Found by code inspections, not yet tested.  The following code creates the new version of the class, but does not set the protection_domain.  One would think that it should be copied from the old class, just like class_loader it.  It would appear that there is at least one bug caused by this (again just by inspection), the ClassFileParser sends the ClassFileLoadHook event, this is sent with the passed in (unset) protection domain ---

    // Parse the stream.
    Handle k_loader_h(THREAD, k_h->class_loader());
    Handle protection_domain;
    // Set redefined class handle in JvmtiThreadState class.
    // This redefined class is sent to agent event handler for class file
    // load hook event.
    state->set_class_being_redefined(&k_h);

    klassOop k = SystemDictionary::parse_stream(k_name, 
                                                k_loader_h, 
                                                protection_domain,
                                                &st,
                                                THREAD);


The protection_domain is not copied from the new class version so should not impact the actual protection_domain of the class.