Merge

.hgtags

@@ -214,3 +214,5 @@ d5228e624826a10ccc5b05f30ad8d839b58fe48d jdk8-b87
 c63eda8f63008a4398d2c22ac8d72f7fef6f9238 jdk8-b90
 169451cf0cc53bde5af24f9820ea3f35ec4b4df4 jdk8-b91
 a2a2a91075ad85becbe10a39d7fd04ef9bea8df5 jdk8-b92
+691d6c6cd332d98b0f0221445a73906776f31f72 jdk8-b93
+51479fa56b7c4363c6d87c2e8b898d8185cf4b22 jdk8-b94

make/common/Defs-windows.gmk

 #
-# Copyright (c) 1999, 2012, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 1999, 2013, Oracle and/or its affiliates. All rights reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -432,40 +432,3 @@ RC_FLAGS += -d "JDK_BUILD_ID=$(JDK_RC_BUILD_ID)" \
             -d "JDK_COPYRIGHT=$(JDK_RC_COPYRIGHT)" \
             -d "JDK_NAME=$(JDK_RC_NAME)" \
             -d "JDK_FVER=$(JDK_RC_FVER)"
-
-# Enable 7-Zip LZMA file (de)compression for Java Kernel if it is available
-ifeq ($(ARCH_DATA_MODEL), 32)
-  ifneq ($(KERNEL), off)
-    # This is a hack to use until  7-Zip (and UPX) bundles can be put
-    # under /java/devtools.
-    ifndef DEPLOY_TOPDIR
-      DEPLOY_TOPDIR=$(JDK_TOPDIR)/../deploy
-    endif
-    # Uncomment this block to cause build failure if above assumption false
-    #DCHK = $(shell if [ ! -d $(DEPLOY_TOPDIR) ] ; then \
-    #  $(ECHO) deploy_not_a_peer_of_j2se ; \
-    #fi )
-    #ifeq ($(DCHK), deploy_not_a_peer_of_j2se)
-    #  If a build failure points to control coming here it means
-    #  it means deploy is not in the same directory
-    #  as j2se. Java Kernel can't tolerate that for the time being.
-    #endif
-    EC_TMP = $(shell if [ -d $(DEPLOY_TOPDIR)/make/lzma ] ; then \
-      $(ECHO) true ; \
-    else \
-      $(ECHO) false ; \
-    fi )
-    ifeq ($(EC_TMP), true)
-      EXTRA_COMP_INSTALL_PATH = lib\\\\deploy\\\\lzma.dll
-      # Crazy but true: deploy/make/plugin/jinstall/Makefile.jkernel does
-      # not include deploy/make/common/Defs-windows.gmk, either directly
-      # or indirectly. But it does include this file, so redundantly declare
-      # these variables that are in deploy/make/common/Defs-windows.gmk for
-      # the sake of the Java Kernel part of the deploy build. Whew!
-      EXTRA_COMP_LIB_NAME = lzma.dll
-      EXTRA_COMP_PATH = $(OUTPUTDIR)/tmp/deploy/lzma/win32/obj
-      EXTRA_COMP_CMD_PATH = $(EXTRA_COMP_PATH)/lzma.exe
-      EXTRA_COMP_LIB_PATH = $(EXTRA_COMP_PATH)/$(EXTRA_COMP_LIB_NAME)
-    endif
-  endif
-endif

make/java/management/Exportedfiles.gmk

 #
-# Copyright (c) 2003, 2005, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2003, 2013, Oracle and/or its affiliates. All rights reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -29,6 +29,7 @@
 
 FILES_export = \
 	sun/management/ClassLoadingImpl.java \
+	sun/management/DiagnosticCommandImpl.java \
 	sun/management/FileSystemImpl.java \
 	sun/management/Flag.java \
 	sun/management/GarbageCollectorImpl.java \

make/java/management/FILES_c.gmk

 #
-# Copyright (c) 2003, 2005, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2003, 2013, Oracle and/or its affiliates. All rights reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -25,6 +25,7 @@
 
 FILES_c = \
 	ClassLoadingImpl.c \
+	DiagnosticCommandImpl.c \
 	FileSystemImpl.c \
 	Flag.c \
 	GarbageCollectorImpl.c \

make/java/management/mapfile-vers

 #
-# Copyright (c) 2005, 2012, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2005, 2013, Oracle and/or its affiliates. All rights reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -39,6 +39,10 @@ SUNWprivate_1.1 {
 	    Java_com_sun_management_UnixOperatingSystem_getTotalSwapSpaceSize;
 	    Java_com_sun_management_UnixOperatingSystem_initialize;
 	    Java_sun_management_ClassLoadingImpl_setVerboseClass;
+            Java_sun_management_DiagnosticCommandImpl_executeDiagnosticCommand;
+            Java_sun_management_DiagnosticCommandImpl_getDiagnosticCommands;
+            Java_sun_management_DiagnosticCommandImpl_getDiagnosticCommandInfo;
+	    Java_sun_management_DiagnosticCommandImpl_setNotificationEnabled;
 	    Java_sun_management_FileSystemImpl_isAccessUserOnly0;
 	    Java_sun_management_Flag_getAllFlagNames;
 	    Java_sun_management_Flag_getFlags;

make/jpda/back/Makefile

@@ -31,6 +31,8 @@ BUILDDIR = ../..
 LIBRARY = jdwp
 PRODUCT = jpda
 
+LIBRARY_SUPPORTS_FULL_DEBUG_SYMBOLS=1
+
 FILES_m = mapfile-vers
 
 include $(BUILDDIR)/common/Defs.gmk

make/sun/awt/Makefile

@@ -390,12 +390,9 @@ ifeq ($(PLATFORM), linux)
 # vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv LINUX
 ifdef OPENJDK
 
-FONTCONFIGS_SRC	= $(PLATFORM_SRC)/classes/sun/awt/fontconfigs
-_FONTCONFIGS	= \
-	fontconfig.properties				\
-	fontconfig.SuSE.properties                      \
-	fontconfig.Ubuntu.properties                    \
-	fontconfig.Fedora.properties
+FONTCONFIGS_SRC	= 
+_FONTCONFIGS	= 
+
 else
 
 FONTCONFIGS_SRC	= $(CLOSED_SRC)/solaris/classes/sun/awt/fontconfigs
@@ -441,7 +438,11 @@ endif # PLATFORM
 FONTCONFIGS     = $(_FONTCONFIGS:%=$(LIBDIR)/%.src)
 BINARYFONTCONFIGS = $(_FONTCONFIGS:%.properties=$(LIBDIR)/%.bfc)
 
+ifneq ("x$(_FONTCONFIGS)", "x")
 fontconfigs: $(FONTCONFIGS) $(BINARYFONTCONFIGS)
+else
+fontconfigs:
+endif
 
 $(LIBDIR)/%.src: $(FONTCONFIGS_SRC)/$(FONTCONFIGS_SRC_PREFIX)%
 	$(install-file)
@@ -455,9 +456,13 @@ $(LIBDIR)/%.bfc: $(FONTCONFIGS_SRC)/$(FONTCONFIGS_SRC_PREFIX)%.properties \
 	$(call chmod-file, 444)
 	@$(java-vm-cleanup)
 
+ifneq ("x$(_FONTCONFIGS)", "x")
 fontconfigs.clean :
 	$(RM) $(FONTCONFIGS)
 	$(RM) $(BINARYFONTCONFIGS)
+else
+fontconfigs.clean :
+endif
 
 ifeq ($(PLATFORM), windows)
 # vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv WINDOWS

make/tools/CharsetMapping/EUC_KR.map

@@ -5,6 +5,8 @@
 # (2)Added 2 new codepoints (KS X 1001:1998)
 #     0xA2E6	0x20AC	# EURO Sign
 #     0xA2E7	0x00AE	# Registered Sign
+# (3) KS X 1001:2002
+#     0xA2E8	0x327E  # CIRCLED KOREAN CHARACTER JUEUI (Postal Code Mark)
 #
 0x00	0x0000
 0x01	0x0001
@@ -295,6 +297,7 @@
 #
 0xA2E6	0x20AC	# EURO Sign
 0xA2E7	0x00AE	# Registered Sign
+0xA2E8	0x327E  # CIRCLED KOREAN CHARACTER JUEUI
 #
 0xA2E0	0x2116	# NUMERO SIGN
 0xA2E1	0x33C7	# SQUARE CO

make/tools/src/build/tools/generatebreakiteratordata/CharSet.java

@@ -39,6 +39,7 @@
 
 package build.tools.generatebreakiteratordata;
 
+import java.util.Arrays;
 import java.util.Hashtable;
 
 /**
@@ -701,7 +702,14 @@ class CharSet {
      * the exact same characters as this one
      */
     public boolean equals(Object that) {
-        return (that instanceof CharSet) && chars.equals(((CharSet)that).chars);
+        return (that instanceof CharSet) && Arrays.equals(chars, ((CharSet)that).chars);
+    }
+
+    /**
+     * Returns the hash code for this set of characters
+     */
+    public int hashCode() {
+       return Arrays.hashCode(chars);
     }
 
     /**

makefiles/CompileJavaClasses.gmk

@@ -342,7 +342,7 @@ $(eval $(call SetupJavaCompilation,BUILD_JOBJC,\
 		DISABLE_SJAVAC:=true,\
 		SRC:=$(JDK_TOPDIR)/src/macosx/native/jobjc/src/core/java \
 		     $(JDK_TOPDIR)/src/macosx/native/jobjc/src/runtime-additions/java \
-		     $(JDK_OUTPUTDIR)/gensrc, \
+		     $(JDK_OUTPUTDIR)/gensrc_jobjc/src, \
 		INCLUDES := com/apple/jobjc,\
                 EXCLUDES := tests/java/com/apple/jobjc,\
 		BIN:=$(JDK_OUTPUTDIR)/jobjc_classes,\
@@ -355,7 +355,7 @@ $(eval $(call SetupJavaCompilation,BUILD_JOBJC_HEADERS,\
 		SETUP:=GENERATE_JDKBYTECODE,\
 		SRC:=$(JDK_TOPDIR)/src/macosx/native/jobjc/src/core/java \
 		     $(JDK_TOPDIR)/src/macosx/native/jobjc/src/runtime-additions/java \
-		     $(JDK_OUTPUTDIR)/gensrc, \
+		     $(JDK_OUTPUTDIR)/gensrc_jobjc/src, \
 		INCLUDES := com/apple/jobjc,\
                 EXCLUDES := tests/java/com/apple/jobjc,\
 		BIN:=$(JDK_OUTPUTDIR)/jobjc_classes_headers,\

makefiles/CompileLaunchers.gmk

@@ -95,6 +95,9 @@ define SetupLauncher
         $1_PLIST_FILE:=Info-cmdline.plist
         ifneq ($(11),)
             $1_PLIST_FILE:=$(11)
+            ifneq ($$(findstring privileged,$$($1_PLIST_FILE)),)
+                $1_CODESIGN:=true
+            endif
         endif
 
         $1_LDFLAGS += -Wl,-all_load $(JDK_OUTPUTDIR)/objs/libjli_static.a \
@@ -174,7 +177,8 @@ define SetupLauncher
 		  -D "JDK_INTERNAL_NAME=$1" \
 		  -D "JDK_FTYPE=0x1L" \
 		  $7,\
-	MANIFEST:=$(JDK_TOPDIR)/src/windows/resource/java.manifest)
+	MANIFEST:=$(JDK_TOPDIR)/src/windows/resource/java.manifest,\
+	CODESIGN:=$$($1_CODESIGN))
 
     BUILD_LAUNCHERS += $$(BUILD_LAUNCHER_$1)
 

makefiles/CompileNativeLibraries.gmk

@@ -1143,7 +1143,7 @@ $(eval $(call SetupNativeCompilation,BUILD_LIBJDWP,\
 			  -D "JDK_INTERNAL_NAME=jdwp" \
 			  -D "JDK_FTYPE=0x2L",\
 		OBJECT_DIR:=$(JDK_OUTPUTDIR)/objs/libjdwp,\
-		DEBUG_SYMBOLS:=$(DEBUG_ALL_BINARIES)))
+		DEBUG_SYMBOLS:=true))
 
 $(BUILD_LIBJDWP) : $(BUILD_LIBJAVA)
 
@@ -2609,21 +2609,22 @@ endif
 
 ##########################################################################################
 
-BUILD_LIBKRB5_NAME:=
-ifeq ($(OPENJDK_TARGET_OS), windows)
+ifneq ($(BUILD_CRYPTO),no)
+  BUILD_LIBKRB5_NAME:=
+  ifeq ($(OPENJDK_TARGET_OS), windows)
      BUILD_LIBKRB5_NAME:=w2k_lsa_auth
      BUILD_LIBKRB5_SRC:=$(JDK_TOPDIR)/src/$(OPENJDK_TARGET_OS_API_DIR)/native/sun/security/krb5
      BUILD_LIBKRB5_LIBS:=advapi32.lib Secur32.lib netapi32.lib kernel32.lib user32.lib \
 			 gdi32.lib winspool.lib comdlg32.lib advapi32.lib shell32.lib \
 			 ole32.lib oleaut32.lib uuid.lib odbc32.lib odbccp32.lib wsock32.lib
-else ifeq ($(OPENJDK_TARGET_OS), macosx)
+  else ifeq ($(OPENJDK_TARGET_OS), macosx)
      BUILD_LIBKRB5_NAME:=osxkrb5
      BUILD_LIBKRB5_SRC:=$(JDK_TOPDIR)/src/share/native/sun/security/krb5
      BUILD_LIBKRB5_LIBS:=-framework Kerberos
-endif
+  endif
 
-ifneq ($(BUILD_LIBKRB5_NAME),)
-$(eval $(call SetupNativeCompilation,BUILD_LIBKRB5,\
+  ifneq ($(BUILD_LIBKRB5_NAME),)
+    $(eval $(call SetupNativeCompilation,BUILD_LIBKRB5,\
 		LIBRARY:=$(BUILD_LIBKRB5_NAME),\
                 OUTPUT_DIR:=$(INSTALL_LIBRARIES_HERE),\
 		SRC:=$(BUILD_LIBKRB5_SRC),\
@@ -2643,7 +2644,8 @@ $(eval $(call SetupNativeCompilation,BUILD_LIBKRB5,\
 		OBJECT_DIR:=$(JDK_OUTPUTDIR)/objs/libkrb5,\
 		DEBUG_SYMBOLS:=$(DEBUG_ALL_BINARIES)))
 
-BUILD_LIBRARIES += $(BUILD_LIBKRB5)
+    BUILD_LIBRARIES += $(BUILD_LIBKRB5)
+  endif
 endif
 
 ##########################################################################################

makefiles/CreateJars.gmk

@@ -467,10 +467,15 @@ $(JCE_MANIFEST): $(MAINMANIFEST)
 	$(MV) $@.tmp $@
 
 ##########################################################################################
-# For all security jars, always build the jar, but for closed, install the prebuilt signed
-# version instead of the newly built jar. Unsigned jars are treated as intermediate targets
-# and explicitly added to the JARS list. For open, signing is not needed. See SignJars.gmk
-# for more information.
+# For security and crypto jars, always build the jar, but for closed, install the prebuilt 
+# signed version instead of the newly built jar. Unsigned jars are treated as intermediate 
+# targets and explicitly added to the JARS list. For open, signing is not needed. See 
+# SignJars.gmk for more information.
+#
+# The source for the crypto jars is not available for all licensees. The BUILD_CRYPTO
+# variable is set to no if these jars can't be built to skip that step of the build.
+# Note that for OPENJDK, the build will fail if BUILD_CRYPTO=no since then there is no 
+# other way to get the jars than to build them.
 
 SUNPKCS11_JAR_DST := $(IMAGES_OUTPUTDIR)/lib/ext/sunpkcs11.jar
 SUNPKCS11_JAR_UNSIGNED := $(IMAGES_OUTPUTDIR)/unsigned/sunpkcs11.jar
@@ -540,7 +545,8 @@ $(eval $(call SetupArchive,BUILD_SWINGBEANS_JAR,,\
 SUNJCE_PROVIDER_JAR_DST := $(IMAGES_OUTPUTDIR)/lib/ext/sunjce_provider.jar
 SUNJCE_PROVIDER_JAR_UNSIGNED := $(IMAGES_OUTPUTDIR)/unsigned/sunjce_provider.jar
 
-$(eval $(call SetupArchive,BUILD_SUNJCE_PROVIDER_JAR,,\
+ifneq ($(BUILD_CRYPTO),no)
+  $(eval $(call SetupArchive,BUILD_SUNJCE_PROVIDER_JAR,,\
 		SRCS:=$(JDK_OUTPUTDIR)/classes, \
 		SUFFIXES:=.class,\
 		INCLUDES:= com/sun/crypto/provider,\
@@ -548,7 +554,10 @@ $(eval $(call SetupArchive,BUILD_SUNJCE_PROVIDER_JAR,,\
                 MANIFEST:=$(JCE_MANIFEST), \
 		SKIP_METAINF := true))
 
-$(SUNJCE_PROVIDER_JAR_UNSIGNED): $(JCE_MANIFEST)
+  $(SUNJCE_PROVIDER_JAR_UNSIGNED): $(JCE_MANIFEST)
+
+  JARS += $(SUNJCE_PROVIDER_JAR_UNSIGNED)
+endif
 
 ifndef OPENJDK
     SUNJCE_PROVIDER_JAR_SRC := $(JDK_TOPDIR)/make/closed/tools/crypto/jce/sunjce_provider.jar
@@ -560,14 +569,13 @@ else
 	$(install-file)
 endif
 
-JARS += $(SUNJCE_PROVIDER_JAR_UNSIGNED)
-
 ##########################################################################################
 
 JCE_JAR_DST := $(IMAGES_OUTPUTDIR)/lib/jce.jar
 JCE_JAR_UNSIGNED := $(IMAGES_OUTPUTDIR)/unsigned/jce.jar
 
-$(eval $(call SetupArchive,BUILD_JCE_JAR,,\
+ifneq ($(BUILD_CRYPTO),no)
+  $(eval $(call SetupArchive,BUILD_JCE_JAR,,\
 		SRCS:=$(JDK_OUTPUTDIR)/classes, \
 		SUFFIXES:=.class,\
 		INCLUDES:= javax/crypto sun/security/internal,\
@@ -575,7 +583,10 @@ $(eval $(call SetupArchive,BUILD_JCE_JAR,,\
                 MANIFEST:=$(JCE_MANIFEST), \
 		SKIP_METAINF := true))
 
-$(JCE_JAR_UNSIGNED): $(JCE_MANIFEST)
+  $(JCE_JAR_UNSIGNED): $(JCE_MANIFEST)
+
+  JARS +=  $(JCE_JAR_UNSIGNED)
+endif
 
 ifndef OPENJDK
   JCE_JAR_SRC := $(JDK_TOPDIR)/make/closed/tools/crypto/jce/jce.jar
@@ -587,35 +598,37 @@ else
 	$(install-file)
 endif
 
-JARS +=  $(JCE_JAR_UNSIGNED)
-
 ##########################################################################################
 
 US_EXPORT_POLICY_JAR_DST := $(IMAGES_OUTPUTDIR)/lib/security/US_export_policy.jar
 US_EXPORT_POLICY_JAR_UNSIGNED := $(IMAGES_OUTPUTDIR)/unsigned/US_export_policy.jar
 
-#
-# TODO fix so that SetupArchive does not write files into SRCS
-#   then we don't need this extra copying
-#
-# NOTE:  We currently do not place restrictions on our limited export
-# policy.  This was not a typo.
-#
-US_EXPORT_POLICY_JAR_SRC_DIR := $(JDK_TOPDIR)/make/javax/crypto/policy/unlimited
-US_EXPORT_POLICY_JAR_TMP := $(IMAGES_OUTPUTDIR)/US_export_policy_jar.tmp
+ifneq ($(BUILD_CRYPTO),no)
+  #
+  # TODO fix so that SetupArchive does not write files into SRCS
+  #   then we don't need this extra copying
+
+  # NOTE:  We currently do not place restrictions on our limited export
+  # policy.  This was not a typo.
+  #
+  US_EXPORT_POLICY_JAR_SRC_DIR := $(JDK_TOPDIR)/make/javax/crypto/policy/unlimited
+  US_EXPORT_POLICY_JAR_TMP := $(IMAGES_OUTPUTDIR)/US_export_policy_jar.tmp
 
-$(US_EXPORT_POLICY_JAR_TMP)/% : $(US_EXPORT_POLICY_JAR_SRC_DIR)/%
+  $(US_EXPORT_POLICY_JAR_TMP)/% : $(US_EXPORT_POLICY_JAR_SRC_DIR)/%
 	$(install-file)
 
-US_EXPORT_POLICY_JAR_DEPS := $(US_EXPORT_POLICY_JAR_TMP)/default_US_export.policy
+  US_EXPORT_POLICY_JAR_DEPS := $(US_EXPORT_POLICY_JAR_TMP)/default_US_export.policy
 
-$(eval $(call SetupArchive,BUILD_US_EXPORT_POLICY_JAR,$(US_EXPORT_POLICY_JAR_DEPS),\
+  $(eval $(call SetupArchive,BUILD_US_EXPORT_POLICY_JAR,$(US_EXPORT_POLICY_JAR_DEPS),\
 		SRCS:=$(US_EXPORT_POLICY_JAR_TMP), \
 		SUFFIXES:= .policy,\
 		JAR:=$(US_EXPORT_POLICY_JAR_UNSIGNED), \
 		EXTRA_MANIFEST_ATTR := Crypto-Strength: unlimited, \
 		SKIP_METAINF := true))
 
+  JARS += $(US_EXPORT_POLICY_JAR_UNSIGNED)
+endif
+
 ifndef OPENJDK
   $(US_EXPORT_POLICY_JAR_DST): $(JDK_TOPDIR)/make/closed/tools/crypto/jce/US_export_policy.jar
 	$(ECHO) $(LOG_INFO) Copying $(@F)
@@ -625,40 +638,42 @@ else
 	$(install-file)
 endif
 
-JARS += $(US_EXPORT_POLICY_JAR_UNSIGNED)
-
 ##########################################################################################
 
 LOCAL_POLICY_JAR_DST := $(IMAGES_OUTPUTDIR)/lib/security/local_policy.jar
 LOCAL_POLICY_JAR_UNSIGNED := $(IMAGES_OUTPUTDIR)/unsigned/local_policy.jar
 
-#
-# TODO fix so that SetupArchive does not write files into SRCS
-#   then we don't need this extra copying
-#
-LOCAL_POLICY_JAR_TMP := $(IMAGES_OUTPUTDIR)/local_policy_jar.tmp
+ifneq ($(BUILD_CRYPTO),no)
+  #
+  # TODO fix so that SetupArchive does not write files into SRCS
+  #   then we don't need this extra copying
+  #
+  LOCAL_POLICY_JAR_TMP := $(IMAGES_OUTPUTDIR)/local_policy_jar.tmp
 
-ifeq ($(UNLIMITED_CRYPTO), true)
+  ifeq ($(UNLIMITED_CRYPTO), true)
     LOCAL_POLICY_JAR_SRC_DIR := $(JDK_TOPDIR)/make/javax/crypto/policy/unlimited
     LOCAL_POLICY_JAR_DEPS := $(LOCAL_POLICY_JAR_TMP)/default_local.policy
     LOCAL_POLICY_JAR_ATTR := Crypto-Strength: unlimited
-else
+  else
     LOCAL_POLICY_JAR_SRC_DIR := $(JDK_TOPDIR)/make/javax/crypto/policy/limited
     LOCAL_POLICY_JAR_DEPS := $(LOCAL_POLICY_JAR_TMP)/exempt_local.policy \
                              $(LOCAL_POLICY_JAR_TMP)/default_local.policy
     LOCAL_POLICY_JAR_ATTR := Crypto-Strength: limited
-endif
+  endif
 
-$(LOCAL_POLICY_JAR_TMP)/% : $(LOCAL_POLICY_JAR_SRC_DIR)/%
+  $(LOCAL_POLICY_JAR_TMP)/% : $(LOCAL_POLICY_JAR_SRC_DIR)/%
 	$(install-file)
 
-$(eval $(call SetupArchive,BUILD_LOCAL_POLICY_JAR,$(LOCAL_POLICY_JAR_DEPS),\
+  $(eval $(call SetupArchive,BUILD_LOCAL_POLICY_JAR,$(LOCAL_POLICY_JAR_DEPS),\
 		SRCS:=$(LOCAL_POLICY_JAR_TMP),\
 		SUFFIXES:= .policy,\
 		JAR:=$(LOCAL_POLICY_JAR_UNSIGNED), \
 		EXTRA_MANIFEST_ATTR := $(LOCAL_POLICY_JAR_ATTR), \
 		SKIP_METAINF := true))
 
+  JARS += $(LOCAL_POLICY_JAR_UNSIGNED)
+endif
+
 ifndef OPENJDK
   $(LOCAL_POLICY_JAR_DST): $(JDK_TOPDIR)/make/closed/tools/crypto/jce/local_policy.jar
 	$(ECHO) $(LOG_INFO) Copying $(@F)
@@ -668,8 +683,6 @@ else
 	$(install-file)
 endif
 
-JARS += $(LOCAL_POLICY_JAR_UNSIGNED)
-
 ##########################################################################################
 
 ifeq ($(OPENJDK_TARGET_OS),windows)

makefiles/GendataFontConfig.gmk

@@ -36,11 +36,9 @@ ifeq ($(OPENJDK_TARGET_OS), linux)
   ifdef OPENJDK
     GENDATA_FONT_CONFIG_SRC_DIR   := \
         $(JDK_TOPDIR)/src/solaris/classes/sun/awt/fontconfigs
-    GENDATA_FONT_CONFIG_SRC_FILES := \
-	fontconfig.properties \
-	fontconfig.SuSE.properties \
-	fontconfig.Ubuntu.properties \
-	fontconfig.Fedora.properties
+    # This is placeholder for possible fonconfig files which may
+    # useful for some highly specialized Linux distributions 
+    GENDATA_FONT_CONFIG_SRC_FILES := 
   else
     GENDATA_FONT_CONFIG_SRC_DIR   := \
         $(JDK_TOPDIR)/src/closed/solaris/classes/sun/awt/fontconfigs

makefiles/GensrcBuffer.gmk

@@ -69,6 +69,9 @@ define typesAndBits
 		$1_fulltype := character
 		$1_Fulltype := Character
 		$1_category := integralType
+                $1_streams  := streamableType
+                $1_streamtype := int
+                $1_Streamtype := Int
 		$1_LBPV     := 1
 	endif
 
@@ -231,10 +234,13 @@ $$($1_DST) : $$($1_DEP) $(GENSRC_BUFFER_DST)/_the.buffer.dir
 	$(TOOL_SPP) < $$($1_SRC) > $$($1_OUT).tmp \
 		-K$$($1_type) \
 		-K$$($1_category) \
+		-K$$($1_streams) \
 		-Dtype=$$($1_type) \
 		-DType=$$($1_Type) \
 		-Dfulltype=$$($1_fulltype) \
 		-DFulltype=$$($1_Fulltype) \
+                -Dstreamtype=$$($1_streamtype) \
+                -DStreamtype=$$($1_Streamtype) \
 		-Dx=$$($1_x) \
 		-Dmemtype=$$($1_memtype) \
 		-DMemtype=$$($1_Memtype) \

makefiles/Images.gmk

@@ -50,8 +50,6 @@ images:: jre-image jdk-image
 overlay-images: jre-overlay-image jdk-overlay-image
 
 
--include $(CUSTOM_MAKE_DIR)/Images.gmk
-
 
 # Processing license files from source area to image area
 # These will be modified to have the platform specific EOL chars.
@@ -774,3 +772,5 @@ endif # Profile
 ################################################################################
 
 .PHONY: default images jre-image jdk-image
+
+-include $(CUSTOM_MAKE_DIR)/Images.gmk

makefiles/Import.gmk

@@ -200,6 +200,46 @@ $(INSTALL_LIBRARIES_HERE)/minimal/%.diz : $(INSTALL_LIBRARIES_HERE)/%.diz
 	$(RM) $(basename $@).debuginfo
 	$(MV) $@.tmp $@
 
-#######
+##########################################################################################
+# Unpack the binary distributions of the crypto classes if they exist.
+SEC_FILES_ZIP:=$(JDK_TOPDIR)/make/tools/crypto/sec-bin.zip
+SEC_FILES_WIN_ZIP:=$(JDK_TOPDIR)/make/tools/crypto/sec-windows-bin.zip
+JGSS_WIN32_FILES_ZIP:=$(JDK_TOPDIR)/make/tools/crypto/jgss-windows-i586-bin.zip
+JGSS_WIN64_FILES_ZIP:=$(JDK_TOPDIR)/make/tools/crypto/jgss-windows-x64-bin.zip
+
+define unzip-sec-file
+	$(ECHO) Unzipping $(<F)
+	$(MKDIR) -p $(@D)
+	$(RM) $@
+	($(CD) $(JDK_OUTPUTDIR) && $(UNZIP) $< > $@.tmp)
+	$(MV) $@.tmp $@
+endef
+
+$(JDK_OUTPUTDIR)/classes/_the.sec-bin.unzipped: $(SEC_FILES_ZIP)
+	$(call unzip-sec-file)
+
+$(JDK_OUTPUTDIR)/classes/_the.sec-windows-bin.unzipped: $(SEC_FILES_WIN_ZIP)
+	$(call unzip-sec-file)
+
+$(JDK_OUTPUTDIR)/classes/_the.jgss-windows-i586-bin.unzipped: $(JGSS_WIN32_FILES_ZIP)
+	$(call unzip-sec-file)
+
+$(JDK_OUTPUTDIR)/classes/_the.jgss-windows-x64-bin.unzipped: $(JGSS_WIN64_FILES_ZIP)
+	$(call unzip-sec-file)
+
+ifneq ($(wildcard $(SEC_FILES_ZIP)),)
+  IMPORT_TARGET_FILES += $(JDK_OUTPUTDIR)/classes/_the.sec-bin.unzipped
+  ifeq ($(OPENJDK_TARGET_OS),windows)
+    IMPORT_TARGET_FILES += $(JDK_OUTPUTDIR)/classes/_the.sec-windows-bin.unzipped
+    ifeq ($(OPENJDK_TARGET_CPU),x86)
+      IMPORT_TARGET_FILES += $(JDK_OUTPUTDIR)/classes/_the.jgss-windows-i586-bin.unzipped
+    endif
+    ifeq ($(OPENJDK_TARGET_CPU),x86_64)
+      IMPORT_TARGET_FILES += $(JDK_OUTPUTDIR)/classes/_the.jgss-windows-x64-bin.unzipped
+    endif
+  endif
+endif
+
+##########################################################################################
 
 all: $(IMPORT_TARGET_FILES)

makefiles/Setup.gmk

@@ -40,7 +40,9 @@ $(eval $(call SetupJavaCompiler,GENERATE_OLDBYTECODE,\
 $(eval $(call SetupJavaCompiler,GENERATE_JDKBYTECODE,\
      JVM:=$(JAVA),\
      JAVAC:=$(NEW_JAVAC),\
-     FLAGS:=-bootclasspath $(JDK_OUTPUTDIR)/classes -source 8 -target 8 -encoding ascii -XDignore.symbol.file=true $(DISABLE_WARNINGS),\
+     FLAGS:=-bootclasspath $(JDK_OUTPUTDIR)/classes -source 8 -target 8 \
+	    -encoding ascii -XDignore.symbol.file=true $(DISABLE_WARNINGS) \
+	    $(GENERATE_JDKBYTECODE_EXTRA_FLAGS),\
      SERVER_DIR:=$(SJAVAC_SERVER_DIR),\
      SERVER_JVM:=$(SJAVAC_SERVER_JAVA)))
 

makefiles/mapfiles/libmanagement/mapfile-vers

 #
-# Copyright (c) 2005, 2012, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2005, 2013, Oracle and/or its affiliates. All rights reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -39,6 +39,10 @@ SUNWprivate_1.1 {
 	    Java_com_sun_management_UnixOperatingSystem_getTotalSwapSpaceSize;
 	    Java_com_sun_management_UnixOperatingSystem_initialize;
 	    Java_sun_management_ClassLoadingImpl_setVerboseClass;
+            Java_sun_management_DiagnosticCommandImpl_executeDiagnosticCommand;
+            Java_sun_management_DiagnosticCommandImpl_getDiagnosticCommands;
+            Java_sun_management_DiagnosticCommandImpl_getDiagnosticCommandInfo;
+            Java_sun_management_DiagnosticCommandImpl_setNotificationEnabled;
 	    Java_sun_management_FileSystemImpl_isAccessUserOnly0;
 	    Java_sun_management_Flag_getAllFlagNames;
 	    Java_sun_management_Flag_getFlags;

src/macosx/classes/sun/font/CCharToGlyphMapper.java

@@ -130,17 +130,27 @@ public class CCharToGlyphMapper extends CharToGlyphMapper {
     }
 
     public synchronized int charToGlyph(int unicode) {
+        if (unicode >= 0x10000) {
+            int[] glyphs = new int[2];
+            char[] surrogates = new char[2];
+            int base = unicode - 0x10000;
+            surrogates[0] = (char)((base >>> 10) + HI_SURROGATE_START);
+            surrogates[1] = (char)((base % 0x400) + LO_SURROGATE_START);
+            charsToGlyphs(2, surrogates, glyphs);
+            return glyphs[0];
+         } else {
              return charToGlyph((char)unicode);
          }
+    }
 
     public synchronized void charsToGlyphs(int count, char[] unicodes, int[] glyphs) {
         cache.get(count, unicodes, glyphs);
     }
 
     public synchronized void charsToGlyphs(int count, int[] unicodes, int[] glyphs) {
-        final char[] unicodeChars = new char[count];
-        for (int i = 0; i < count; i++) unicodeChars[i] = (char)unicodes[i];
-        cache.get(count, unicodeChars, glyphs);
+        for (int i = 0; i < count; i++) {
+            glyphs[i] = charToGlyph(unicodes[i]);
+        };
     }
 
     // This mapper returns either the glyph code, or if the character can be
@@ -166,7 +176,7 @@ public class CCharToGlyphMapper extends CharToGlyphMapper {
             firstLayerCache[1] = 1;
         }
 
-        public int get(final char index) {
+        public synchronized int get(final int index) {
             if (index < FIRST_LAYER_SIZE) {
                 // catch common glyphcodes
                 return firstLayerCache[index];
@@ -179,12 +189,12 @@ public class CCharToGlyphMapper extends CharToGlyphMapper {
             }
 
             if (generalCache == null) return 0;
-            final Integer value = generalCache.get(new Integer(index));
+            final Integer value = generalCache.get(index);
             if (value == null) return 0;
             return value.intValue();
         }
 
-        public void put(final char index, final int value) {
+        public synchronized void put(final int index, final int value) {
             if (index < FIRST_LAYER_SIZE) {
                 // catch common glyphcodes
                 firstLayerCache[index] = value;
@@ -204,7 +214,7 @@ public class CCharToGlyphMapper extends CharToGlyphMapper {
                 generalCache = new HashMap<Integer, Integer>();
             }
 
-            generalCache.put(new Integer(index), new Integer(value));
+            generalCache.put(index, value);
         }
 
         private class SparseBitShiftingTwoLayerArray {
@@ -220,14 +230,14 @@ public class CCharToGlyphMapper extends CharToGlyphMapper {
                 this.secondLayerLength = size >> shift;
             }
 
-            public int get(final char index) {
+            public int get(final int index) {
                 final int firstIndex = index >> shift;
                 final int[] firstLayerRow = cache[firstIndex];
                 if (firstLayerRow == null) return 0;
                 return firstLayerRow[index - (firstIndex * (1 << shift))];
             }
 
-            public void put(final char index, final int value) {
+            public void put(final int index, final int value) {
                 final int firstIndex = index >> shift;
                 int[] firstLayerRow = cache[firstIndex];
                 if (firstLayerRow == null) {
@@ -237,77 +247,81 @@ public class CCharToGlyphMapper extends CharToGlyphMapper {
             }
         }
 
-        public void get(int count, char[] indicies, int[] values){
+        public synchronized void get(int count, char[] indicies, int[] values)
+        {
+            // "missed" is the count of 'char' that are not mapped.
+            // Surrogates count for 2.
+            // unmappedChars is the unique list of these chars.
+            // unmappedCharIndices is the location in the original array
             int missed = 0;
-            for(int i = 0; i < count; i++){
-                char code = indicies[i];
+            char[] unmappedChars = null;
+            int [] unmappedCharIndices = null;
+
+            for (int i = 0; i < count; i++){
+                int code = indicies[i];
+                if (code >= HI_SURROGATE_START &&
+                    code <= HI_SURROGATE_END && i < count - 1)
+                {
+                    char low = indicies[i + 1];
+                    if (low >= LO_SURROGATE_START && low <= LO_SURROGATE_END) {
+                        code = (code - HI_SURROGATE_START) * 0x400 +
+                            low - LO_SURROGATE_START + 0x10000;
+                    }
+                }
 
                 final int value = get(code);
-                if(value != 0){
+                if (value != 0 && value != -1) {
                     values[i] = value;
-                }else{
-                    // zero this element out, because the caller does not
-                    // promise to keep it clean
+                    if (code >= 0x10000) {
+                        values[i+1] = INVISIBLE_GLYPH_ID;
+                        i++;
+                    }
+                } else {
                     values[i] = 0;
+                    put(code, -1);
+                    if (unmappedChars == null) {
+                        // This is likely to be longer than we need,
+                        // but is the simplest and cheapest option.
+                        unmappedChars = new char[indicies.length];
+                        unmappedCharIndices = new int[indicies.length];
+                    }
+                    unmappedChars[missed] = indicies[i];
+                    unmappedCharIndices[missed] = i;
+                    if (code >= 0x10000) { // was a surrogate pair
+                        unmappedChars[++missed] = indicies[++i];
+                    }
                     missed++;
                 }
             }
 
-            if (missed == 0) return; // horray! everything is already cached!
-
-            final char[] filteredCodes = new char[missed]; // all index codes requested (partially filled)
-            final int[] filteredIndicies = new int[missed]; // local indicies into filteredCodes array (totally filled)
+            if (missed == 0) {
+                return;
+            }
 
-            // scan, mark, and store the index codes again to send into native
-            int j = 0;
-            int dupes = 0;
-            for (int i = 0; i < count; i++){
-                if (values[i] != 0L) continue; // already filled
+            final int[] glyphCodes = new int[missed];
 
-                final char code = indicies[i];
+            // bulk call to fill in the unmapped code points.
+            nativeCharsToGlyphs(fFont.getNativeFontPtr(),
+                                missed, unmappedChars, glyphCodes);
 
-                // we have already promised to fill this code - this is a dupe
-                if (get(code) == -1){
-                    filteredIndicies[j] = -1;
-                    dupes++;
-                    j++;
-                    continue;
+            for (int m = 0; m < missed; m++){
+                int i = unmappedCharIndices[m];
+                int code = unmappedChars[m];
+                if (code >= HI_SURROGATE_START &&
+                    code <= HI_SURROGATE_END && m < missed - 1)
+                {
+                    char low = indicies[m + 1];
+                    if (low >= LO_SURROGATE_START && low <= LO_SURROGATE_END) {
+                        code = (code - HI_SURROGATE_START) * 0x400 +
+                            low - LO_SURROGATE_START + 0x10000;
                     }
-
-                // this is a code we have not obtained before
-                // mark this one as "promise to get" in the global cache with a -1
-                final int k = j - dupes;
-                filteredCodes[k] = code;
-                put(code, -1);
-                filteredIndicies[j] = k;
-                j++;
                 }
-
-            final int filteredRunLen = j - dupes;
-            final int[] filteredValues = new int[filteredRunLen];
-
-            // bulk call to fill in the distinct values
-            nativeCharsToGlyphs(fFont.getNativeFontPtr(), filteredRunLen, filteredCodes, filteredValues);
-
-            // scan the requested list, and fill in values from our
-            // distinct code list which has been filled from "getDistinct"
-            j = 0;
-            for (int i = 0; i < count; i++){
-                if (values[i] != 0L && values[i] != -1L) continue; // already placed
-
-                final int k = filteredIndicies[j]; // index into filteredImages array
-                final char code = indicies[i];
-                if(k == -1L){
-                    // we should have already filled the cache with this value
-                    values[i] = get(code);
-                }else{
-                    // fill the particular code request, and store in the cache
-                    final int ptr = filteredValues[k];
-                    values[i] = ptr;
-                    put(code, ptr);
+               values[i] = glyphCodes[m];
+               put(code, values[i]);
+               if (code >= 0x10000) {
+                   m++;
+                   values[i + 1] = INVISIBLE_GLYPH_ID;
                 }
-
-                j++;
             }
         }
     }

src/share/classes/com/sun/crypto/provider/DHKeyAgreement.java

 /*
- * Copyright (c) 1997, 2012, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -403,8 +403,9 @@ extends KeyAgreementSpi {
             }
             return skey;
         } else if (algorithm.equals("TlsPremasterSecret")) {
-            // return entire secret
-            return new SecretKeySpec(secret, "TlsPremasterSecret");
+            // remove leading zero bytes per RFC 5246 Section 8.1.2
+            return new SecretKeySpec(
+                        KeyUtil.trimZeroes(secret), "TlsPremasterSecret");
         } else {
             throw new NoSuchAlgorithmException("Unsupported secret key "
                                                + "algorithm: "+ algorithm);

src/share/classes/com/sun/crypto/provider/HmacPKCS12PBESHA1.java

@@ -86,12 +86,13 @@ public final class HmacPKCS12PBESHA1 extends HmacCore {
             throw new InvalidKeyException("SecretKey of PBE type required");
         }
         if (params == null) {
-            // generate default for salt and iteration count if necessary
-            if (salt == null) {
-                salt = new byte[20];
-                SunJCE.getRandom().nextBytes(salt);
+            // should not auto-generate default values since current
+            // javax.crypto.Mac api does not have any method for caller to
+            // retrieve the generated defaults.
+            if ((salt == null) || (iCount == 0)) {
+                throw new InvalidAlgorithmParameterException
+                    ("PBEParameterSpec required for salt and iteration count");
             }
-            if (iCount == 0) iCount = 100;
         } else if (!(params instanceof PBEParameterSpec)) {
             throw new InvalidAlgorithmParameterException
                 ("PBEParameterSpec type required");

src/share/classes/com/sun/crypto/provider/PBMAC1Core.java

@@ -42,12 +42,10 @@ import java.security.spec.*;
  */
 abstract class PBMAC1Core extends HmacCore {
 
-    private static final int DEFAULT_SALT_LENGTH = 20;
-    private static final int DEFAULT_COUNT = 4096;
-
+    // NOTE: this class inherits the Cloneable interface from HmacCore
+    // Need to override clone() if mutable fields are added.
     private final String kdfAlgo;
     private final String hashAlgo;
-    private final PBKDF2Core kdf;
     private final int blockLength; // in octets
 
     /**
@@ -56,13 +54,15 @@ abstract class PBMAC1Core extends HmacCore {
      */
     PBMAC1Core(String kdfAlgo, String hashAlgo, int blockLength)
         throws NoSuchAlgorithmException {
-
         super(hashAlgo, blockLength);
         this.kdfAlgo = kdfAlgo;
         this.hashAlgo = hashAlgo;
         this.blockLength = blockLength;
+    }
 
-        switch(kdfAlgo) {
+    private static PBKDF2Core getKDFImpl(String algo) {
+        PBKDF2Core kdf = null;
+        switch(algo) {
         case "HmacSHA1":
                 kdf = new PBKDF2Core.HmacSHA1();
                 break;
@@ -79,9 +79,10 @@ abstract class PBMAC1Core extends HmacCore {
                 kdf = new PBKDF2Core.HmacSHA512();
                 break;
         default:
-                throw new NoSuchAlgorithmException(
-                    "No MAC implementation for " + kdfAlgo);
+                throw new ProviderException(
+                    "No MAC implementation for " + algo);
         }
+        return kdf;
     }
 
     /**
@@ -120,12 +121,13 @@ abstract class PBMAC1Core extends HmacCore {
             throw new InvalidKeyException("SecretKey of PBE type required");
         }
         if (params == null) {
-            // generate default for salt and iteration count if necessary
-            if (salt == null) {
-                salt = new byte[DEFAULT_SALT_LENGTH];
-                SunJCE.getRandom().nextBytes(salt);
+            // should not auto-generate default values since current
+            // javax.crypto.Mac api does not have any method for caller to
+            // retrieve the generated defaults.
+            if ((salt == null) || (iCount == 0)) {
+                throw new InvalidAlgorithmParameterException
+                    ("PBEParameterSpec required for salt and iteration count");
             }
-            if (iCount == 0) iCount = DEFAULT_COUNT;
         } else if (!(params instanceof PBEParameterSpec)) {
             throw new InvalidAlgorithmParameterException
                 ("PBEParameterSpec type required");
@@ -168,7 +170,7 @@ abstract class PBMAC1Core extends HmacCore {
         java.util.Arrays.fill(passwdChars, ' ');
 
         SecretKey s = null;
-
+        PBKDF2Core kdf = getKDFImpl(kdfAlgo);
         try {
             s = kdf.engineGenerateSecret(pbeSpec);
 

src/share/classes/com/sun/crypto/provider/SunJCE.java

@@ -731,10 +731,11 @@ public final class SunJCE extends Provider {
                     put("Mac.HmacSHA384 SupportedKeyFormats", "RAW");
                     put("Mac.HmacSHA512 SupportedKeyFormats", "RAW");
                     put("Mac.HmacPBESHA1 SupportedKeyFormats", "RAW");
-                    put("Mac.HmacPBESHA224 SupportedKeyFormats", "RAW");
-                    put("Mac.HmacPBESHA256 SupportedKeyFormats", "RAW");
-                    put("Mac.HmacPBESHA384 SupportedKeyFormats", "RAW");
-                    put("Mac.HmacPBESHA512 SupportedKeyFormats", "RAW");
+                    put("Mac.PBEWithHmacSHA1 SupportedKeyFormatS", "RAW");
+                    put("Mac.PBEWithHmacSHA224 SupportedKeyFormats", "RAW");
+                    put("Mac.PBEWithHmacSHA256 SupportedKeyFormats", "RAW");
+                    put("Mac.PBEWithHmacSHA384 SupportedKeyFormats", "RAW");
+                    put("Mac.PBEWithHmacSHA512 SupportedKeyFormats", "RAW");
                     put("Mac.SslMacMD5 SupportedKeyFormats", "RAW");
                     put("Mac.SslMacSHA1 SupportedKeyFormats", "RAW");
 

src/share/classes/com/sun/management/DiagnosticCommandMBean.java

+/*
+ * Copyright (c) 2013, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package com.sun.management;
+
+import java.lang.management.PlatformManagedObject;
+import javax.management.DynamicMBean;
+
+/**
+ * Management interface for the diagnostic commands for the HotSpot Virtual Machine.
+ *
+ * <p>The {code DiagnosticCommandMBean} is registered to the
+ * {@linkplain java.lang.management.ManagementFactory#getPlatformMBeanServer
+ * platform MBeanServer} as are other platform MBeans.
+ *
+ * <p>The {@link javax.management.ObjectName ObjectName} for uniquely identifying
+ * the diagnostic MBean within an MBeanServer is:
+ * <blockquote>
+ *    {@code com.sun.management:type=DiagnosticCommand}
+ * </blockquote>
+ *
+ * <p>This MBean is a {@link javax.management.DynamicMBean DynamicMBean}
+ * and also a {@link javax.management.NotificationEmitter}.
+ * The {@code DiagnosticCommandMBean} is generated at runtime and is subject to
+ * modifications during the lifetime of the Java virtual machine.
+ *
+ * A <em>diagnostic command</em> is represented as an operation of
+ * the {@code DiagnosticCommandMBean} interface. Each diagnostic command has:
+ * <ul>
+ * <li>the diagnostic command name which is the name being referenced in
+ *     the HotSpot Virtual Machine</li>
+ * <li>the MBean operation name which is the
+ *     {@linkplain javax.management.MBeanOperationInfo#getName() name}
+ *     generated for the diagnostic command operation invocation.
+ *     The MBean operation name is implementation dependent</li>
+ * </ul>
+ *
+ * The recommended way to transform a diagnostic command name into a MBean
+ * operation name is as follows:
+ * <ul>
+ * <li>All characters from the first one to the first dot are set to be
+ *      lower-case characters</li>
+ * <li>Every dot or underline character is removed and the following
+ *   character is set to be an upper-case character</li>
+ * <li>All other characters are copied without modification</li>
+ * </ul>
+ *
+ * <p>The diagnostic command name is always provided with the meta-data on the
+ * operation in a field named {@code dcmd.name} (see below).
+ *
+ * <p>A diagnostic command may or may not support options or arguments.
+ * All the operations return {@code String} and either take
+ * no parameter for operations that do not support any option or argument,
+ * or take a {@code String[]} parameter for operations that support at least
+ * one option or argument.
+ * Each option or argument must be stored in a single String.
+ * Options or arguments split across several String instances are not supported.
+ *
+ * <p>The distinction between options and arguments: options are identified by
+ * the option name while arguments are identified by their position in the
+ * command line. Options and arguments are processed in the order of the array
+ * passed to the invocation method.
+ *
+ * <p>Like any operation of a dynamic MBean, each of these operations is
+ * described by {@link javax.management.MBeanOperationInfo MBeanOperationInfo}
+ * instance. Here's the values returned by this object:
+ * <ul>
+ *  <li>{@link javax.management.MBeanOperationInfo#getName() getName()}
+ *      returns the operation name generated from the diagnostic command name</li>
+ *  <li>{@link javax.management.MBeanOperationInfo#getDescription() getDescription()}
+ *      returns the diagnostic command description
+ *      (the same as the one return in the 'help' command)</li>
+ *  <li>{@link javax.management.MBeanOperationInfo#getImpact() getImpact()}
+ *      returns <code>ACTION_INFO</code></li>
+ *  <li>{@link javax.management.MBeanOperationInfo#getReturnType() getReturnType()}
+ *      returns {@code java.lang.String}</li>
+ *  <li>{@link javax.management.MBeanOperationInfo#getDescriptor() getDescriptor()}
+ *      returns a Descriptor instance (see below)</li>
+ * </ul>
+ *
+ * <p>The {@link javax.management.Descriptor Descriptor}
+ * is a collection of fields containing additional
+ * meta-data for a JMX element. A field is a name and an associated value.
+ * The additional meta-data provided for an operation associated with a
+ * diagnostic command are described in the table below:
+ * <p>
+ *
+ * <table border="1" cellpadding="5">
+ *   <tr>
+ *     <th>Name</th><th>Type</th><th>Description</th>
+ *   </tr>
+ *   <tr>
+ *     <td>dcmd.name</td><td>String</td>
+ *     <td>The original diagnostic command name (not the operation name)</td>
+ *   </tr>
+ *   <tr>
+ *     <td>dcmd.description</td><td>String</td>
+ *     <td>The diagnostic command description</td>
+ *   </tr>
+ *   <tr>
+ *     <td>dcmd.help</td><td>String</td>
+ *     <td>The full help message for this diagnostic command (same output as
+ *          the one produced by the 'help' command)</td>
+ *   </tr>
+ *   <tr>
+ *     <td>dcmd.vmImpact</td><td>String</td>
+ *     <td>The impact of the diagnostic command,
+ *      this value is the same as the one printed in the 'impact'
+ *      section of the help message of the diagnostic command, and it
+ *      is different from the getImpact() of the MBeanOperationInfo</td>
+ *   </tr>
+ *   <tr>
+ *     <td>dcmd.enabled</td><td>boolean</td>
+ *     <td>True if the diagnostic command is enabled, false otherwise</td>
+ *   </tr>
+ *   <tr>
+ *     <td>dcmd.permissionClass</td><td>String</td>
+ *     <td>Some diagnostic command might require a specific permission to be
+ *          executed, in addition to the MBeanPermission to invoke their
+ *          associated MBean operation. This field returns the fully qualified
+ *          name of the permission class or null if no permission is required
+ *   </td>
+ *   </tr>
+ *   <tr>
+ *     <td>dcmd.permissionName</td><td>String</td>
+ *     <td>The fist argument of the permission required to execute this
+ *          diagnostic command or null if no permission is required</td>
+ *   </tr>
+ *   <tr>
+ *     <td>dcmd.permissionAction</td><td>String</td>
+ *     <td>The second argument of the permission required to execute this
+ *          diagnostic command or null if the permission constructor has only
+ *          one argument (like the ManagementPermission) or if no permission
+ *          is required</td>
+ *   </tr>
+ *   <tr>
+ *     <td>dcmd.arguments</td><td>Descriptor</td>
+ *     <td>A Descriptor instance containing the descriptions of options and
+ *          arguments supported by the diagnostic command (see below)</td>
+ *   </tr>
+ * </table>
+ * <p>
+ *
+ * <p>The description of parameters (options or arguments) of a diagnostic
+ * command is provided within a Descriptor instance. In this Descriptor,
+ * each field name is a parameter name, and each field value is itself
+ * a Descriptor instance. The fields provided in this second Descriptor
+ * instance are described in the table below:
+ *
+ * <table border="1" cellpadding="5">
+ *   <tr>
+ *     <th>Name</th><th>Type</th><th>Description</th>
+ *   </tr>
+ *   <tr>
+ *     <td>dcmd.arg.name</td><td>String</td>
+ *     <td>The name of the parameter</td>
+ *   </tr>
+ *   <tr>
+ *     <td>dcmd.arg.type</td><td>String</td>
+ *     <td>The type of the parameter. The returned String is the name of a type
+ *          recognized by the diagnostic command parser. These types are not
+ *          Java types and are implementation dependent.
+ *          </td>
+ *   </tr>
+ *   <tr>
+ *     <td>dcmd.arg.description</td><td>String</td>
+ *     <td>The parameter description</td>
+ *   </tr>
+ *   <tr>
+ *     <td>dcmd.arg.isMandatory</td><td>boolean</td>
+ *     <td>True if the parameter is mandatory, false otherwise</td>
+ *   </tr>
+ *   <tr>
+ *     <td>dcmd.arg.isOption</td><td>boolean</td>
+ *     <td>True if the parameter is an option, false if it is an argument</td>
+ *   </tr>
+ *   <tr>
+ *     <td>dcmd.arg.isMultiple</td><td>boolean</td>
+ *     <td>True if the parameter can be specified several times, false
+ *          otherwise</td>
+ *   </tr>
+ * </table>
+ *
+ * <p>When the set of diagnostic commands currently supported by the Java
+ * Virtual Machine is modified, the {@code DiagnosticCommandMBean} emits
+ * a {@link javax.management.Notification} with a
+ * {@linkplain javax.management.Notification#getType() type} of
+ * <a href="{@docRoot}/../../../../api/javax/management/MBeanInfo.html#info-changed">
+ * {@code "jmx.mbean.info.changed"}</a> and a
+ * {@linkplain javax.management.Notification#getUserData() userData} that
+ * is the new {@code MBeanInfo}.
+ *
+ * @since 8
+ */
+public interface DiagnosticCommandMBean extends DynamicMBean
+{
+
+}

src/share/classes/java/lang/Integer.java

@@ -26,7 +26,6 @@
 package java.lang;
 
 import java.lang.annotation.Native;
-import java.util.Properties;
 
 /**
  * The {@code Integer} class wraps a value of the primitive type
@@ -185,7 +184,7 @@ public final class Integer extends Number implements Comparable<Integer> {
      * @since 1.8
      */
     public static String toUnsignedString(int i, int radix) {
-        return Long.toString(toUnsignedLong(i), radix);
+        return Long.toUnsignedString(toUnsignedLong(i), radix);
     }
 
     /**
@@ -307,20 +306,39 @@ public final class Integer extends Number implements Comparable<Integer> {
     /**
      * Convert the integer to an unsigned number.
      */
-    private static String toUnsignedString0(int i, int shift) {
-        char[] buf = new char[32];
-        int charPos = 32;
+    private static String toUnsignedString0(int val, int shift) {
+        // assert shift > 0 && shift <=5 : "Illegal shift value";
+        int mag = Integer.SIZE - Integer.numberOfLeadingZeros(val);
+        int chars = Math.max(((mag + (shift - 1)) / shift), 1);
+        char[] buf = new char[chars];
+
+        formatUnsignedInt(val, shift, buf, 0, chars);
+
+        // Use special constructor which takes over "buf".
+        return new String(buf, true);
+    }
+
+    /**
+     * Format a long (treated as unsigned) into a character buffer.
+     * @param val the unsigned int to format
+     * @param shift the log2 of the base to format in (4 for hex, 3 for octal, 1 for binary)
+     * @param buf the character buffer to write to
+     * @param offset the offset in the destination buffer to start at
+     * @param len the number of characters to write
+     * @return the lowest character  location used
+     */
+     static int formatUnsignedInt(int val, int shift, char[] buf, int offset, int len) {
+        int charPos = len;
         int radix = 1 << shift;
         int mask = radix - 1;
         do {
-            buf[--charPos] = digits[i & mask];
-            i >>>= shift;
-        } while (i != 0);
+            buf[offset + --charPos] = Integer.digits[val & mask];
+            val >>>= shift;
+        } while (val != 0 && charPos > 0);
 
-        return new String(buf, charPos, (32 - charPos));
+        return charPos;
     }
 
-
     final static char [] DigitTens = {
         '0', '0', '0', '0', '0', '0', '0', '0', '0', '0',
         '1', '1', '1', '1', '1', '1', '1', '1', '1', '1',
@@ -875,6 +893,7 @@ public final class Integer extends Number implements Comparable<Integer> {
      * Returns the value of this {@code Integer} as a {@code long}
      * after a widening primitive conversion.
      * @jls 5.1.2 Widening Primitive Conversions
+     * @see Integer#toUnsignedLong(int)
      */
     public long longValue() {
         return (long)value;

src/share/classes/java/lang/Long.java

@@ -28,6 +28,7 @@ package java.lang;
 import java.lang.annotation.Native;
 import java.math.*;
 
+
 /**
  * The {@code Long} class wraps a value of the primitive type {@code
  * long} in an object. An object of type {@code Long} contains a
@@ -344,18 +345,39 @@ public final class Long extends Number implements Comparable<Long> {
     }
 
     /**
-     * Convert the integer to an unsigned number.
+     * Format a long (treated as unsigned) into a String.
+     * @param val the value to format
+     * @param shift the log2 of the base to format in (4 for hex, 3 for octal, 1 for binary)
      */
-    private static String toUnsignedString0(long i, int shift) {
-        char[] buf = new char[64];
-        int charPos = 64;
+    static String toUnsignedString0(long val, int shift) {
+        // assert shift > 0 && shift <=5 : "Illegal shift value";
+        int mag = Long.SIZE - Long.numberOfLeadingZeros(val);
+        int chars = Math.max(((mag + (shift - 1)) / shift), 1);
+        char[] buf = new char[chars];
+
+        formatUnsignedLong(val, shift, buf, 0, chars);
+        return new String(buf, true);
+    }
+
+    /**
+     * Format a long (treated as unsigned) into a character buffer.
+     * @param val the unsigned long to format
+     * @param shift the log2 of the base to format in (4 for hex, 3 for octal, 1 for binary)
+     * @param buf the character buffer to write to
+     * @param offset the offset in the destination buffer to start at
+     * @param len the number of characters to write
+     * @return the lowest character location used
+     */
+     static int formatUnsignedLong(long val, int shift, char[] buf, int offset, int len) {
+        int charPos = len;
         int radix = 1 << shift;
-        long mask = radix - 1;
+        int mask = radix - 1;
         do {
-            buf[--charPos] = Integer.digits[(int)(i & mask)];
-            i >>>= shift;
-        } while (i != 0);
-        return new String(buf, charPos, (64 - charPos));
+            buf[offset + --charPos] = Integer.digits[((int) val) & mask];
+            val >>>= shift;
+        } while (val != 0 && charPos > 0);
+
+        return charPos;
     }
 
     /**

src/share/classes/java/lang/management/ManagementFactory.java

 /*
- * Copyright (c) 2003, 2012, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -42,7 +42,9 @@ import javax.management.StandardMBean;
 import java.util.Collections;
 import java.util.List;
 import java.util.Set;
+import java.util.HashMap;
 import java.util.HashSet;
+import java.util.Map;
 import java.security.AccessController;
 import java.security.Permission;
 import java.security.PrivilegedAction;
@@ -482,6 +484,11 @@ public class ManagementFactory {
                     }
                 }
             }
+            HashMap<ObjectName, DynamicMBean> dynmbeans =
+                    ManagementFactoryHelper.getPlatformDynamicMBeans();
+            for (Map.Entry<ObjectName, DynamicMBean> e : dynmbeans.entrySet()) {
+                addDynamicMBean(platformMBeanServer, e.getValue(), e.getKey());
+            }
         }
         return platformMBeanServer;
     }
@@ -825,4 +832,24 @@ public class ManagementFactory {
         }
     }
 
+    /**
+     * Registers a DynamicMBean.
+     */
+    private static void addDynamicMBean(final MBeanServer mbs,
+                                        final DynamicMBean dmbean,
+                                        final ObjectName on) {
+        try {
+            AccessController.doPrivileged(new PrivilegedExceptionAction<Void>() {
+                @Override
+                public Void run() throws InstanceAlreadyExistsException,
+                                         MBeanRegistrationException,
+                                         NotCompliantMBeanException {
+                    mbs.registerMBean(dmbean, on);
+                    return null;
+                }
+            });
+        } catch (PrivilegedActionException e) {
+            throw new RuntimeException(e.getException());
+        }
+    }
 }

src/share/classes/java/net/HttpCookie.java

@@ -128,8 +128,7 @@ public final class HttpCookie implements Cloneable {
      *         a {@code String} specifying the value of the cookie
      *
      * @throws  IllegalArgumentException
-     *          if the cookie name contains illegal characters or it is one of
-     *          the tokens reserved for use by the cookie protocol
+     *          if the cookie name contains illegal characters
      * @throws  NullPointerException
      *          if {@code name} is {@code null}
      *
@@ -142,7 +141,7 @@ public final class HttpCookie implements Cloneable {
 
     private HttpCookie(String name, String value, String header) {
         name = name.trim();
-        if (name.length() == 0 || !isToken(name)) {
+        if (name.length() == 0 || !isToken(name) || name.charAt(0) == '$') {
             throw new IllegalArgumentException("Illegal cookie name");
         }
 
@@ -170,9 +169,8 @@ public final class HttpCookie implements Cloneable {
      * @return  a List of cookie parsed from header line string
      *
      * @throws  IllegalArgumentException
-     *          if header string violates the cookie specification's syntax, or
-     *          the cookie name contains illegal characters, or the cookie name
-     *          is one of the tokens reserved for use by the cookie protocol
+     *          if header string violates the cookie specification's syntax or
+     *          the cookie name contains illegal characters.
      * @throws  NullPointerException
      *          if the header string is {@code null}
      */

src/share/classes/java/net/HttpURLPermission.java

@@ -377,7 +377,7 @@ public final class HttpURLPermission extends Permission {
             throw new IllegalArgumentException ("unexpected URL scheme");
         }
         if (!u.getSchemeSpecificPart().equals("*")) {
-            u = URI.create(scheme + "://" + u.getAuthority() + u.getPath());
+            u = URI.create(scheme + "://" + u.getRawAuthority() + u.getRawPath());
         }
         return u;
     }

src/share/classes/java/nio/Buffer.java

@@ -25,6 +25,7 @@
 
 package java.nio;
 
+import java.util.Spliterator;
 
 /**
  * A container for data of a specific primitive type.
@@ -173,6 +174,13 @@ package java.nio;
 
 public abstract class Buffer {
 
+    /**
+     * The characteristics of Spliterators that traverse and split elements
+     * maintained in Buffers.
+     */
+    static final int SPLITERATOR_CHARACTERISTICS =
+        Spliterator.SIZED | Spliterator.SUBSIZED | Spliterator.ORDERED;
+
     // Invariants: mark <= position <= limit <= capacity
     private int mark = -1;
     private int position = 0;

src/share/classes/java/nio/ByteBufferAs-X-Buffer.java.template

@@ -115,6 +115,12 @@ class ByteBufferAs$Type$Buffer$RW$$BO$                  // package-private
         return Bits.get$Type$$BO$(bb, ix(checkIndex(i)));
     }
 
+#if[streamableType]
+   $type$ getUnchecked(int i) {
+        return Bits.get$Type$$BO$(bb, ix(i));
+    }
+#end[streamableType]
+
 #end[rw]
 
     public $Type$Buffer put($type$ x) {

src/share/classes/java/nio/CharBufferSpliterator.java

+/*
+ * Copyright (c) 2013, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+* particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package java.nio;
+
+import java.util.Comparator;
+import java.util.Spliterator;
+import java.util.function.IntConsumer;
+
+/**
+ * A Spliterator.OfInt for sources that traverse and split elements
+ * maintained in a CharBuffer.
+ *
+ * @implNote
+ * The implementation is based on the code for the Array-based spliterators.
+ */
+class CharBufferSpliterator implements Spliterator.OfInt {
+    private final CharBuffer buffer;
+    private int index;   // current index, modified on advance/split
+    private final int limit;
+
+    CharBufferSpliterator(CharBuffer buffer) {
+        this(buffer, buffer.position(), buffer.limit());
+    }
+
+    CharBufferSpliterator(CharBuffer buffer, int origin, int limit) {
+        assert origin <= limit;
+        this.buffer = buffer;
+        this.index = (origin <= limit) ? origin : limit;
+        this.limit = limit;
+    }
+
+    @Override
+    public OfInt trySplit() {
+        int lo = index, mid = (lo + limit) >>> 1;
+        return (lo >= mid)
+               ? null
+               : new CharBufferSpliterator(buffer, lo, index = mid);
+    }
+
+    @Override
+    public void forEachRemaining(IntConsumer action) {
+        if (action == null)
+            throw new NullPointerException();
+        CharBuffer cb = buffer;
+        int i = index;
+        int hi = limit;
+        index = hi;
+        while (i < hi) {
+            action.accept(cb.getUnchecked(i++));
+        }
+    }
+
+    @Override
+    public boolean tryAdvance(IntConsumer action) {
+        if (action == null)
+            throw new NullPointerException();
+        if (index >= 0 && index < limit) {
+            action.accept(buffer.getUnchecked(index++));
+            return true;
+        }
+        return false;
+    }
+
+    @Override
+    public long estimateSize() {
+        return (long)(limit - index);
+    }
+
+    @Override
+    public int characteristics() {
+        return Buffer.SPLITERATOR_CHARACTERISTICS;
+    }
+}

src/share/classes/java/nio/Direct-X-Buffer.java.template

@@ -253,6 +253,12 @@ class Direct$Type$Buffer$RW$$BO$
         return $fromBits$($swap$(unsafe.get$Swaptype$(ix(checkIndex(i)))));
     }
 
+#if[streamableType]
+    $type$ getUnchecked(int i) {
+        return $fromBits$($swap$(unsafe.get$Swaptype$(ix(i))));
+    }
+#end[streamableType]
+
     public $Type$Buffer get($type$[] dst, int offset, int length) {
 #if[rw]
         if ((length << $LG_BYTES_PER_VALUE$) > Bits.JNI_COPY_TO_ARRAY_THRESHOLD) {

src/share/classes/java/nio/Heap-X-Buffer.java.template

@@ -139,6 +139,12 @@ class Heap$Type$Buffer$RW$
         return hb[ix(checkIndex(i))];
     }
 
+#if[streamableType]
+    $type$ getUnchecked(int i) {
+	return hb[ix(i)];
+    }
+#end[streamableType]
+
     public $Type$Buffer get($type$[] dst, int offset, int length) {
         checkBounds(offset, length, dst.length);
         if (length > remaining())

src/share/classes/java/nio/StringCharBuffer.java

@@ -77,6 +77,10 @@ class StringCharBuffer                                  // package-private
         return str.charAt(checkIndex(index) + offset);
     }
 
+    char getUnchecked(int index) {
+        return str.charAt(index + offset);
+    }
+
     // ## Override bulk get methods for better performance
 
     public final CharBuffer put(char c) {

src/share/classes/java/nio/X-Buffer.java.template

@@ -30,6 +30,11 @@ package java.nio;
 #if[char]
 import java.io.IOException;
 #end[char]
+#if[streamableType]
+import java.util.Spliterator;
+import java.util.stream.StreamSupport;
+import java.util.stream.$Streamtype$Stream;
+#end[streamableType]
 
 /**
  * $A$ $type$ buffer.
@@ -589,6 +594,19 @@ public abstract class $Type$Buffer
      */
     public abstract $type$ get(int index);
 
+#if[streamableType]
+    /**
+     * Absolute <i>get</i> method.  Reads the $type$ at the given
+     * index without any validation of the index.
+     *
+     * @param  index
+     *         The index from which the $type$ will be read
+     *
+     * @return  The $type$ at the given index
+     */
+    abstract $type$ getUnchecked(int index);   // package-private
+#end[streamableType]
+
     /**
      * Absolute <i>put</i> method&nbsp;&nbsp;<i>(optional operation)</i>.
      *
@@ -1458,4 +1476,16 @@ public abstract class $Type$Buffer
 
 #end[byte]
 
+#if[streamableType]
+
+#if[char]
+    @Override
+#end[char]
+    public $Streamtype$Stream $type$s() {
+        return StreamSupport.$streamtype$Stream(() -> new $Type$BufferSpliterator(this),
+            Buffer.SPLITERATOR_CHARACTERISTICS);
+    }
+
+#end[streamableType]
+
 }

src/share/classes/java/security/AccessController.java

@@ -82,9 +82,15 @@ import sun.reflect.Reflection;
  *     else if (caller i is marked as privileged) {
  *         if (a context was specified in the call to doPrivileged)
  *             context.checkPermission(permission)
+ *         if (limited permissions were specified in the call to doPrivileged) {
+ *             for (each limited permission) {
+ *                 if (the limited permission implies the requested permission)
  *                     return;
  *             }
- * };
+ *         } else
+ *             return;
+ *     }
+ * }
  *
  * // Next, check the context inherited when the thread was created.
  * // Whenever a new thread is created, the AccessControlContext at
@@ -101,11 +107,16 @@ import sun.reflect.Reflection;
  * was marked as "privileged" via a <code>doPrivileged</code>
  * call without a context argument (see below for information about a
  * context argument). If that caller's domain has the
- * specified permission, no further checking is done and
+ * specified permission and at least one limiting permission argument (if any)
+ * implies the requested permission, no further checking is done and
  * <code>checkPermission</code>
  * returns quietly, indicating that the requested access is allowed.
  * If that domain does not have the specified permission, an exception
- * is thrown, as usual.
+ * is thrown, as usual. If the caller's domain had the specified permission
+ * but it was not implied by any limiting permission arguments given in the call
+ * to <code>doPrivileged</code> then the permission checking continues
+ * until there are no more callers or another <code>doPrivileged</code>
+ * call matches the requested permission and returns normally.
  *
  * <p> The normal use of the "privileged" feature is as follows. If you
  * don't need to return a value from within the "privileged" block, do
@@ -180,6 +191,9 @@ import sun.reflect.Reflection;
  *
  * <p> Be *very* careful in your use of the "privileged" construct, and
  * always remember to make the privileged code section as small as possible.
+ * You can pass <code>Permission</code> arguments to further limit the
+ * scope of the "privilege" (see below).
+ *
  *
  * <p> Note that <code>checkPermission</code> always performs security checks
  * within the context of the currently executing thread.
@@ -215,7 +229,9 @@ import sun.reflect.Reflection;
  *
  * <p> There are also times where you don't know a priori which permissions
  * to check the context against. In these cases you can use the
- * doPrivileged method that takes a context:
+ * doPrivileged method that takes a context. You can also limit the scope
+ * of the privileged code by passing additional <code>Permission</code>
+ * parameters.
  *
  *  <pre> {@code
  * somemethod() {
@@ -223,12 +239,21 @@ import sun.reflect.Reflection;
  *         public Object run() {
  *             // Code goes here. Any permission checks within this
  *             // run method will require that the intersection of the
- *             // callers protection domain and the snapshot's
- *             // context have the desired permission.
+ *             // caller's protection domain and the snapshot's
+ *             // context have the desired permission. If a requested
+ *             // permission is not implied by the limiting FilePermission
+ *             // argument then checking of the thread continues beyond the
+ *             // caller of doPrivileged.
  *         }
- *     }, acc);
+ *     }, acc, new FilePermission("/temp/*", read));
  *     ...normal code here...
  * }}</pre>
+ * <p> Passing a limiting <code>Permission</code> argument of an instance of
+ * <code>AllPermission</code> is equivalent to calling the equivalent
+ * <code>doPrivileged</code> method without limiting <code>Permission</code>
+ * arguments. Passing a zero length array of <code>Permission</code> disables
+ * the code privileges so that checking always continues beyond the caller of
+ * that <code>doPrivileged</code> method.
  *
  * @see AccessControlContext
  *
@@ -334,6 +359,112 @@ public final class AccessController {
     public static native <T> T doPrivileged(PrivilegedAction<T> action,
                                             AccessControlContext context);
 
+
+    /**
+     * Performs the specified <code>PrivilegedAction</code> with privileges
+     * enabled and restricted by the specified
+     * <code>AccessControlContext</code> and with a privilege scope limited
+     * by specified <code>Permission</code> arguments.
+     *
+     * The action is performed with the intersection of the permissions
+     * possessed by the caller's protection domain, and those possessed
+     * by the domains represented by the specified
+     * <code>AccessControlContext</code>.
+     * <p>
+     * If the action's <code>run</code> method throws an (unchecked) exception,
+     * it will propagate through this method.
+     *
+     * @param action the action to be performed.
+     * @param context an <i>access control context</i>
+     *                representing the restriction to be applied to the
+     *                caller's domain's privileges before performing
+     *                the specified action.  If the context is
+     *                <code>null</code>,
+     *                then no additional restriction is applied.
+     * @param perms the <code>Permission</code> arguments which limit the
+     *              scope of the caller's privileges. The number of arguments
+     *              is variable.
+     *
+     * @return the value returned by the action's <code>run</code> method.
+     *
+     * @throws NullPointerException if action or perms or any element of
+     *         perms is <code>null</code>
+     *
+     * @see #doPrivileged(PrivilegedAction)
+     * @see #doPrivileged(PrivilegedExceptionAction,AccessControlContext)
+     *
+     * @since 1.8
+     */
+    @CallerSensitive
+    public static <T> T doPrivileged(PrivilegedAction<T> action,
+        AccessControlContext context, Permission... perms) {
+
+        AccessControlContext parent = getContext();
+        if (perms == null) {
+            throw new NullPointerException("null permissions parameter");
+        }
+        Class <?> caller = Reflection.getCallerClass();
+        return AccessController.doPrivileged(action, createWrapper(null,
+            caller, parent, context, perms));
+    }
+
+
+    /**
+     * Performs the specified <code>PrivilegedAction</code> with privileges
+     * enabled and restricted by the specified
+     * <code>AccessControlContext</code> and with a privilege scope limited
+     * by specified <code>Permission</code> arguments.
+     *
+     * The action is performed with the intersection of the permissions
+     * possessed by the caller's protection domain, and those possessed
+     * by the domains represented by the specified
+     * <code>AccessControlContext</code>.
+     * <p>
+     * If the action's <code>run</code> method throws an (unchecked) exception,
+     * it will propagate through this method.
+     *
+     * <p> This method preserves the current AccessControlContext's
+     * DomainCombiner (which may be null) while the action is performed.
+     *
+     * @param action the action to be performed.
+     * @param context an <i>access control context</i>
+     *                representing the restriction to be applied to the
+     *                caller's domain's privileges before performing
+     *                the specified action.  If the context is
+     *                <code>null</code>,
+     *                then no additional restriction is applied.
+     * @param perms the <code>Permission</code> arguments which limit the
+     *              scope of the caller's privileges. The number of arguments
+     *              is variable.
+     *
+     * @return the value returned by the action's <code>run</code> method.
+     *
+     * @throws NullPointerException if action or perms or any element of
+     *         perms is <code>null</code>
+     *
+     * @see #doPrivileged(PrivilegedAction)
+     * @see #doPrivileged(PrivilegedExceptionAction,AccessControlContext)
+     * @see java.security.DomainCombiner
+     *
+     * @since 1.8
+     */
+    @CallerSensitive
+    public static <T> T doPrivilegedWithCombiner(PrivilegedAction<T> action,
+        AccessControlContext context, Permission... perms) {
+
+        AccessControlContext parent = getContext();
+        DomainCombiner dc = parent.getCombiner();
+        if (dc == null && context != null) {
+            dc = context.getCombiner();
+        }
+        if (perms == null) {
+            throw new NullPointerException("null permissions parameter");
+        }
+        Class <?> caller = Reflection.getCallerClass();
+        return AccessController.doPrivileged(action, createWrapper(dc, caller,
+            parent, context, perms));
+    }
+
     /**
      * Performs the specified <code>PrivilegedExceptionAction</code> with
      * privileges enabled.  The action is performed with <i>all</i> of the
@@ -408,6 +539,22 @@ public final class AccessController {
     private static AccessControlContext preserveCombiner(DomainCombiner combiner,
                                                          Class<?> caller)
     {
+        return createWrapper(combiner, caller, null, null, null);
+    }
+
+    /**
+     * Create a wrapper to contain the limited privilege scope data.
+     */
+    private static AccessControlContext
+        createWrapper(DomainCombiner combiner, Class<?> caller,
+                      AccessControlContext parent, AccessControlContext context,
+                      Permission[] perms)
+    {
+        return new AccessControlContext(getCallerPD(caller), combiner, parent,
+                                        context, perms);
+    }
+
+    private static ProtectionDomain getCallerPD(final Class <?> caller) {
         ProtectionDomain callerPd = doPrivileged
             (new PrivilegedAction<ProtectionDomain>() {
             public ProtectionDomain run() {
@@ -415,18 +562,9 @@ public final class AccessController {
             }
         });
 
-        // perform 'combine' on the caller of doPrivileged,
-        // even if the caller is from the bootclasspath
-        ProtectionDomain[] pds = new ProtectionDomain[] {callerPd};
-        if (combiner == null) {
-            return new AccessControlContext(pds);
-        } else {
-            return new AccessControlContext(combiner.combine(pds, null),
-                                            combiner);
-        }
+        return callerPd;
     }
 
-
     /**
      * Performs the specified <code>PrivilegedExceptionAction</code> with
      * privileges enabled and restricted by the specified
@@ -454,7 +592,7 @@ public final class AccessController {
      * @exception NullPointerException if the action is <code>null</code>
      *
      * @see #doPrivileged(PrivilegedAction)
-     * @see #doPrivileged(PrivilegedExceptionAction,AccessControlContext)
+     * @see #doPrivileged(PrivilegedAction,AccessControlContext)
      */
     @CallerSensitive
     public static native <T> T
@@ -462,6 +600,118 @@ public final class AccessController {
                      AccessControlContext context)
         throws PrivilegedActionException;
 
+
+    /**
+     * Performs the specified <code>PrivilegedExceptionAction</code> with
+     * privileges enabled and restricted by the specified
+     * <code>AccessControlContext</code> and with a privilege scope limited by
+     * specified <code>Permission</code> arguments.
+     *
+     * The action is performed with the intersection of the permissions
+     * possessed by the caller's protection domain, and those possessed
+     * by the domains represented by the specified
+     * <code>AccessControlContext</code>.
+     * <p>
+     * If the action's <code>run</code> method throws an (unchecked) exception,
+     * it will propagate through this method.
+     *
+     * @param action the action to be performed.
+     * @param context an <i>access control context</i>
+     *                representing the restriction to be applied to the
+     *                caller's domain's privileges before performing
+     *                the specified action.  If the context is
+     *                <code>null</code>,
+     *                then no additional restriction is applied.
+     * @param perms the <code>Permission</code> arguments which limit the
+     *              scope of the caller's privileges. The number of arguments
+     *              is variable.
+     *
+     * @return the value returned by the action's <code>run</code> method.
+     *
+     * @throws PrivilegedActionException if the specified action's
+     *         <code>run</code> method threw a <i>checked</i> exception
+     * @throws NullPointerException if action or perms or any element of
+     *         perms is <code>null</code>
+     *
+     * @see #doPrivileged(PrivilegedAction)
+     * @see #doPrivileged(PrivilegedAction,AccessControlContext)
+     *
+     * @since 1.8
+     */
+    @CallerSensitive
+    public static <T> T doPrivileged(PrivilegedExceptionAction<T> action,
+                                     AccessControlContext context, Permission... perms)
+        throws PrivilegedActionException
+    {
+        AccessControlContext parent = getContext();
+        if (perms == null) {
+            throw new NullPointerException("null permissions parameter");
+        }
+        Class <?> caller = Reflection.getCallerClass();
+        return AccessController.doPrivileged(action, createWrapper(null, caller, parent, context, perms));
+    }
+
+
+    /**
+     * Performs the specified <code>PrivilegedExceptionAction</code> with
+     * privileges enabled and restricted by the specified
+     * <code>AccessControlContext</code> and with a privilege scope limited by
+     * specified <code>Permission</code> arguments.
+     *
+     * The action is performed with the intersection of the permissions
+     * possessed by the caller's protection domain, and those possessed
+     * by the domains represented by the specified
+     * <code>AccessControlContext</code>.
+     * <p>
+     * If the action's <code>run</code> method throws an (unchecked) exception,
+     * it will propagate through this method.
+     *
+     * <p> This method preserves the current AccessControlContext's
+     * DomainCombiner (which may be null) while the action is performed.
+     *
+     * @param action the action to be performed.
+     * @param context an <i>access control context</i>
+     *                representing the restriction to be applied to the
+     *                caller's domain's privileges before performing
+     *                the specified action.  If the context is
+     *                <code>null</code>,
+     *                then no additional restriction is applied.
+     * @param perms the <code>Permission</code> arguments which limit the
+     *              scope of the caller's privileges. The number of arguments
+     *              is variable.
+     *
+     * @return the value returned by the action's <code>run</code> method.
+     *
+     * @throws PrivilegedActionException if the specified action's
+     *         <code>run</code> method threw a <i>checked</i> exception
+     * @throws NullPointerException if action or perms or any element of
+     *         perms is <code>null</code>
+     *
+     * @see #doPrivileged(PrivilegedAction)
+     * @see #doPrivileged(PrivilegedAction,AccessControlContext)
+     * @see java.security.DomainCombiner
+     *
+     * @since 1.8
+     */
+    @CallerSensitive
+    public static <T> T doPrivilegedWithCombiner(PrivilegedExceptionAction<T> action,
+                                                 AccessControlContext context,
+                                                 Permission... perms)
+        throws PrivilegedActionException
+    {
+        AccessControlContext parent = getContext();
+        DomainCombiner dc = parent.getCombiner();
+        if (dc == null && context != null) {
+            dc = context.getCombiner();
+        }
+        if (perms == null) {
+            throw new NullPointerException("null permissions parameter");
+        }
+        Class <?> caller = Reflection.getCallerClass();
+        return AccessController.doPrivileged(action, createWrapper(dc, caller,
+            parent, context, perms));
+    }
+
     /**
      * Returns the AccessControl context. i.e., it gets
      * the protection domains of all the callers on the stack,
@@ -474,6 +724,7 @@ public final class AccessController {
 
     private static native AccessControlContext getStackAccessControlContext();
 
+
     /**
      * Returns the "inherited" AccessControl context. This is the context
      * that existed when the thread was created. Package private so
@@ -484,9 +735,9 @@ public final class AccessController {
 
     /**
      * This method takes a "snapshot" of the current calling context, which
-     * includes the current Thread's inherited AccessControlContext,
-     * and places it in an AccessControlContext object. This context may then
-     * be checked at a later point, possibly in another thread.
+     * includes the current Thread's inherited AccessControlContext and any
+     * limited privilege scope, and places it in an AccessControlContext object.
+     * This context may then be checked at a later point, possibly in another thread.
      *
      * @see AccessControlContext
      *

src/share/classes/java/security/DigestOutputStream.java

 /*
- * Copyright (c) 1996, 1999, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -112,10 +112,10 @@ public class DigestOutputStream extends FilterOutputStream {
      * @see MessageDigest#update(byte)
      */
     public void write(int b) throws IOException {
+        out.write(b);
         if (on) {
             digest.update((byte)b);
         }
-        out.write(b);
     }
 
     /**
@@ -142,10 +142,10 @@ public class DigestOutputStream extends FilterOutputStream {
      * @see MessageDigest#update(byte[], int, int)
      */
     public void write(byte[] b, int off, int len) throws IOException {
+        out.write(b, off, len);
         if (on) {
             digest.update(b, off, len);
         }
-        out.write(b, off, len);
     }
 
     /**

src/share/classes/java/util/Hashtable.java

@@ -180,7 +180,17 @@ public class Hashtable<K,V>
          */
         static final long HASHSEED_OFFSET;
 
+        static final boolean USE_HASHSEED;
+
         static {
+            String hashSeedProp = java.security.AccessController.doPrivileged(
+                    new sun.security.action.GetPropertyAction(
+                        "jdk.map.useRandomSeed"));
+            boolean localBool = (null != hashSeedProp)
+                    ? Boolean.parseBoolean(hashSeedProp) : false;
+            USE_HASHSEED = localBool;
+
+            if (USE_HASHSEED) {
                 try {
                     UNSAFE = sun.misc.Unsafe.getUnsafe();
                     HASHSEED_OFFSET = UNSAFE.objectFieldOffset(
@@ -188,27 +198,34 @@ public class Hashtable<K,V>
                 } catch (NoSuchFieldException | SecurityException e) {
                     throw new InternalError("Failed to record hashSeed offset", e);
                 }
+            } else {
+                UNSAFE = null;
+                HASHSEED_OFFSET = 0;
+            }
         }
     }
 
     /**
      * A randomizing value associated with this instance that is applied to
      * hash code of keys to make hash collisions harder to find.
+     *
+     * Non-final so it can be set lazily, but be sure not to set more than once.
      */
-    transient final int hashSeed = sun.misc.Hashing.randomHashSeed(this);
+    transient final int hashSeed;
 
-    private int hash(Object k) {
-        if (k instanceof String) {
-            return ((String)k).hash32();
+    /**
+     * Return an initial value for the hashSeed, or 0 if the random seed is not
+     * enabled.
+     */
+    final int initHashSeed() {
+        if (sun.misc.VM.isBooted() && Holder.USE_HASHSEED) {
+            return sun.misc.Hashing.randomHashSeed(this);
+        }
+        return 0;
     }
 
-        int h = hashSeed ^ k.hashCode();
-
-        // This function ensures that hashCodes that differ only by
-        // constant multiples at each bit position have a bounded
-        // number of collisions (approximately 8 at default load factor).
-        h ^= (h >>> 20) ^ (h >>> 12);
-        return h ^ (h >>> 7) ^ (h >>> 4);
+    private int hash(Object k) {
+        return hashSeed ^ k.hashCode();
     }
 
     /**
@@ -232,6 +249,7 @@ public class Hashtable<K,V>
         this.loadFactor = loadFactor;
         table = new Entry<?,?>[initialCapacity];
         threshold = (int)Math.min(initialCapacity * loadFactor, MAX_ARRAY_SIZE + 1);
+        hashSeed = initHashSeed();
     }
 
     /**
@@ -1187,8 +1205,10 @@ public class Hashtable<K,V>
         s.defaultReadObject();
 
         // set hashMask
+        if (Holder.USE_HASHSEED) {
             Holder.UNSAFE.putIntVolatile(this, Holder.HASHSEED_OFFSET,
                     sun.misc.Hashing.randomHashSeed(this));
+        }
 
         // Read the original length of the array and number of elements
         int origlength = s.readInt();

src/share/classes/java/util/IntSummaryStatistics.java

@@ -159,7 +159,7 @@ public class IntSummaryStatistics implements IntConsumer {
      */
     public String toString() {
         return String.format(
-            "%s{count=%d, sum=%d, min=%d, average=%d, max=%d}",
+            "%s{count=%d, sum=%d, min=%d, average=%f, max=%d}",
             this.getClass().getSimpleName(),
             getCount(),
             getSum(),

src/share/classes/java/util/LongSummaryStatistics.java

@@ -171,7 +171,7 @@ public class LongSummaryStatistics implements LongConsumer, IntConsumer {
      */
     public String toString() {
         return String.format(
-            "%s{count=%d, sum=%d, min=%d, average=%d, max=%d}",
+            "%s{count=%d, sum=%d, min=%d, average=%f, max=%d}",
             this.getClass().getSimpleName(),
             getCount(),
             getSum(),

src/share/classes/java/util/PrimitiveIterator.java

@@ -91,6 +91,7 @@ public interface PrimitiveIterator<T> extends Iterator<T> {
          * @throws NullPointerException if the specified action is null
          */
         default void forEachRemaining(IntConsumer action) {
+            Objects.requireNonNull(action);
             while (hasNext())
                 action.accept(nextInt());
         }
@@ -123,6 +124,8 @@ public interface PrimitiveIterator<T> extends Iterator<T> {
                 forEachRemaining((IntConsumer) action);
             }
             else {
+                // The method reference action::accept is never null
+                Objects.requireNonNull(action);
                 if (Tripwire.ENABLED)
                     Tripwire.trip(getClass(), "{0} calling PrimitiveIterator.OfInt.forEachRemainingInt(action::accept)");
                 forEachRemaining((IntConsumer) action::accept);
@@ -162,6 +165,7 @@ public interface PrimitiveIterator<T> extends Iterator<T> {
          * @throws NullPointerException if the specified action is null
          */
         default void forEachRemaining(LongConsumer action) {
+            Objects.requireNonNull(action);
             while (hasNext())
                 action.accept(nextLong());
         }
@@ -194,6 +198,8 @@ public interface PrimitiveIterator<T> extends Iterator<T> {
                 forEachRemaining((LongConsumer) action);
             }
             else {
+                // The method reference action::accept is never null
+                Objects.requireNonNull(action);
                 if (Tripwire.ENABLED)
                     Tripwire.trip(getClass(), "{0} calling PrimitiveIterator.OfLong.forEachRemainingLong(action::accept)");
                 forEachRemaining((LongConsumer) action::accept);
@@ -232,6 +238,7 @@ public interface PrimitiveIterator<T> extends Iterator<T> {
          * @throws NullPointerException if the specified action is null
          */
         default void forEachRemaining(DoubleConsumer action) {
+            Objects.requireNonNull(action);
             while (hasNext())
                 action.accept(nextDouble());
         }
@@ -265,6 +272,8 @@ public interface PrimitiveIterator<T> extends Iterator<T> {
                 forEachRemaining((DoubleConsumer) action);
             }
             else {
+                // The method reference action::accept is never null
+                Objects.requireNonNull(action);
                 if (Tripwire.ENABLED)
                     Tripwire.trip(getClass(), "{0} calling PrimitiveIterator.OfDouble.forEachRemainingDouble(action::accept)");
                 forEachRemaining((DoubleConsumer) action::accept);