--- a/.hgtags	Mon Jul 04 14:29:08 2016 -0700
+++ b/.hgtags	Tue Jul 05 15:10:45 2016 -0700
@@ -384,6 +384,7 @@
 bd0186cd2419129357b110fe3f13519f68b29774 jdk8u40-b27
 28a1dbd4bb9ec97427790c88d21514af2f878c94 jdk8u40-b31
 663a3151c688bc3f4c092bcad21cc81e29139d62 jdk8u40-b32
+5b700e0c00471ba1b7575fc6d03d6b0a0e041b50 jdk8u40-b33
 5761efbc739fdedcbff224e22f920e88b29af4cf jdk8u45-b00
 6a52852476c9ccb2d52153d1b94b675e863bb28c jdk8u45-b01
 3b9d342f9f584465ea5976e06357b45682f9681d jdk8u45-b02
@@ -542,6 +543,19 @@
 0ce690c17329bde61998e5cd30b1beec9872262f jdk8u74-b01
 5eb60567655e15d7ba4c349658d707f5bde0c2b8 jdk8u74-b02
 d82cbb7a4bfe21b146f7b91ce833ac5a579c94eb jdk8u72-b31
+e3b496b6ae52f2c018e9c628c31be984bb4907e7 jdk8u73-b00
+5e484ab4b05f1398e924ab90874f7fe2ddf20731 jdk8u73-b01
+0cfcffb354bb4c76cac46f52b16a50e3b57794b9 jdk8u73-b02
+9e88cf03fe09fbf33045f43489be6f9c00e80c35 jdk8u74-b00
+0ce690c17329bde61998e5cd30b1beec9872262f jdk8u74-b01
+5eb60567655e15d7ba4c349658d707f5bde0c2b8 jdk8u74-b02
+3d00f5689b6c6e71fb1a230b7a746b61569b90ec jdk8u74-b31
+0cec2665affa36496b906c566e22ba7048ae6087 jdk8u74-b32
+7b719c1dec62535c34030cf3457abe6f478f13a0 jdk8u77-b00
+cafc1648f432eff2c392040af2db4505c3d290b6 jdk8u77-b01
+0f0077ee5e53365562ff77a01aa97d0c7374f447 jdk8u77-b02
+e8dc6eb11c761f20b44d8c4b8acb0846268872f1 jdk8u77-b03
+af6ddd4cd94c9353cc053b888de6d42d4d0faf47 jdk8u77-b31
 073b951904b3ee7c54fb79a169478fa66d925320 jdk8u75-b00
 5b48f7defe40eab668fe554df0afd87d84d60722 jdk8u75-b01
 0015f4a7f0d02a9bb79b7a0c737590f01feaabd4 jdk8u75-b02
@@ -561,6 +575,7 @@
 cd7cec8fd295c0462a813b5f54dc5457c2bade2d jdk8u91-b00
 4ea02753e66e348ee4639e157061bcbdef1d7ff3 jdk8u91-b13
 f8d0cfaa9900ebda679fa9df8319fb753858f283 jdk8u91-b14
+9f89788050d38ba4e19e24894eb8b3dd24c1a9d0 jdk8u91-b15
 7b719c1dec62535c34030cf3457abe6f478f13a0 jdk8u77-b00
 cafc1648f432eff2c392040af2db4505c3d290b6 jdk8u77-b01
 0f0077ee5e53365562ff77a01aa97d0c7374f447 jdk8u77-b02
@@ -581,12 +596,71 @@
 e0fbd6a51e061025f2d6ad0311a587f7ce3c2b43 jdk8u92-b00
 8f0466c0dce60b1df3bc01785b01a7f09fa7b564 jdk8u92-b13
 5617f9bec354fb2c60bbb816d175f4cee7d2c56e jdk8u92-b14
+fe88377e18b0c5f3da8e6741e0d5b9bfd45d2648 jdk8u92-b31
+073b951904b3ee7c54fb79a169478fa66d925320 jdk8u75-b00
+5b48f7defe40eab668fe554df0afd87d84d60722 jdk8u75-b01
+0015f4a7f0d02a9bb79b7a0c737590f01feaabd4 jdk8u75-b02
+74b2903babf0f4138c367e3f9eea8958f5d71b94 jdk8u75-b03
+aa99436ccf826b3a2eecdaf646814e58cf514efb jdk8u101-b00
+aa99436ccf826b3a2eecdaf646814e58cf514efb jdk8u75-b04
+e4dd4a6a2e67aa42d1e22246216f56a5280f83fb jdk8u75-b05
+6ca185377097c44ee1768f2f817b1b9e3b89068c jdk8u75-b06
+77880a70d92dbfc0ab1dab1aefad179c711ea852 jdk8u75-b07
+d267b16e3ecc006200ec6478904b7ea119df5b19 jdk8u75-b08
+1030aea873cdecfb6f55ab652abc67c901f61f60 jdk8u75-b09
+964fe4bba121592325cb346e3a4fa677b277d0ec jdk8u75-b10
+f7cfd44464c3c3efd6d6f29921fad4ed0de75d83 jdk8u75-b12
+7b719c1dec62535c34030cf3457abe6f478f13a0 jdk8u77-b00
+cafc1648f432eff2c392040af2db4505c3d290b6 jdk8u77-b01
+0f0077ee5e53365562ff77a01aa97d0c7374f447 jdk8u77-b02
+e8dc6eb11c761f20b44d8c4b8acb0846268872f1 jdk8u77-b03
+cd7cec8fd295c0462a813b5f54dc5457c2bade2d jdk8u91-b00
+4ea02753e66e348ee4639e157061bcbdef1d7ff3 jdk8u91-b13
+7deeb4f70404e4f52306f9d0bcfc482fc5f16fb3 jdk8u76-b00
+5786892e7c7d512ef9104a469ff7eafeaac12c38 jdk8u76-b01
+239155e48af89968b62e695a3233d42bed1a3282 jdk8u76-b02
+137e5c45fd5422ecd6c758c6b83a2f184abef91b jdk8u76-b03
+7bbceb589f5ddb6eefab2b23de0003de67cfc667 jdk8u76-b04
+ca66a2dd5cfd6d4d0d05ee9861ff3cadd7166761 jdk8u76-b05
+f8453e7a3185060e5625127fe76b5cd7ae64150a jdk8u76-b06
+dd1d572083b0b11f70f03408f6bb154bbdef4272 jdk8u76-b07
+fc122918583747b114b246babc82841a827c56c7 jdk8u76-b08
+afb55372bcc787b75e24afd28b00cfaaa45bb77d jdk8u76-b09
+d2f26e6433db89354b028fb75abcc6ca266d035f jdk8u76-b10
+df2dcefb08f9e3c65a4cbea75e54600649d063d0 jdk8u76-b11
+94c775e05eb053b8440d82298927a144ed73f340 jdk8u76-b12
+e0fbd6a51e061025f2d6ad0311a587f7ce3c2b43 jdk8u92-b00
+8f0466c0dce60b1df3bc01785b01a7f09fa7b564 jdk8u92-b13
+aa99436ccf826b3a2eecdaf646814e58cf514efb jdk8u81-b00
+8674aec1be6459f33451690fb106eec314964116 jdk8u101-b01
+96a43945cb6a69989294b511ecdfc0493ea09bf1 jdk8u101-b02
+371b0c5477d8613c06fd1206deed27759f18e42e jdk8u101-b03
+52cca1ce8b473ecd751da2350d4b3ef111b5676e jdk8u101-b04
+3edb6296456161d67bf33a73faf18dc57ef548de jdk8u101-b05
+37bd092c2a7a9e71c027a33757429e02e00050de jdk8u101-b06
+df3cd274d224e22e156556bc0d7b8927b72a7608 jdk8u101-b07
+b8914ce62047d20076a64fd43a6ca8f5bb470047 jdk8u101-b08
+317ccda98b74d445f6d3b241783a22cc167cedbf jdk8u101-b09
+7c90acc432738bdc1506d510daeadf9376279dfa jdk8u101-b10
+4942432b3da1afbc2c2c87bdf896b112800e537c jdk8u101-b11
+f8511bfb19c35d8d396dc53245c06cc3710657b1 jdk8u101-b12
+2bb2aec4b3e51aab96e9c25603c7c92fcbac46de jdk8u101-b13
 223d0e48a55b92255f5a613743a99e7deacaf455 jdk8u102-b00
 223d0e48a55b92255f5a613743a99e7deacaf455 jdk8u82-b00
 9d09a2f1395561fe71b1a83f53907ddc52e699d6 jdk8u102-b01
 564fbe28cbb0ff2e6f55623807ea816042de00ff jdk8u102-b02
 ab7dbd58a766fb01c6643f3a80c9e96ac1278a06 jdk8u102-b03
 626d8fa7a1bfd9e65b94117a526ba57b25ec3d14 jdk8u102-b04
+3c35b66b5345f615a3ff626111587c452c8c3893 jdk8u102-b05
+2a265ab91dd234348630dab92f622a616ab76a0e jdk8u102-b06
+8d44271dd11dd4bdc88ef647fd144e544791ecc4 jdk8u102-b07
+329501e6cc220884f005afc7cd330e227931fb21 jdk8u102-b08
+e108e30edcca932832e4e5edf1a15349d3be2fed jdk8u102-b09
+e0d70741f35cd16289de3fd6049834879725dae5 jdk8u102-b10
+360a2772486dd1aa818132222ea0b7fcfa5707ef jdk8u102-b11
+57546b5b575dec9ecfbb1e9a77d87c391a44ab96 jdk8u102-b12
+a7c292080d5ed76ea5e3b123c0dee4c340aa174f jdk8u102-b13
+56b133772ec1aa4f44f2eee2c4103c645f764935 jdk8u102-b14
 b87d82f5c33dfb55bfc81254044f28eea5d7424a jdk8u112-b00
 1f2394102288d9073652064784e31a3f52fc5d4b jdk8u112-b01
 40c934289deefd68915f6519d71a4e315c69117a jdk8u112-b02

--- a/src/share/classes/com/sun/corba/se/impl/orbutil/ORBUtility.java	Mon Jul 04 14:29:08 2016 -0700
+++ b/src/share/classes/com/sun/corba/se/impl/orbutil/ORBUtility.java	Tue Jul 05 15:10:45 2016 -0700
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -34,21 +34,13 @@
 import java.security.Policy;
 import java.security.PrivilegedAction;
 import java.security.ProtectionDomain;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Map;
-import java.util.List;
-import java.util.ListIterator;
-import java.util.Set;
-import java.util.Map.Entry;
-import java.util.Collection;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Hashtable;
 import java.util.Iterator;
 import java.util.Enumeration;
-import java.util.Properties;
-import java.util.IdentityHashMap;
 import java.util.StringTokenizer;
 import java.util.NoSuchElementException;
 
@@ -165,8 +157,18 @@
      * Return default ValueHandler
      */
     public static ValueHandler createValueHandler() {
+        ValueHandler vh;
+        try {
+            vh = AccessController.doPrivileged(new PrivilegedExceptionAction<ValueHandler>() {
+                public ValueHandler run() throws Exception {
         return Util.createValueHandler();
     }
+            });
+        } catch (PrivilegedActionException e) {
+            throw new InternalError(e.getMessage());
+        }
+        return vh;
+    }
 
     /**
      * Returns true if it was accurately determined that the remote ORB is
@@ -664,7 +666,16 @@
      * ValueHandler.
      */
     public static byte getMaxStreamFormatVersion() {
-        ValueHandler vh = Util.createValueHandler();
+        ValueHandler vh;
+        try {
+            vh = AccessController.doPrivileged(new PrivilegedExceptionAction<ValueHandler>() {
+                public ValueHandler run() throws Exception {
+                    return Util.createValueHandler();
+                }
+            });
+        } catch (PrivilegedActionException e) {
+            throw new InternalError(e.getMessage());
+        }
 
         if (!(vh instanceof javax.rmi.CORBA.ValueHandlerMultiFormat))
             return ORBConstants.STREAM_FORMAT_VERSION_1;

--- a/src/share/classes/com/sun/corba/se/impl/orbutil/resources/sunorb_zh_TW.properties	Mon Jul 04 14:29:08 2016 -0700
+++ b/src/share/classes/com/sun/corba/se/impl/orbutil/resources/sunorb_zh_TW.properties	Tue Jul 05 15:10:45 2016 -0700
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -103,5 +103,5 @@
 tnameserv.hs3=\u5C31\u7DD2\u3002
 
 orbd.commfailure=\n\u56E0\u70BA ORBinitialPort \u5728\u4F7F\u7528\u4E2D\uFF0C\u6240\u4EE5\u7121\u6CD5\u555F\u52D5 ORBD\u3002
-orbd.internalexception=\n\u56E0\u70BA\u5167\u90E8\u767C\u751F\u7570\u5E38\uFF0C\u6240\u4EE5\u7121\u6CD5\u555F\u52D5 ORBD\u3002 \n\u53EF\u80FD\u7684\u539F\u56E0: \n1. \u6307\u5B9A\u7684 ORBInitialPort \u6216 ORBActivationPort \u5728\u4F7F\u7528\u4E2D\u3002 \n2. \u6C92\u6709\u5BEB\u5165 orb.db \u7684\u6B0A\u9650\u3002 
+orbd.internalexception=\n\u56E0\u70BA\u5167\u90E8\u767C\u751F\u7570\u5E38\uFF0C\u6240\u4EE5\u7121\u6CD5\u555F\u52D5 ORBD\u3002\n\u53EF\u80FD\u7684\u539F\u56E0: \n1. \u6307\u5B9A\u7684 ORBInitialPort \u6216 ORBActivationPort \u5728\u4F7F\u7528\u4E2D\u3002\n2. \u6C92\u6709\u5BEB\u5165 orb.db \u7684\u6B0A\u9650\u3002
 

--- a/src/share/classes/javax/rmi/CORBA/Util.java	Mon Jul 04 14:29:08 2016 -0700
+++ b/src/share/classes/javax/rmi/CORBA/Util.java	Tue Jul 05 15:10:45 2016 -0700
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1998, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1998, 2016, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -45,6 +45,7 @@
 import java.rmi.Remote;
 import java.io.File;
 import java.io.FileInputStream;
+import java.io.SerializablePermission;
 import java.net.MalformedURLException ;
 import java.security.AccessController;
 import java.security.PrivilegedAction;
@@ -63,8 +64,22 @@
     private static final javax.rmi.CORBA.UtilDelegate utilDelegate;
     private static final String UtilClassKey = "javax.rmi.CORBA.UtilClass";
 
+    private static final String ALLOW_CREATEVALUEHANDLER_PROP = "jdk.rmi.CORBA.allowCustomValueHandler";
+    private static boolean allowCustomValueHandler;
+
     static {
         utilDelegate = (javax.rmi.CORBA.UtilDelegate)createDelegate(UtilClassKey);
+        allowCustomValueHandler = readAllowCustomValueHandlerProperty();
+    }
+
+    private static boolean readAllowCustomValueHandlerProperty () {
+       return AccessController
+        .doPrivileged(new PrivilegedAction<Boolean>() {
+            @Override
+            public Boolean run() {
+                return Boolean.getBoolean(ALLOW_CREATEVALUEHANDLER_PROP);
+            }
+        });
     }
 
     private Util(){}
@@ -111,7 +126,7 @@
      * Writes a java.lang.Object as a CORBA Object. If <code>obj</code> is
      * an exported RMI-IIOP server object, the tie is found
      * and wired to <code>obj</code>, then written to
-<code>out.write_Object(org.omg.CORBA.Object)</code>.
+     * <code>out.write_Object(org.omg.CORBA.Object)</code>.
      * If <code>obj</code> is a CORBA Object, it is written to
      * <code>out.write_Object(org.omg.CORBA.Object)</code>.
      * @param out the stream in which to write the object.
@@ -196,6 +211,8 @@
      */
     public static ValueHandler createValueHandler() {
 
+        isCustomSerializationPermitted();
+
         if (utilDelegate != null) {
             return utilDelegate.createValueHandler();
         }
@@ -336,6 +353,7 @@
     // security reasons. If you know a better solution how to share this code
     // then remove it from PortableRemoteObject. Also in Stub.java
     private static Object createDelegate(String classKey) {
+
         String className = (String)
             AccessController.doPrivileged(new GetPropertyAction(classKey));
         if (className == null) {
@@ -388,4 +406,16 @@
             new GetORBPropertiesFileAction());
     }
 
+    private static void isCustomSerializationPermitted() {
+        SecurityManager sm = System.getSecurityManager();
+        if (!allowCustomValueHandler) {
+            if ( sm != null) {
+                // check that a serialization permission has been
+                // set to allow the loading of the Util delegate
+                // which provides access to custom ValueHandler
+                sm.checkPermission(new SerializablePermission(
+                        "enableCustomValueHanlder"));
+            }
+        }
+    }
 }