JDK-8139317 : [Mac] SecurityException when constructing WebView from JFXPanel application
  • Type: Bug
  • Component: javafx
  • Sub-Component: web
  • Affected Version: 8,9
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • Submitted: 2015-10-09
  • Updated: 2020-01-31
  • Resolved: 2016-04-22
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 8 JDK 9
8u102Fixed 9Fixed
Related Reports
Blocks :  
JDK-8139326 - [TEST] Unit tests for JFXPanel with security manager don't detect errors
Blocks :  
JDK-8154564 - [Mac] Re-enable SandboxAppTest::testJFXPanelImplicitExitApp on Mac
Relates :  
JDK-8097417 - Create regression tests that run JavaFX apps with a security manager
Relates :  
JDK-8139326 - [TEST] Unit tests for JFXPanel with security manager don't detect errors
Description
The attached test program fails on Mac when run with a security manager. To reproduce, run the app as follows:

$ java -Djava.security.manager HelloJFXPanelWeb
createScene: calling Platform.runLater
PlatformImpl.runLater returns
Platform.runLater :: run
Exception in thread "JavaFX Application Thread" java.lang.ExceptionInInitializerError
	at javafx.scene.web.WebEngine.<init>(WebEngine.java:870)
	at javafx.scene.web.WebEngine.<init>(WebEngine.java:845)
	at javafx.scene.web.WebView.<init>(WebView.java:269)
	at HelloJFXPanelWeb$2.run(HelloJFXPanelWeb.java:66)
	at com.sun.javafx.application.PlatformImpl.lambda$null$174(PlatformImpl.java:295)
	at com.sun.javafx.application.PlatformImpl$$Lambda$55/657906486.run(Unknown Source)
	at java.security.AccessController.doPrivileged(Native Method)
	at com.sun.javafx.application.PlatformImpl.lambda$runLater$175(PlatformImpl.java:294)
	at com.sun.javafx.application.PlatformImpl$$Lambda$54/647865547.run(Unknown Source)
	at com.sun.glass.ui.InvokeLaterDispatcher$Future.run(InvokeLaterDispatcher.java:96)
Caused by: java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "modifyThreadGroup")
	at java.security.AccessControlContext.checkPermission(AccessControlContext.java:457)
	at java.security.AccessController.checkPermission(AccessController.java:884)
	at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
	at java.lang.SecurityManager.checkAccess(SecurityManager.java:729)
	at java.lang.ThreadGroup.checkAccess(ThreadGroup.java:315)
	at java.lang.Thread.init(Thread.java:391)
	at java.lang.Thread.init(Thread.java:349)
	at java.lang.Thread.<init>(Thread.java:548)
	at com.sun.webkit.Disposer.<clinit>(Disposer.java:61)
	... 10 more
Comments
Changeset: b7f76c13c625 Author: kcr Date: 2016-04-22 07:42 -0700 URL: http://hg.openjdk.java.net/openjfx/9-dev/rt/rev/b7f76c13c625
22-04-2016
+1
22-04-2016
http://cr.openjdk.java.net/~kcr/8139317/webrev.00/ This patch changes the creation of the WebEngine disposer thread to match that of other, similar disposer threads. It also enables the failing test on Mac. I verified that the test now passes with this fix (whereas it fails without).
21-04-2016
I will fix the unit tests separately. See JDK-8139326.
09-10-2015
The problem is that when the WebEngine class is loaded and initialized, it creates a Disposer thread, but does not wrap the creation and modification of the thread in a doPrivileged. The bug is that we should not rely on being able to create and modify the thread without asserting privileges. Other disposer threads in FX -- for font and bean property adapters -- are correctly created within a doPrivileged block. On Mac, JavaFX does not create the JavaFX application thread which triggers the bug in some cases depending on the security manager and policy being used. This does not affect applets or javaws applications, presumably because of the way the plugin security manager is configured, but we are just getting lucky in that case. As part of this bug fix, we need to fix the unit tests. I will attach a patch for that.
09-10-2015
The unit tests created to address JDK-8097417 actually cover this case, and do not run correctly on Mac. Unfortunately, an error in the test app for the JFXPanel case has a bug in it where the exception is not reported by the test. If you run the test case you can visually see that it doesn't render correctly, but the test passes anyway.
09-10-2015
This works fine on Windows and Linux.
09-10-2015