JDK-8163309 : SecurityException from Applet calling Thread.setPriority(int)
  • Type: Bug
  • Component: deploy
  • Affected Version: 9
  • Priority: P3
  • Status: Resolved
  • Resolution: Duplicate
  • Submitted: 2016-08-05
  • Updated: 2016-10-18
  • Resolved: 2016-10-18
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 9
9Resolved
Related Reports
Duplicate :  
JDK-8168205 - Should not default class path to CWD if -cp is not specified but -m is specified
Relates :  
JDK-8156989 - Trailing empty element in classpath ignored
Description
As of JDK 9 b120 the "Animator" demo applet throws an exception as follows :-
jdk9b120/bin/appletviewer  example1.html
java.security.AccessControlException: access denied ("java.lang.RuntimePermission" "modifyThread")
	at java.security.AccessControlContext.checkPermission(java.base@9-ea/AccessControlContext.java:468)
	at java.security.AccessController.checkPermission(java.base@9-ea/AccessController.java:894)
	at java.lang.SecurityManager.checkPermission(java.base@9-ea/SecurityManager.java:541)
	at sun.applet.AppletSecurity.checkAccess(java.desktop@9-ea/AppletSecurity.java:231)
	at java.lang.Thread.checkAccess(java.base@9-ea/Thread.java:1488)
	at java.lang.Thread.setPriority(java.base@9-ea/Thread.java:1185)
	at Animator.init(Animator.java:299)
	at sun.applet.AppletPanel.run(java.desktop@9-ea/AppletPanel.java:423)
	at java.lang.Thread.run(java.base@9-ea/Thread.java:843)
---

I am not sure of why, since I can't pinpoint what changed, but
can see that in AppletSecurity.java the call to
"currentAppletClassLoader()" returns null now .. which is
then interpreted as meaning the Thread (which is the applet's
own main thread), is not in its thread group ... and that
seems wrong .. and presumably inconsistent with all history
since 1995 since the applet has always made this call.
Comments
In jdk8, appletviewer launcher always -Djava.class.path is always set to ${JAVA_HOME}/tools.jar. With the modular runtime image change, specifically with jimage, there is no more tools.jar. -Djava.class.path in JDK 9 appetviewer launcher is set to nothing and hence default to the current directory. This explains why Animator is loaded by AppClassLoader rather than AppletClassLoader.
17-10-2016