--- a/ChangeLog	Mon Apr 20 18:10:37 2020 +0100
+++ b/ChangeLog	Fri May 01 06:16:35 2020 +0100
@@ -1,3 +1,28 @@
+2020-04-30  Andrew John Hughes  <gnu_andrew@member.fsf.org>
+
+	Bump to icedtea-3.16.0.
+	* Makefile.am:
+	(CORBA_CHANGESET): Update to icedtea-3.16.0 tag.
+	(JAXP_CHANGESET): Likewise.
+	(JAXWS_CHANGESET): Likewise.
+	(JDK_CHANGESET): Likewise.
+	(LANGTOOLS_CHANGESET): Likewise.
+	(OPENJDK_CHANGESET): Likewise.
+	(NASHORN_CHANGESET): Likewise.
+	(CORBA_SHA256SUM): Likewise.
+	(JAXP_SHA256SUM): Likewise.
+	(JAXWS_SHA256SUM): Likewise.
+	(JDK_SHA256SUM): Likewise.
+	(LANGTOOLS_SHA256SUM): Likewise.
+	(OPENJDK_SHA256SUM): Likewise.
+	(NASHORN_SHA256SUM): Likewise.
+	* NEWS: Updated.
+	* acinclude.m4:
+	(IT_DETERMINE_VERSION): Set BUILD_VERSION to b09
+	and MILESTONE to fcs for final release.
+	* configure.ac: Bump to 3.16.0.
+	* hotspot.map.in: Update to icedtea-3.16.0 tag.
+
 2020-04-18  Andrew John Hughes  <gnu_andrew@member.fsf.org>
 
 	Bump aarch32 to jdk8u252-b01-aarch32-20200131.

--- a/Makefile.am	Mon Apr 20 18:10:37 2020 +0100
+++ b/Makefile.am	Fri May 01 06:16:35 2020 +0100
@@ -1,20 +1,20 @@
 # Dependencies
 
-CORBA_CHANGESET = 7f5bc788ce2a
-JAXP_CHANGESET = e186cc599b97
-JAXWS_CHANGESET = 9e2d63d726ae
-JDK_CHANGESET = f6d92b4b12df
-LANGTOOLS_CHANGESET = 37c3c47b664f
-OPENJDK_CHANGESET = 9fd0ac410149
-NASHORN_CHANGESET = e854df08e55f
-
-CORBA_SHA256SUM = 38b70fb5e58bfab594313c26d39889c21d0f18df02be6771e45a943189210e11
-JAXP_SHA256SUM = 8f4af015af84c43accfe02e65dfd8c87003a62ac91b284997975bdd82a7d36e1
-JAXWS_SHA256SUM = cf81b3ee6b620a2b4becc7fd91cc82faf4f320991965a9834b8a1abe28d24aec
-JDK_SHA256SUM = 5796ebe2789884f07b8e8820dac111c5af292a5a12e281f82a29781d9c67d5e3
-LANGTOOLS_SHA256SUM = de86bca91823f3c32c477cdeb67927018f94e14758d8370b0f2f77fdbbe2ce46
-OPENJDK_SHA256SUM = f517ed77761fdaf6f305a9c5ae2eab90406bc56ce8cd746742640ece58d70475
-NASHORN_SHA256SUM = c659dd2662fcef542fce1674335decdd831eea9f2542533e701de917af4539ae
+CORBA_CHANGESET = ea3169880d70
+JAXP_CHANGESET = 883803235596
+JAXWS_CHANGESET = e5d96dc9988a
+JDK_CHANGESET = bb9b9a0ad162
+LANGTOOLS_CHANGESET = e47d37e5fe0b
+OPENJDK_CHANGESET = bca1f7228ce8
+NASHORN_CHANGESET = 1d70dcb4ab53
+
+CORBA_SHA256SUM = 45fbaefea10211f1efc17df5d1f2197583a119d2e8d1773ecd0f4fbc786813d3
+JAXP_SHA256SUM = 030ee059bcb815934b4ea4fb1e6b8d4ee4d15fdad6f4ea8ce20f99ded80631b6
+JAXWS_SHA256SUM = b529f8d44af3ed7588e51f8326da2ba47fb3ea79c23933b5a7e8ec1e5e4e0f1b
+JDK_SHA256SUM = da14787acc99062ffb8b087eb27619eded0c84649b4a4e0f8d50d5c067533e8b
+LANGTOOLS_SHA256SUM = dd6978cce62c30bdeb2afeec865449d99e2a65a8555fdbecf9f7173c10022fcd
+OPENJDK_SHA256SUM = f08a768697cefd1bc2b358b075803d366d7023c7e84a78fc47fef66134bbc7e9
+NASHORN_SHA256SUM = 30086e392a365242c7c61eee18534bfc1583ced855fbb301f187fcd16403845c
 
 HS_TYPE = "`$(AWK) 'version==$$1 {print $$2}' version=$(HSBUILD) $(abs_top_builddir)/hotspot.map`"
 HS_URL = "`$(AWK) 'version==$$1 {print $$3}' version=$(HSBUILD) $(abs_top_builddir)/hotspot.map`"

--- a/NEWS	Mon Apr 20 18:10:37 2020 +0100
+++ b/NEWS	Fri May 01 06:16:35 2020 +0100
@@ -12,27 +12,39 @@
 
 New in release 3.16.0 (2020-04-XX):
 
-* Import of OpenJDK 8 u242 build 01
+* Security fixes
+  - S8223898, CVE-2020-2754: Forward references to Nashorn
+  - S8223904, CVE-2020-2755: Improve Nashorn matching
+  - S8224541, CVE-2020-2756: Better mapping of serial ENUMs
+  - S8224549, CVE-2020-2757: Less Blocking Array Queues
+  - S8225603: Enhancement for big integers
+  - S8227542: Manifest improved jar headers
+  - S8231415, CVE-2020-2773: Better signatures in XML
+  - S8233250: Better X11 rendering
+  - S8233410: Better Build Scripting
+  - S8234027: Better JCEKS key support
+  - S8234408, CVE-2020-2781: Improve TLS session handling
+  - S8234825, CVE-2020-2800: Better Headings for HTTP Servers
+  - S8234841, CVE-2020-2803: Enhance buffering of byte buffers
+  - S8235274, CVE-2020-2805: Enhance typing of methods
+  - S8236201, CVE-2020-2830: Better Scanner conversions
+  - S8238960: linux-i586 builds are inconsistent as the newly build jdk is not able to reserve enough space for object heap
+* Import of OpenJDK 8 u252 build 01
   - S8028480: (zipfs) NoSuchFileException on creating a file in ZipFileSystem with CREATE and WRITE
   - S8031191: Warning exception when XMLSignature logging is enabled
   - S8034773: (zipfs) newOutputstream uses CREATE_NEW when no options specified
   - S8038431: Close InputStream when finished retrieving XML Signature HTTP References
   - S8041620: Solaris Studio 12.4 C++ 5.13 change in behavior for placing friend declarations within surrounding scope.
   - S8046044: Fix raw and unchecked lint warnings in XML Signature Impl
-  - S8055351: sun/security/provider/DSA/TestAlgParameterGenerator.java failed with interrupted! (timed out?)
   - S8056313: TEST_BUG: java/util/Timer/NameConstructors.java fails intermittently
-  - S8133489: Better messaging for PKIX path validation matching
   - S8144732: VM_HeapDumper hits assert with bad dump_len
   - S8150432: LocaleProviders.sh fails
   - S8150460: (linux|bsd|aix)_close.c: file descriptor table may become large or may not work at all
-  - S8170641: sun/net/www/protocol/https/HttpsURLConnection/PostThruProxy.sh fails with timeout
-  - S8173956: KeyStore regression due to default keystore being changed to PKCS12
   - S8216354: Syntax error in toolchain_windows.m4
   - S8218553: Enhance keystore load debug output
   - S8218580: endpoint identification algorithm should be case-insensitive
   - S8227397: Add --with-extra-asflags configure option
   - S8227662: freetype seeks to index at the end of the font data
-  - S8227715: GPLv2 files missing Classpath Exception
   - S8231201: hs_err should print coalesced safepoint operations in Events section
   - S8231991: Mouse wheel change focus on awt/swing windows
   - S8232003: (fs) Files.write can leak file descriptor in the exception case
@@ -40,14 +52,102 @@
   - S8232355: Two obsolete flags have the wrong obsolete version in 8u
   - S8233023: assert(Opcode() == mem->Opcode() || phase->C->get_alias_index(adr_type()) == Compile::AliasIdxRaw) failed: no mismatched stores, except on raw memory
   - S8233404: System property to set the number of PBE iterations in JCEKS keystores
-  - S8233886: TEST_BUG jdk/java/net/CookieHandler/B6791927.java hit hardcoded expiration date
   - S8234107: Several AWT modal dialog tests failing on Linux after JDK-8231991
   - S8234264: Incorrect 8047434 JDK 8 backport in 8219677
   - S8234288: Turkey Time Zone returns incorrect time zone name
   - S8235637: jhsdb jmap from OpenJDK 11.0.5 doesn't work if prelink is enabled
   - S8236873: Worker has a deadlock bug
   - S8237523: 8u backport of JDK-8216354 didn't include generated-configure.sh changes
+* Import of OpenJDK 8 u252 build 02
+  - S7143743: Potential memory leak with zip provider
+  - S8033215: clang: node.cpp:284 IDX_INIT macro use uninitialized field _out
+  - S8143849: Integrate Marlin renderer per JEP 265
+  - S8146792: Predicate moved after partial peel may lead to broken graph
+  - S8193255: Root Certificates should be stored in text format and assembled at build time
+  - S8233995: java.vm.vendor (and potentially other properties/fields) not correctly set in Windows/Hotspot build of OpenJDK8
+  - S8235142: JDK-8193255 backport broke bootstrap with JDK 10
+* Import of OpenJDK 8 u252 build 03
+  - S8005819: Support cross-realm MSSFU
+  - S8046724: XML Signature ECKeyValue elements cannot be marshalled or unmarshalled
+  - S8079140: IgnoreAllErrorHandler should use doPrivileged when it reads system properties
+  - S8134579: [TESTBUG] Some bmi tests fail if can_access_local_variables is on.
+  - S8145055: Marlin renderer causes unaligned write accesses
+  - S8145849: ALPN: getHandshakeApplicationProtocol() always return null
+  - S8146293: Add support for RSASSA-PSS Signature algorithm
+  - S8158978: ALPN not working when values are set directly on a SSLServerSocket
+  - S8162723: Array index overflow in Base64 utility class
+  - S8170282: Enable ALPN parameters to be supplied during the TLS handshake
+  - S8171443: (spec) An ALPN callback function may also ignore ALPN
+  - S8175029: StackOverflowError in X509CRL and X509Certificate.verify(PublicKey, Provider)
+  - S8200400: Restrict Sasl mechanisms
+  - S8205445: Add RSASSA-PSS Signature support to SunMSCAPI
+  - S8205720: KeyFactory#getKeySpec and translateKey throws NullPointerException with Invalid key
+  - S8206171: Signature#getParameters for RSASSA-PSS throws ProviderException when not initialized
+  - S8213009: Refactoring existing SunMSCAPI classes
+  - S8213010: Supporting keys created with certmgr.exe
+  - S8214096: sun.security.util.SignatureUtil passes null parameter, so JCE validation fails
+  - S8215694: keytool cannot generate RSASSA-PSS certificates
+  - S8216039: TLS with BC and RSASSA-PSS breaks ECDHServerKeyExchange
+  - S8221407: Windows 32bit build error in libsunmscapi/security.cpp
+  - S8223003: SunMSCAPI keys are not cleaned up
+  - S8223063: Support CNG RSA keys
+  - S8223158: Docked MacBook cannot start any Java Swing applications
+  - S8225180: SignedObject with invalid Key not throwing the InvalidKeyException in Windows
+  - S8225392: Comparison builds are failing due to cacerts file
+  - S8225745: NoSuchAlgorithmException exception for SHA256withECDSA with RSASSA-PSS support
+  - S8229767: Typo in java.security: Sasl.createClient and Sasl.createServer
+  - S8230977: JEP 244/8051498 - TLS Application-Layer Protocol Negotiation Extension (Java SE 8)
+  - S8230978: Add support for RSASSA-PSS Signature algorithm (Java SE 8)
+  - S8234245: sun/security/lib/cacerts/VerifyCACerts.java fails due to wrong checksum
+  - S8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash algorithm as AlgorithmId
+  - S8238502: sunmscapi.dll causing EXCEPTION_ACCESS_VIOLATION
+* Import of OpenJDK 8 u252 build 04
+  - S8047212: runtime/ParallelClassLoading/bootstrap/random/inner-complex assert(ObjectSynchronizer::verify_objmon_isinpool(inf)) failed: monitor is invalid
+  - S8135318: CMS wrong max_eden_size for check_gc_overhead_limit
+  - S8144445: Maximum size checking in Marlin ArrayCache utility methods is not optimal
+  - S8144446: Automate the Marlin crash test
+  - S8144630: Use PrivilegedAction to create Thread in Marlin RendererStats
+  - S8215756: Memory leaks in the AWT on macOS
+  - S8219244: NMT: Change ThreadSafepointState's allocation type from mtInternal to mtThread
+  - S8225128: Add exception for expiring DocuSign root to VerifyCACerts test
+  - S8229345: Memory leak due to vtable stubs not being shared on SPARC
+  - S8229872: (fs) Increase buffer size used with getmntent
+  - S8236179: C1 register allocation error with T_ADDRESS
+  - S8237368: Problem with NullPointerException in RMI TCPEndpoint.read
+* Import of OpenJDK 8 u252 build 05
+  - S8022263: use same Clang warnings on BSD as on Linux
+  - S8055283: Expand ResourceHashtable with C_HEAP allocation, removal and some unit tests
+  - S8068184: Fix for JDK-8032832 caused a deadlock
+  - S8079693: Add support for ECDSA P-384 and P-521 curves to XML Signature
+  - S8132130: some docs cleanup
+  - S8144526: Remove Marlin logging use of deleted internal API
+  - S8144654: Improve Marlin logging
+  - S8144718: Pisces / Marlin Strokers may generate invalid curves with huge coordinates and round joins
+  - S8166976: TestCipherPBECons has wrong @run line
+  - S8167409: Invalid value passed to critical JNI function
+  - S8181872: C1: possible overflow when strength reducing integer multiply by constant
+  - S8187078: -XX:+VerifyOops finds numerous problems when running JPRT
+  - S8191227: issues with unsafe handle resolution
+  - S8216472: (se) Stack overflow during selection operation leads to crash (win)
+  - S8229022: BufferedReader performance can be improved by using StringBuilder
+  - S8231430: C2: Memory stomp in max_array_length() for T_ILLEGAL type
+  - S8235904: Infinite loop when rendering huge lines
+* Import of OpenJDK 8 u252 build 06
+  - S8225130: Add exception for expiring Comodo roots to VerifyCACerts test
+  - S8230235: Rendering HTML with empty img attribute and documentBaseKey cause Exception
+  - S8235744: PIT: test/jdk/javax/swing/text/html/TestJLabelWithHTMLText.java times out in linux-x64
+  - S8240521: Revert backport of 8231584: Deadlock with ClassLoader.findLibrary and System.loadLibrary call
+* Import of OpenJDK 8 u252 build 07
+  - S8197441: Signature#initSign/initVerify for an invalid private/public key fails with ClassCastException for SunPKCS11 provider
+* Import of OpenJDK 8 u252 build 08
+  - S8241296: Segfault in JNIHandleBlock::oops_do()
+  - S8241307: Marlin renderer should not be the default in 8u252
+* Import of OpenJDK 8 u252 build 09
+  - S8204152: SignedObject throws NullPointerException for null keys with an initialized Signature object
+  - S8219597: (bf) Heap buffer state changes could provoke unexpected exceptions
 * Backports
+  - S8035949, PR3784: Remove unused macro USE_SELECT and clean up Unix version of net_util_md.{c,h}
+  - S8167481, PR3784: cleanup of headers and includes for native libnet
   - S8195607, PR3776: sun/security/pkcs11/Secmod/TestNssDbSqlite.java failed with "NSS initialization failed" on NSS 3.34.1
 
 New in release 3.15.0 (2020-01-20):

--- a/acinclude.m4	Mon Apr 20 18:10:37 2020 +0100
+++ b/acinclude.m4	Fri May 01 06:16:35 2020 +0100
@@ -2090,8 +2090,8 @@
   JAVA_VER=1.8.0
   JAVA_VENDOR=openjdk
   JDK_UPDATE_VERSION=252
-  BUILD_VERSION=b01
-  MILESTONE=ea
+  BUILD_VERSION=b09
+  MILESTONE=fcs
   if test "x${MILESTONE}" = "xfcs"; then
     COMBINED_VERSION=${JDK_UPDATE_VERSION}-${BUILD_VERSION}
   else

--- a/configure.ac	Mon Apr 20 18:10:37 2020 +0100
+++ b/configure.ac	Fri May 01 06:16:35 2020 +0100
@@ -1,4 +1,4 @@
-AC_INIT([icedtea], [3.16.0pre01], [distro-pkg-dev@openjdk.java.net])
+AC_INIT([icedtea], [3.16.0], [distro-pkg-dev@openjdk.java.net])
 AC_CANONICAL_HOST
 AC_CANONICAL_TARGET
 AM_INIT_AUTOMAKE([1.9 tar-pax foreign])

--- a/hotspot.map.in	Mon Apr 20 18:10:37 2020 +0100
+++ b/hotspot.map.in	Fri May 01 06:16:35 2020 +0100
@@ -1,4 +1,4 @@
 # version type(drop/hg) url changeset sha256sum
-default drop https://icedtea.classpath.org/download/drops/icedtea8/@ICEDTEA_RELEASE@ efb699b681a1 49a0877e0057ccfcf2eeca58016aacbd51b44f8850e00f89e4caeade7bd39665
+default drop https://icedtea.classpath.org/download/drops/icedtea8/@ICEDTEA_RELEASE@ 773c67608051 95d6f3f2015ed9f0ea36a9320da4c010e154188310a9c3fc0f70f08fc1c241ae
 shenandoah drop https://icedtea.classpath.org/download/drops/icedtea8/@ICEDTEA_RELEASE@ 345ee7a80453 4b14a3adb29d807fba26b031a20882b590373aad54080c4ae40c31612deb39e6
 aarch32 drop https://icedtea.classpath.org/download/drops/icedtea8/@ICEDTEA_RELEASE@ a5cd00da9bbc 33bce39f4d3f18e196f19fdb93fde1a1b0106b978dc6509326e9c1613290a6a3