JDK-8229773 : Resolve permissions for code source URLs lazily
  • Type: Enhancement
  • Component: security-libs
  • Sub-Component: java.security
  • Affected Version: 11,12,13,14
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • Submitted: 2019-08-15
  • Updated: 2020-06-01
  • Resolved: 2019-08-19
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 11 JDK 13 JDK 14
11.0.5-oracleFixed 13.0.1Fixed 14 b11Fixed
Related Reports
Relates :  
JDK-8213406 - (fs) More than one instance of built-in FileSystem observed in heap
Description
When establishing protection domains during class load, we resolve the permissions needed to access a code source eagerly. This forces early initialization of FilePermission etc, which in turn initializes default file system and others. Since the permissions are not checked against unless a security manager has been installed, this is often done unnecessarily. 

By doing the initialization lazily using a delegating implementation, we reduce number of classes loaded on many small apps by ~40.
Comments
Fix request (11u) Requesting backport of this fix to JDK11 updates to match Oracle 11.0.5 where this is included as well. Started webrev as the patch did not apply cleanly: https://mail.openjdk.java.net/pipermail/jdk-updates-dev/2019-September/001896.html Regression testing does not show any issues and fix includes a testcase.
18-09-2019
URL: https://hg.openjdk.java.net/jdk/jdk/rev/1b6806340400 User: redestad Date: 2019-08-19 04:04:34 +0000
19-08-2019