--- a/.hgtags	Tue Aug 04 12:33:45 2015 -0700
+++ b/.hgtags	Sun Aug 30 17:43:33 2015 -0700
@@ -456,6 +456,7 @@
 d433f5fd8910bee1f2c295b65cf03977034fe0ea jdk8u60-b24
 c8cfbe57bcd5042d2fef42dcef14d73dd4bdc416 jdk8u60-b25
 0d6a8a9b26a37678b420ff540b5a622c3f4fd44c jdk8u60-b26
+afbc08ea922bf6e5e14d2eea24a2f94f37627ea7 jdk8u60-b27
 286b9a885fcc6245fdf2b20697473ec3b35f2538 jdk8u65-b00
 80a796d0db958f49a4b0713818227eda8e5efbb9 jdk8u65-b01
 77d48e6d111faec236c8678997ae4311151cfee4 jdk8u65-b02
@@ -465,6 +466,7 @@
 3ee40ba7525d6d5ee201a475b967ca2e5c3c9ab3 jdk8u65-b06
 bd2ad7acb217391747dae8263c090483af454313 jdk8u65-b07
 d215cd281678e4b89a4155755cd6e03e37b7e9b1 jdk8u65-b08
+e9de15763a5a3cef64ef1d4bc40a018d4d572325 jdk8u65-b09
 e9f82302d5fdef8a0976640e09363895e9dcde3c jdk8u66-b00
 64d7bd4e98150447916f210e3bfd6875a4c2728a jdk8u66-b01
 d8210091911b14930192abd3138ee37c281fb632 jdk8u66-b02

--- a/src/macosx/native/sun/awt/CFRetainedResource.m	Tue Aug 04 12:33:45 2015 -0700
+++ b/src/macosx/native/sun/awt/CFRetainedResource.m	Sun Aug 30 17:43:33 2015 -0700
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2012, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2011, 2015, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -40,10 +40,17 @@
     if (releaseOnAppKitThread) {
         // Releasing resources on the main AppKit message loop only
         // Releasing resources on the nested loops may cause dangling 
-        // pointers after the nested loop is exited 
-        [NSApp postRunnableEvent:^(){
-            CFRelease(jlong_to_ptr(ptr));
-        }];
+        // pointers after the nested loop is exited
+        if ([NSApp respondsToSelector:@selector(postRunnableEvent:)]) {
+            [NSApp postRunnableEvent:^() {
+                CFRelease(jlong_to_ptr(ptr));
+            }];
+        } else {
+            // could happen if we are embedded inside SWT/FX application,
+            [JNFRunLoop performOnMainThreadWaiting:NO withBlock:^() {
+                CFRelease(jlong_to_ptr(ptr));
+            }];
+        }
     } else {
 
 JNF_COCOA_ENTER(env);

--- a/src/share/classes/java/rmi/server/RemoteObjectInvocationHandler.java	Tue Aug 04 12:33:45 2015 -0700
+++ b/src/share/classes/java/rmi/server/RemoteObjectInvocationHandler.java	Sun Aug 30 17:43:33 2015 -0700
@@ -162,6 +162,14 @@
     public Object invoke(Object proxy, Method method, Object[] args)
         throws Throwable
     {
+        if (! Proxy.isProxyClass(proxy.getClass())) {
+            throw new IllegalArgumentException("not a proxy");
+        }
+
+        if (Proxy.getInvocationHandler(proxy) != this) {
+            throw new IllegalArgumentException("handler mismatch");
+        }
+
         if (method.getDeclaringClass() == Object.class) {
             return invokeObjectMethod(proxy, method, args);
         } else if ("finalize".equals(method.getName()) && method.getParameterCount() == 0 &&
@@ -186,11 +194,13 @@
 
         } else if (name.equals("equals")) {
             Object obj = args[0];
+            InvocationHandler hdlr;
             return
                 proxy == obj ||
                 (obj != null &&
                  Proxy.isProxyClass(obj.getClass()) &&
-                 equals(Proxy.getInvocationHandler(obj)));
+                 (hdlr = Proxy.getInvocationHandler(obj)) instanceof RemoteObjectInvocationHandler &&
+                 this.equals(hdlr));
 
         } else if (name.equals("toString")) {
             return proxyToString(proxy);

--- a/src/share/classes/javax/management/openmbean/OpenMBeanAttributeInfoSupport.java	Tue Aug 04 12:33:45 2015 -0700
+++ b/src/share/classes/javax/management/openmbean/OpenMBeanAttributeInfoSupport.java	Sun Aug 30 17:43:33 2015 -0700
@@ -761,11 +761,15 @@
         Class<?> stringArrayClass;
         Class<?> targetArrayClass;
         try {
+            String baseClassName = baseType.safeGetClassName();
+
+            // check access to the provided base type class name and bail out early
+            ReflectUtil.checkPackageAccess(baseClassName);
+
             stringArrayClass =
                 Class.forName(squareBrackets + "Ljava.lang.String;");
             targetArrayClass =
-                Class.forName(squareBrackets + "L" + baseType.safeGetClassName() +
-                              ";");
+                Class.forName(squareBrackets + "L" + baseClassName + ";");
         } catch (ClassNotFoundException e) {
             throw new NoClassDefFoundError(e.toString());  // can't happen
         }