic) {
                 item = 0;
             } else if (opcode == JVM_OPC_invokeinit) {
                 fullinfo_type init_type = this_idata->operand2.fi;
@@ -2795,7 +2781,6 @@ push_stack(context_type *context, unsigned int inumber, stack_info_type *new_sta
 
         case JVM_OPC_invokevirtual: case JVM_OPC_invokespecial:
         case JVM_OPC_invokeinit:
-        case JVM_OPC_invokedynamic:
         case JVM_OPC_invokestatic: case JVM_OPC_invokeinterface: {
             /* Look to signature to determine correct result. */
             int operand = this_idata->operand.i;

jdk/src/java.base/solaris/lib/security/default.policy

@@ -4,7 +4,10 @@ grant codeBase "jrt:/jdk.crypto.ucrypto" {
     permission java.lang.RuntimePermission "accessClassInPackage.sun.nio.ch";
     permission java.lang.RuntimePermission "loadLibrary.j2ucrypto";
     // need "com.oracle.security.ucrypto.debug" for debugging
-    permission java.util.PropertyPermission "*", "read";
+    permission java.util.PropertyPermission "com.oracle.security.ucrypto.debug", "read";
+    permission java.util.PropertyPermission "file.separator", "read";
+    permission java.util.PropertyPermission "java.home", "read";
+    permission java.util.PropertyPermission "os.name", "read";
     permission java.security.SecurityPermission
                    "putProviderProperty.OracleUcrypto";
     permission java.security.SecurityPermission

jdk/src/java.base/unix/native/libnet/net_util_md.c

@@ -273,13 +273,10 @@ int cmpScopeID (unsigned int scope, struct sockaddr *him) {
 
 #endif
 
-
 void
 NET_ThrowByNameWithLastError(JNIEnv *env, const char *name,
                    const char *defaultDetail) {
-    char errmsg[255];
-    sprintf(errmsg, "errno: %d, error: %s\n", errno, defaultDetail);
-    JNU_ThrowByNameWithLastError(env, name, errmsg);
+    JNU_ThrowByNameWithMessageAndLastError(env, name, defaultDetail);
 }
 
 void

jdk/src/java.base/windows/native/libjli/java_md.c

@@ -48,6 +48,10 @@ static jboolean GetJVMPath(const char *jrepath, const char *jvmtype,
                            char *jvmpath, jint jvmpathsize);
 static jboolean GetJREPath(char *path, jint pathsize);
 
+#ifdef USE_REGISTRY_LOOKUP
+jboolean GetPublicJREHome(char *buf, jint bufsize);
+#endif
+
 /* We supports warmup for UI stack that is performed in parallel
  * to VM initialization.
  * This helps to improve startup of UI application as warmup phase
@@ -346,6 +350,14 @@ GetJREPath(char *path, jint pathsize)
         }
     }
 
+#ifdef USE_REGISTRY_LOOKUP
+    /* Lookup public JRE using Windows registry. */
+    if (GetPublicJREHome(path, pathsize)) {
+        JLI_TraceLauncher("JRE path is %s\n", path);
+        return JNI_TRUE;
+    }
+#endif
+
     JLI_ReportErrorMessage(JRE_ERROR8 JAVA_DLL);
     return JNI_FALSE;
 }

jdk/src/java.base/windows/native/libnet/NetworkInterface_winXP.c

@@ -554,14 +554,20 @@ static jobject createNetworkInterfaceXP(JNIEnv *env, netif *ifs)
      * Create a NetworkInterface object and populate it
      */
     netifObj = (*env)->NewObject(env, ni_class, ni_ctor);
+    if (netifObj == NULL) {
+        return NULL;
+    }
     name = (*env)->NewStringUTF(env, ifs->name);
+    if (name == NULL) {
+        return NULL;
+    }
     if (ifs->dNameIsUnicode) {
         displayName = (*env)->NewString(env, (PWCHAR)ifs->displayName,
                                         (jsize)wcslen ((PWCHAR)ifs->displayName));
     } else {
         displayName = (*env)->NewStringUTF(env, ifs->displayName);
     }
-    if (netifObj == NULL || name == NULL || displayName == NULL) {
+    if (displayName == NULL) {
         return NULL;
     }
     (*env)->SetObjectField(env, netifObj, ni_nameID, name);
@@ -621,26 +627,28 @@ static jobject createNetworkInterfaceXP(JNIEnv *env, netif *ifs)
             (*env)->SetObjectArrayElement(env, bindsArr, bind_index++, ibObj);
         } else /* AF_INET6 */ {
             int scope;
+            jboolean ret;
             iaObj = (*env)->NewObject(env, ia6_class, ia6_ctrID);
-            if (iaObj) {
-                jboolean ret = setInet6Address_ipaddress(env, iaObj, (jbyte *)&(addrs->addr.sa6.sin6_addr.s6_addr));
-                if (ret == JNI_FALSE) {
-                    return NULL;
-                }
-                scope = addrs->addr.sa6.sin6_scope_id;
-                if (scope != 0) { /* zero is default value, no need to set */
-                    setInet6Address_scopeid(env, iaObj, scope);
-                    setInet6Address_scopeifname(env, iaObj, netifObj);
-                }
-                ibObj = (*env)->NewObject(env, ni_ibcls, ni_ibctrID);
-                if (ibObj == NULL) {
-                  free_netaddr(netaddrP);
-                  return NULL;
-                }
-                (*env)->SetObjectField(env, ibObj, ni_ibaddressID, iaObj);
-                (*env)->SetShortField(env, ibObj, ni_ibmaskID, addrs->mask);
-                (*env)->SetObjectArrayElement(env, bindsArr, bind_index++, ibObj);
+            if (iaObj == NULL) {
+                return NULL;
             }
+            ret = setInet6Address_ipaddress(env, iaObj, (jbyte *)&(addrs->addr.sa6.sin6_addr.s6_addr));
+            if (ret == JNI_FALSE) {
+                return NULL;
+            }
+            scope = addrs->addr.sa6.sin6_scope_id;
+            if (scope != 0) { /* zero is default value, no need to set */
+                setInet6Address_scopeid(env, iaObj, scope);
+                setInet6Address_scopeifname(env, iaObj, netifObj);
+            }
+            ibObj = (*env)->NewObject(env, ni_ibcls, ni_ibctrID);
+            if (ibObj == NULL) {
+              free_netaddr(netaddrP);
+              return NULL;
+            }
+            (*env)->SetObjectField(env, ibObj, ni_ibaddressID, iaObj);
+            (*env)->SetShortField(env, ibObj, ni_ibmaskID, addrs->mask);
+            (*env)->SetObjectArrayElement(env, bindsArr, bind_index++, ibObj);
         }
         (*env)->SetObjectArrayElement(env, addrArr, addr_index, iaObj);
         addrs = addrs->next;

jdk/src/java.base/windows/native/libnet/TwoStacksPlainDatagramSocketImpl.c

@@ -830,6 +830,7 @@ Java_java_net_TwoStacksPlainDatagramSocketImpl_peek(JNIEnv *env, jobject this,
     }
     if (IS_NULL(addressObj)) {
         JNU_ThrowNullPointerException(env, "Null address in peek()");
+        return -1;
     } else {
         address = getInetAddress_addr(env, addressObj);
         /* We only handle IPv4 for now. Will support IPv6 once its in the os */
@@ -1127,11 +1128,23 @@ Java_java_net_TwoStacksPlainDatagramSocketImpl_peekData(JNIEnv *env, jobject thi
     }
     if (n == -1) {
         JNU_ThrowByName(env, JNU_JAVANETPKG "SocketException", "socket closed");
+        if (packetBufferLen > MAX_BUFFER_LEN) {
+            free(fullPacket);
+        }
+        return -1;
     } else if (n == -2) {
         JNU_ThrowByName(env, JNU_JAVAIOPKG "InterruptedIOException",
                         "operation interrupted");
+        if (packetBufferLen > MAX_BUFFER_LEN) {
+            free(fullPacket);
+        }
+        return -1;
     } else if (n < 0) {
         NET_ThrowCurrent(env, "Datagram receive failed");
+        if (packetBufferLen > MAX_BUFFER_LEN) {
+            free(fullPacket);
+        }
+        return -1;
     } else {
         jobject packetAddress;
 
@@ -1882,7 +1895,7 @@ Java_java_net_TwoStacksPlainDatagramSocketImpl_socketNativeSetOption
         default :
             JNU_ThrowByName(env, JNU_JAVANETPKG "SocketException",
                 "Socket option not supported by PlainDatagramSocketImp");
-            break;
+            return;
 
     }
 
@@ -2325,6 +2338,7 @@ Java_java_net_TwoStacksPlainDatagramSocketImpl_setTimeToLive(JNIEnv *env, jobjec
       if (NET_SetSockOpt(fd, IPPROTO_IP, IP_MULTICAST_TTL, (char*)&ittl,
                          sizeof (ittl)) < 0) {
         NET_ThrowCurrent(env, "set IP_MULTICAST_TTL failed");
+        return;
       }
     }
 
@@ -2518,6 +2532,9 @@ static void mcast_join_leave(JNIEnv *env, jobject this,
         } else {
             ifindex = getIndexFromIf (env, niObj);
             if (ifindex == -1) {
+                if ((*env)->ExceptionOccurred(env)) {
+                    return;
+                }
                 NET_ThrowCurrent(env, "get ifindex failed");
                 return;
             }

jdk/src/java.base/windows/native/libnet/TwoStacksPlainSocketImpl.c

@@ -108,7 +108,7 @@ Java_java_net_TwoStacksPlainSocketImpl_initProto(JNIEnv *env, jclass cls) {
     psi_portID = (*env)->GetFieldID(env, cls, "port", "I");
     CHECK_NULL(psi_portID);
     psi_lastfdID = (*env)->GetFieldID(env, cls, "lastfd", "I");
-    CHECK_NULL(psi_portID);
+    CHECK_NULL(psi_lastfdID);
     psi_localportID = (*env)->GetFieldID(env, cls, "localport", "I");
     CHECK_NULL(psi_localportID);
     psi_timeoutID = (*env)->GetFieldID(env, cls, "timeout", "I");
@@ -153,17 +153,17 @@ Java_java_net_TwoStacksPlainSocketImpl_socketCreate(JNIEnv *env, jobject this,
         fd1Obj = (*env)->GetObjectField(env, this, psi_fd1ID);
 
         if (IS_NULL(fd1Obj)) {
-            JNU_ThrowByName(env, JNU_JAVANETPKG "SocketException",
-                            "null fd1 object");
             (*env)->SetIntField(env, fdObj, IO_fd_fdID, -1);
             NET_SocketClose(fd);
+            JNU_ThrowByName(env, JNU_JAVANETPKG "SocketException",
+                            "null fd1 object");
             return;
         }
         fd1 = socket(AF_INET6, (stream ? SOCK_STREAM: SOCK_DGRAM), 0);
         if (fd1 == -1) {
-            NET_ThrowCurrent(env, "create");
             (*env)->SetIntField(env, fdObj, IO_fd_fdID, -1);
             NET_SocketClose(fd);
+            NET_ThrowCurrent(env, "create");
             return;
         } else {
             /* Set socket attribute so it is not passed to any child process */
@@ -907,6 +907,7 @@ Java_java_net_TwoStacksPlainSocketImpl_socketNativeSetOption
                     isRcvTimeoutSupported = JNI_FALSE;
                 } else {
                     NET_ThrowCurrent(env, "setsockopt SO_RCVTIMEO");
+                    return;
                 }
             }
             if (fd1 != -1) {

jdk/src/java.base/windows/native/libnet/net_util_md.c

@@ -205,9 +205,7 @@ NET_ThrowCurrent(JNIEnv *env, char *msg)
 void
 NET_ThrowByNameWithLastError(JNIEnv *env, const char *name,
                    const char *defaultDetail) {
-    char errmsg[255];
-    sprintf(errmsg, "errno: %d, error: %s\n", WSAGetLastError(), defaultDetail);
-    JNU_ThrowByNameWithLastError(env, name, errmsg);
+    JNU_ThrowByNameWithMessageAndLastError(env, name, defaultDetail);
 }
 
 jfieldID

jdk/src/java.base/windows/native/libnio/ch/FileDispatcherImpl.c

@@ -202,6 +202,7 @@ Java_sun_nio_ch_FileDispatcherImpl_write0(JNIEnv *env, jclass clazz, jobject fdo
 
     if ((h == INVALID_HANDLE_VALUE) || (result == 0)) {
         JNU_ThrowIOExceptionWithLastError(env, "Write failed");
+        return IOS_THROWN;
     }
 
     return convertReturnVal(env, (jint)written, JNI_FALSE);
@@ -250,6 +251,7 @@ Java_sun_nio_ch_FileDispatcherImpl_writev0(JNIEnv *env, jclass clazz, jobject fd
 
     if ((h == INVALID_HANDLE_VALUE) || (result == 0)) {
         JNU_ThrowIOExceptionWithLastError(env, "Write failed");
+        return IOS_THROWN;
     }
 
     return convertLongReturnVal(env, totalWritten, JNI_FALSE);

jdk/src/java.desktop/macosx/native/libjsound/PLATFORM_API_MacOSX_PCM.cpp

@@ -817,6 +817,10 @@ void* DAUDIO_Open(INT32 mixerIndex, INT32 deviceID, int isSource,
         ERROR1("<<DAUDIO_Open: ERROR: unsupported encoding (%d)\n", encoding);
         return NULL;
     }
+    if (channels <= 0) {
+        ERROR1("<<DAUDIO_Open: ERROR: Invalid number of channels=%d!\n", channels);
+        return NULL;
+    }
 
     OSX_DirectAudioDevice *device = new OSX_DirectAudioDevice();
 

jdk/src/java.desktop/share/classes/sun/applet/AppletSecurity.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1995, 2014, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1995, 2016, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -40,36 +40,25 @@ import java.util.HashSet;
 import java.util.StringTokenizer;
 import java.security.*;
 import java.lang.reflect.*;
+import jdk.internal.misc.JavaNetURLClassLoaderAccess;
+import jdk.internal.misc.JavaSecurityAccess;
+import jdk.internal.misc.SharedSecrets;
 import sun.awt.AWTSecurityManager;
 import sun.awt.AppContext;
 import sun.awt.AWTPermissions;
 import sun.security.util.SecurityConstants;
 
 
+
 /**
  * This class defines an applet security policy
  *
  */
 public
 class AppletSecurity extends AWTSecurityManager {
-
-    //URLClassLoader.acc
-    private static Field facc = null;
-
-    //AccessControlContext.context;
-    private static Field fcontext = null;
-
-    static {
-        try {
-            facc = URLClassLoader.class.getDeclaredField("acc");
-            facc.setAccessible(true);
-            fcontext = AccessControlContext.class.getDeclaredField("context");
-            fcontext.setAccessible(true);
-        } catch (NoSuchFieldException e) {
-            throw new UnsupportedOperationException(e);
-        }
-    }
-
+    private static final JavaNetURLClassLoaderAccess JNUCLA
+            = SharedSecrets.getJavaNetURLClassLoaderAccess();
+    private static final JavaSecurityAccess JSA = SharedSecrets.getJavaSecurityAccess();
 
     /**
      * Construct and initialize.
@@ -148,6 +137,7 @@ class AppletSecurity extends AWTSecurityManager {
             final ClassLoader currentLoader = context[i].getClassLoader();
 
             if (currentLoader instanceof URLClassLoader) {
+                URLClassLoader ld = (URLClassLoader)currentLoader;
                 loader = AccessController.doPrivileged(
                     new PrivilegedAction<ClassLoader>() {
                         public ClassLoader run() {
@@ -156,12 +146,12 @@ class AppletSecurity extends AWTSecurityManager {
                             ProtectionDomain[] pds = null;
 
                             try {
-                                acc = (AccessControlContext) facc.get(currentLoader);
+                                acc = JNUCLA.getAccessControlContext(ld);
                                 if (acc == null) {
                                     return null;
                                 }
 
-                                pds = (ProtectionDomain[]) fcontext.get(acc);
+                                pds = JSA.getProtectDomains(acc);
                                 if (pds == null) {
                                     return null;
                                 }

jdk/src/java.desktop/share/native/libfontmanager/layout/ContextualGlyphSubstProc.cpp

@@ -46,6 +46,7 @@ UOBJECT_DEFINE_RTTI_IMPLEMENTATION(ContextualGlyphSubstitutionProcessor)
 ContextualGlyphSubstitutionProcessor::ContextualGlyphSubstitutionProcessor(const LEReferenceTo<MorphSubtableHeader> &morphSubtableHeader, LEErrorCode &success)
   : StateTableProcessor(morphSubtableHeader, success), entryTable(), contextualGlyphSubstitutionHeader(morphSubtableHeader, success)
 {
+  if (LE_FAILURE(success)) return;
   contextualGlyphSubstitutionHeader.orphan();
   substitutionTableOffset = SWAPW(contextualGlyphSubstitutionHeader->substitutionTableOffset);
 
@@ -66,10 +67,10 @@ void ContextualGlyphSubstitutionProcessor::beginStateTable()
     markGlyph = 0;
 }
 
-ByteOffset ContextualGlyphSubstitutionProcessor::processStateEntry(LEGlyphStorage &glyphStorage, le_int32 &currGlyph, EntryTableIndex index)
+ByteOffset ContextualGlyphSubstitutionProcessor::processStateEntry(LEGlyphStorage &glyphStorage, le_int32 &currGlyph, EntryTableIndex index, LEErrorCode &success)
 {
-  LEErrorCode success = LE_NO_ERROR;
   const ContextualGlyphSubstitutionStateEntry *entry = entryTable.getAlias(index, success);
+  if (LE_FAILURE(success)) return 0;
   ByteOffset newState = SWAPW(entry->newStateOffset);
   le_int16 flags = SWAPW(entry->flags);
   WordOffset markOffset = SWAPW(entry->markOffset);

jdk/src/java.desktop/share/native/libfontmanager/layout/ContextualGlyphSubstProc.h

@@ -52,7 +52,7 @@ class ContextualGlyphSubstitutionProcessor : public StateTableProcessor
 public:
     virtual void beginStateTable();
 
-    virtual ByteOffset processStateEntry(LEGlyphStorage &glyphStorage, le_int32 &currGlyph, EntryTableIndex index);
+    virtual ByteOffset processStateEntry(LEGlyphStorage &glyphStorage, le_int32 &currGlyph, EntryTableIndex index, LEErrorCode &success);
 
     virtual void endStateTable();
 

jdk/src/java.desktop/share/native/libfontmanager/layout/IndicRearrangementProcessor.cpp

@@ -63,10 +63,10 @@ void IndicRearrangementProcessor::beginStateTable()
     lastGlyph = 0;
 }
 
-ByteOffset IndicRearrangementProcessor::processStateEntry(LEGlyphStorage &glyphStorage, le_int32 &currGlyph, EntryTableIndex index)
+ByteOffset IndicRearrangementProcessor::processStateEntry(LEGlyphStorage &glyphStorage, le_int32 &currGlyph, EntryTableIndex index, LEErrorCode &success)
 {
-  LEErrorCode success = LE_NO_ERROR; // todo- make a param?
-  const IndicRearrangementStateEntry *entry = entryTable.getAlias(index,success);
+    const IndicRearrangementStateEntry *entry = entryTable.getAlias(index, success);
+    if (LE_FAILURE(success)) return 0;
     ByteOffset newState = SWAPW(entry->newStateOffset);
     IndicRearrangementFlags flags = (IndicRearrangementFlags) SWAPW(entry->flags);
 

jdk/src/java.desktop/share/native/libfontmanager/layout/IndicRearrangementProcessor.h

@@ -52,7 +52,7 @@ class IndicRearrangementProcessor : public StateTableProcessor
 public:
     virtual void beginStateTable();
 
-    virtual ByteOffset processStateEntry(LEGlyphStorage &glyphStorage, le_int32 &currGlyph, EntryTableIndex index);
+    virtual ByteOffset processStateEntry(LEGlyphStorage &glyphStorage, le_int32 &currGlyph, EntryTableIndex index, LEErrorCode &success);
 
     virtual void endStateTable();
 

jdk/src/java.desktop/share/native/libfontmanager/layout/LigatureSubstProc.cpp

@@ -67,9 +67,8 @@ void LigatureSubstitutionProcessor::beginStateTable()
     m = -1;
 }
 
-ByteOffset LigatureSubstitutionProcessor::processStateEntry(LEGlyphStorage &glyphStorage, le_int32 &currGlyph, EntryTableIndex index)
+ByteOffset LigatureSubstitutionProcessor::processStateEntry(LEGlyphStorage &glyphStorage, le_int32 &currGlyph, EntryTableIndex index, LEErrorCode &success)
 {
-  LEErrorCode success = LE_NO_ERROR;
   const LigatureSubstitutionStateEntry *entry = entryTable.getAlias(index, success);
   if (LE_FAILURE(success)) {
       currGlyph++;

jdk/src/java.desktop/share/native/libfontmanager/layout/LigatureSubstProc.h

@@ -54,7 +54,7 @@ class LigatureSubstitutionProcessor : public StateTableProcessor
 public:
     virtual void beginStateTable();
 
-    virtual ByteOffset processStateEntry(LEGlyphStorage &glyphStorage, le_int32 &currGlyph, EntryTableIndex index);
+    virtual ByteOffset processStateEntry(LEGlyphStorage &glyphStorage, le_int32 &currGlyph, EntryTableIndex index, LEErrorCode &success);
 
     virtual void endStateTable();
 

jdk/src/java.desktop/share/native/libfontmanager/layout/StateTableProcessor.cpp

@@ -81,6 +81,7 @@ void StateTableProcessor::process(LEGlyphStorage &glyphStorage, LEErrorCode &suc
 
     while (currGlyph <= glyphCount) {
         if(LE_STATE_PATIENCE_DECR()) break; // patience exceeded.
+        if (LE_FAILURE(success)) break;
         ClassCode classCode = classCodeOOB;
         if (currGlyph == glyphCount) {
             // XXX: How do we handle EOT vs. EOL?
@@ -100,7 +101,7 @@ void StateTableProcessor::process(LEGlyphStorage &glyphStorage, LEErrorCode &suc
         EntryTableIndex entryTableIndex = stateArray.getObject((le_uint8)classCode, success);
         if (LE_FAILURE(success)) { break; }
         LE_STATE_PATIENCE_CURR(le_int32, currGlyph);
-        currentState = processStateEntry(glyphStorage, currGlyph, entryTableIndex);
+        currentState = processStateEntry(glyphStorage, currGlyph, entryTableIndex, success);
         LE_STATE_PATIENCE_INCR(currGlyph);
     }
 

jdk/src/java.desktop/share/native/libfontmanager/layout/StateTableProcessor.h

@@ -53,7 +53,7 @@ public:
 
     virtual void beginStateTable() = 0;
 
-    virtual ByteOffset processStateEntry(LEGlyphStorage &glyphStorage, le_int32 &currGlyph, EntryTableIndex index) = 0;
+    virtual ByteOffset processStateEntry(LEGlyphStorage &glyphStorage, le_int32 &currGlyph, EntryTableIndex index, LEErrorCode &success) = 0;
 
     virtual void endStateTable() = 0;
 

jdk/src/java.desktop/share/native/liblcms/cmsintrp.c

@@ -244,7 +244,7 @@ void LinLerp1D(register const cmsUInt16Number Value[],
 // To prevent out of bounds indexing
 cmsINLINE cmsFloat32Number fclamp(cmsFloat32Number v)
 {
-    return v < 0.0f ? 0.0f : (v > 1.0f ? 1.0f : v);
+    return v < 0.0f || v != v ? 0.0f : (v > 1.0f ? 1.0f : v);
 }
 
 // Floating-point version of 1D interpolation

jdk/src/java.desktop/share/native/liblcms/cmsio0.c

@@ -1543,6 +1543,13 @@ void* CMSEXPORT cmsReadTag(cmsHPROFILE hProfile, cmsTagSignature sig)
     // If the element is already in memory, return the pointer
     if (Icc -> TagPtrs[n]) {
 
+        if (Icc -> TagTypeHandlers[n] == NULL) goto Error;
+        BaseType = Icc -> TagTypeHandlers[n]->Signature;
+        if (BaseType == 0) goto Error;
+        TagDescriptor = _cmsGetTagDescriptor(Icc-> ContextID, sig);
+        if (TagDescriptor == NULL) goto Error;
+        if (!IsTypeSupported(TagDescriptor, BaseType)) goto Error;
+
         if (Icc ->TagSaveAsRaw[n]) goto Error;  // We don't support read raw tags as cooked
 
         _cmsUnlockMutex(Icc->ContextID, Icc ->UsrMutex);

jdk/src/java.desktop/share/native/liblcms/cmstypes.c

@@ -4313,7 +4313,10 @@ void *Type_MPEclut_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* io,
 
     // Copy MAX_INPUT_DIMENSIONS at most. Expand to cmsUInt32Number
     nMaxGrids = InputChans > MAX_INPUT_DIMENSIONS ? MAX_INPUT_DIMENSIONS : InputChans;
-    for (i=0; i < nMaxGrids; i++) GridPoints[i] = (cmsUInt32Number) Dimensions8[i];
+    for (i=0; i < nMaxGrids; i++) {
+        if (Dimensions8[i] == 1) goto Error; // Impossible value, 0 for no CLUT and then 2 at least
+        GridPoints[i] = (cmsUInt32Number)Dimensions8[i];
+    }
 
     // Allocate the true CLUT
     mpe = cmsStageAllocCLutFloatGranular(self ->ContextID, GridPoints, InputChans, OutputChans, NULL);

jdk/src/java.desktop/unix/classes/sun/java2d/x11/X11SurfaceDataProxy.java

@@ -102,10 +102,13 @@ public abstract class X11SurfaceDataProxy extends SurfaceDataProxy
                                            int w, int h)
     {
         if (cachedData == null) {
-            // Bitmask will be created lazily during the blit phase
-            cachedData = X11SurfaceData.createData(x11gc, w, h,
-                                                   x11gc.getColorModel(),
-                                                   null, 0, getTransparency());
+            try {
+                // Bitmask will be created lazily during the blit phase
+                cachedData = X11SurfaceData.createData(x11gc, w, h,
+                                                       x11gc.getColorModel(),
+                                                       null, 0, getTransparency());
+           } catch (OutOfMemoryError oome) {
+           }
         }
         return cachedData;
     }

jdk/src/java.desktop/unix/classes/sun/java2d/xr/XRPMBlitLoops.java

@@ -138,6 +138,9 @@ public class XRPMBlitLoops {
             vImg = (SunVolatileImage) dst.getGraphicsConfig().createCompatibleVolatileImage(w, h, src.getTransparency());
             vImg.setAccelerationPriority(1.0f);
 
+            if (!(vImg.getDestSurface() instanceof XRSurfaceData)) {
+                throw new InvalidPipeException("Could not create XRSurfaceData");
+            }
             if (src.getTransparency() == SurfaceData.OPAQUE) {
                 rgbTmpPM = new WeakReference<SunVolatileImage>(vImg);
             } else {

jdk/src/java.desktop/unix/classes/sun/java2d/xr/XRSurfaceDataProxy.java

@@ -59,9 +59,12 @@ public class XRSurfaceDataProxy extends SurfaceDataProxy implements Transparency
     public SurfaceData validateSurfaceData(SurfaceData srcData,
             SurfaceData cachedData, int w, int h) {
         if (cachedData == null) {
-            cachedData = XRSurfaceData.createData(xrgc, w, h,
-                                                  xrgc.getColorModel(), null, 0,
-                                                  getTransparency(), true);
+            try {
+                cachedData = XRSurfaceData.createData(xrgc, w, h,
+                                                      xrgc.getColorModel(), null, 0,
+                                                      getTransparency(), true);
+            } catch (OutOfMemoryError oome) {
+            }
         }
         return cachedData;
     }

jdk/src/java.desktop/unix/native/common/java2d/x11/X11SurfaceData.c

@@ -441,7 +441,7 @@ jboolean XShared_initSurface(JNIEnv *env, X11SDOps *xsdo, jint depth, jint width
          * width , height must be nonzero otherwise XCreatePixmap
          * generates BadValue in error_handler
          */
-        if (width <= 0 || height <= 0) {
+        if (width <= 0 || height <= 0 || width > 32767 || height > 32767) {
             JNU_ThrowOutOfMemoryError(env,
                                   "Can't create offscreen surface");
             return JNI_FALSE;

jdk/src/java.desktop/unix/native/libjsound/PLATFORM_API_BsdOS_ALSA_PCM.c

@@ -434,7 +434,10 @@ void* DAUDIO_Open(INT32 mixerIndex, INT32 deviceID, int isSource,
         snd_output_stdio_attach(&ALSA_OUTPUT, stdout, 0);
     }
 #endif
-
+    if (channels <= 0) {
+        ERROR1("ERROR: Invalid number of channels=%d!\n", channels);
+        return NULL;
+    }
     info = (AlsaPcmInfo*) malloc(sizeof(AlsaPcmInfo));
     if (!info) {
         ERROR0("Out of memory\n");

jdk/src/java.desktop/unix/native/libjsound/PLATFORM_API_LinuxOS_ALSA_PCM.c

@@ -434,7 +434,10 @@ void* DAUDIO_Open(INT32 mixerIndex, INT32 deviceID, int isSource,
         snd_output_stdio_attach(&ALSA_OUTPUT, stdout, 0);
     }
 #endif
-
+    if (channels <= 0) {
+        ERROR1("ERROR: Invalid number of channels=%d!\n", channels);
+        return NULL;
+    }
     info = (AlsaPcmInfo*) malloc(sizeof(AlsaPcmInfo));
     if (!info) {
         ERROR0("Out of memory\n");

jdk/src/java.desktop/unix/native/libjsound/PLATFORM_API_SolarisOS_PCM.c

@@ -182,6 +182,10 @@ void* DAUDIO_Open(INT32 mixerIndex, INT32 deviceID, int isSource,
         ERROR1(" DAUDIO_Open: invalid encoding %d\n", (int) encoding);
         return NULL;
     }
+    if (channels <= 0) {
+        ERROR1(" DAUDIO_Open: Invalid number of channels=%d!\n", channels);
+        return NULL;
+    }
 
     info = (SolPcmInfo*) malloc(sizeof(SolPcmInfo));
     if (!info) {