Bug ID: JDK-7145442 Java hangs on "Request Authentication" dialog if script uses applet object

Type: Bug
Component: deploy
Sub-Component: plugin
Affected Version: 7
Priority: P3
Status: Closed
Resolution: Fixed
OS: windows_7
CPU: x86
Submitted: 2012-02-14
Updated: 2013-09-12
Resolved: 2012-04-17
JDK 7	JDK 8
7u4Fixed	8 b29Fixed
FULL PRODUCT VERSION :
it does work in JRE 6u23 but doesn't work on higher versions including 7u2

It is strange but it started to work normally when I upgraded JRE 7 x86 to 7u2 on Win7x64SP1 in one environment.
But when I did the same for JRE x64 it still doesn't work. Both about boxes for x86 & x64 say the same.

On Win 2003 x86 SP2 (on VM) all JREs higher than 6u23 are affected.

ADDITIONAL OS VERSION INFORMATION :
Reproduced on Win7x64 SP1, Win 2003 x86 SP2 (on VM), customer complains about Win7 x86 & x64

A DESCRIPTION OF THE PROBLEM :
IE hangs if applet shows "Request Authentication" dialog in time when HTML page tries to access it/applet (in Body onLoad event for example)
Sometimes dialog can "live" for some seconds, i.e. hang isn't always momentary, I usually have some seconds to move dialog a few times until it completely hangs.

REGRESSION.  Last worked in version 7

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
HTML page that contains applet must be located on protected by HTTPS/SSL host, HTTPS must be configured to request client certificate (2-way SSL).

When client opens this page first time, while jar ins't cached, java tries to load jar and shows "Request Authentication" dialog with available certificate list.
(so for IE please ensure that you have Personal certificates in certmgr.msc)
When jar is cached (Java Control Panel -> Temporary Internet Files -> View -> Resources) problem isn't reproducible so far.

HTML page should try to access the same object in the same time.

Minimal reproducible scenario is specified in a special field but any JAR/Class even non existent (as it happens on making request for obtaining it) can be used.

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
I found following statement:

A call to an applet method or access to an applet variable from JavaScript code will be blocked until the applet's init() method is complete or the applet first invokes JavaScript code from the web page in which it is deployed. As the JavaScript implementation is single-threaded in many browsers, the web page may appear to be frozen during applet startup.

so JScript call to applet should be blocked until it is loaded.
ACTUAL -
IE6,8,9 completely hang.

REPRODUCIBILITY :
This bug can be reproduced often.

---------- BEGIN SOURCE ----------
<HTML>
<BODY>

<H>Applet Test</H>
<applet name="Serena Dimensions CM Web Client" width="2" height="2"
  codebase="/dim_applet/"
  code="merant.adm.applet.PermissionsApplet.class"
  id="PermissionsApplet">
  <PARAM NAME="cache_version" VALUE="12.2000.999.0">
<PARAM NAME="cache_option" VALUE="Plugin">
<PARAM NAME="cache_archive" VALUE="dmjweb10.jar">
<PARAM NAME="scriptable" VALUE="true">
<PARAM NAME="VERSION_INFO" VALUE="merant.adm.diminet.util.WebClientVersionInfo">
<PARAM NAME="cabbase" VALUE="dmjweb10ie.cab">
</applet>

<SCRIPT>
	try
	{
		var docVendor = document.PermissionsApplet.getJavaPluginVendor();
		alert(docVendor);
	}
	catch (e)
	{
		alert("catch");
	}
</SCRIPT>

</BODY>
</HTML>
---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
- Don't use object on first login page but load jar in order to cache it further as problem isn't reproduced with cached jar (so far).
- We are considering workaround described here http://docs.oracle.com/javase/tutorial/deployment/applet/appletStatus.html
but it will require much more work to do this on each page and support matrix should be asjusted for this....