diff --git a/.hgtags b/.hgtags
index ac04e0a75f9fd06d544ee1a568d488e42b0172d8..f4d0b343acaf12e25aa00948e55df2ede90ef2d0 100644
--- a/.hgtags
+++ b/.hgtags
@@ -456,6 +456,7 @@ c4b37246b92736adf5f40c785aabb67a7d227245 jdk8u60-b23
 d433f5fd8910bee1f2c295b65cf03977034fe0ea jdk8u60-b24
 c8cfbe57bcd5042d2fef42dcef14d73dd4bdc416 jdk8u60-b25
 0d6a8a9b26a37678b420ff540b5a622c3f4fd44c jdk8u60-b26
+afbc08ea922bf6e5e14d2eea24a2f94f37627ea7 jdk8u60-b27
 286b9a885fcc6245fdf2b20697473ec3b35f2538 jdk8u65-b00
 80a796d0db958f49a4b0713818227eda8e5efbb9 jdk8u65-b01
 77d48e6d111faec236c8678997ae4311151cfee4 jdk8u65-b02
@@ -465,6 +466,7 @@ fe1c420a8982e58f6d49c50b729732d93f9682dd jdk8u65-b05
 3ee40ba7525d6d5ee201a475b967ca2e5c3c9ab3 jdk8u65-b06
 bd2ad7acb217391747dae8263c090483af454313 jdk8u65-b07
 d215cd281678e4b89a4155755cd6e03e37b7e9b1 jdk8u65-b08
+e9de15763a5a3cef64ef1d4bc40a018d4d572325 jdk8u65-b09
 e9f82302d5fdef8a0976640e09363895e9dcde3c jdk8u66-b00
 64d7bd4e98150447916f210e3bfd6875a4c2728a jdk8u66-b01
 d8210091911b14930192abd3138ee37c281fb632 jdk8u66-b02
diff --git a/src/macosx/native/sun/awt/CFRetainedResource.m b/src/macosx/native/sun/awt/CFRetainedResource.m
index 1371189b83f85f1510e92678a6b288ea3a4939f9..b5650cdd63cf57c6c780a37dec4afe984834ae09 100644
--- a/src/macosx/native/sun/awt/CFRetainedResource.m
+++ b/src/macosx/native/sun/awt/CFRetainedResource.m
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2012, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2011, 2015, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -40,10 +40,17 @@ JNIEXPORT void JNICALL Java_sun_lwawt_macosx_CFRetainedResource_nativeCFRelease
     if (releaseOnAppKitThread) {
         // Releasing resources on the main AppKit message loop only
         // Releasing resources on the nested loops may cause dangling 
-        // pointers after the nested loop is exited 
-        [NSApp postRunnableEvent:^(){
-            CFRelease(jlong_to_ptr(ptr));
-        }];
+        // pointers after the nested loop is exited
+        if ([NSApp respondsToSelector:@selector(postRunnableEvent:)]) {
+            [NSApp postRunnableEvent:^() {
+                CFRelease(jlong_to_ptr(ptr));
+            }];
+        } else {
+            // could happen if we are embedded inside SWT/FX application,
+            [JNFRunLoop performOnMainThreadWaiting:NO withBlock:^() {
+                CFRelease(jlong_to_ptr(ptr));
+            }];
+        }
     } else {
 
 JNF_COCOA_ENTER(env);
diff --git a/src/share/classes/java/rmi/server/RemoteObjectInvocationHandler.java b/src/share/classes/java/rmi/server/RemoteObjectInvocationHandler.java
index e2c41ac2714594e63cfac71936f677724a3ca392..c17eac6cfe82cdced876e016f2a016bc761b98ea 100644
--- a/src/share/classes/java/rmi/server/RemoteObjectInvocationHandler.java
+++ b/src/share/classes/java/rmi/server/RemoteObjectInvocationHandler.java
@@ -162,6 +162,14 @@ public class RemoteObjectInvocationHandler
     public Object invoke(Object proxy, Method method, Object[] args)
         throws Throwable
     {
+        if (! Proxy.isProxyClass(proxy.getClass())) {
+            throw new IllegalArgumentException("not a proxy");
+        }
+
+        if (Proxy.getInvocationHandler(proxy) != this) {
+            throw new IllegalArgumentException("handler mismatch");
+        }
+
         if (method.getDeclaringClass() == Object.class) {
             return invokeObjectMethod(proxy, method, args);
         } else if ("finalize".equals(method.getName()) && method.getParameterCount() == 0 &&
@@ -186,11 +194,13 @@ public class RemoteObjectInvocationHandler
 
         } else if (name.equals("equals")) {
             Object obj = args[0];
+            InvocationHandler hdlr;
             return
                 proxy == obj ||
                 (obj != null &&
                  Proxy.isProxyClass(obj.getClass()) &&
-                 equals(Proxy.getInvocationHandler(obj)));
+                 (hdlr = Proxy.getInvocationHandler(obj)) instanceof RemoteObjectInvocationHandler &&
+                 this.equals(hdlr));
 
         } else if (name.equals("toString")) {
             return proxyToString(proxy);
diff --git a/src/share/classes/javax/management/openmbean/OpenMBeanAttributeInfoSupport.java b/src/share/classes/javax/management/openmbean/OpenMBeanAttributeInfoSupport.java
index 8cd314fb0d4c00e65ef0851af78bd2fe0330dc57..bff3224d6ad86e1db6fca87ca9c0269c0f4f6d98 100644
--- a/src/share/classes/javax/management/openmbean/OpenMBeanAttributeInfoSupport.java
+++ b/src/share/classes/javax/management/openmbean/OpenMBeanAttributeInfoSupport.java
@@ -761,11 +761,15 @@ public class OpenMBeanAttributeInfoSupport
         Class<?> stringArrayClass;
         Class<?> targetArrayClass;
         try {
+            String baseClassName = baseType.safeGetClassName();
+
+            // check access to the provided base type class name and bail out early
+            ReflectUtil.checkPackageAccess(baseClassName);
+
             stringArrayClass =
                 Class.forName(squareBrackets + "Ljava.lang.String;");
             targetArrayClass =
-                Class.forName(squareBrackets + "L" + baseType.safeGetClassName() +
-                              ";");
+                Class.forName(squareBrackets + "L" + baseClassName + ";");
         } catch (ClassNotFoundException e) {
             throw new NoClassDefFoundError(e.toString());  // can't happen
         }