--- a/src/share/classes/java/util/TimeZone.java	Tue Jan 15 10:37:49 2013 +0000
+++ b/src/share/classes/java/util/TimeZone.java	Fri Jul 19 15:32:01 2013 +0900
@@ -165,6 +165,11 @@
     // Proclaim serialization compatibility with JDK 1.1
     static final long serialVersionUID = 3581463369166924961L;
 
+    // TimeZone.setDefault maintains the compatible behavior of the AppContext-based
+    // default setting for untrusted code if allowSetDefault is true.
+    private static final boolean allowSetDefault = AccessController.doPrivileged(
+        new sun.security.action.GetPropertyAction("jdk.util.TimeZone.allowSetDefault")) != null;
+
     /**
      * Gets the time zone offset, for current date, modified in case of
      * daylight savings. This is the offset to add to UTC to get local time.
@@ -689,6 +694,9 @@
                 sm.checkPermission(new PropertyPermission
                                    ("user.timezone", "write"));
             } catch (SecurityException e) {
+                if (!allowSetDefault) {
+                    throw e;
+                }
                 hasPermission = false;
             }
         }
@@ -719,6 +727,7 @@
      * Returns the default TimeZone in an AppContext if any AppContext
      * has ever used. null is returned if any AppContext hasn't been
      * used or if the AppContext doesn't have the default TimeZone.
+     * null is also returned if allowSetDefault is false.
      *
      * Note that javaAWTAccess may be null if sun.awt.AppContext class hasn't
      * been loaded. If so, it implies that AWTSecurityManager is not our
@@ -726,18 +735,20 @@
      * This works around a build time issue.
      */
     private static TimeZone getDefaultInAppContext() {
-        // JavaAWTAccess provides access implementation-private methods without using reflection.
-        JavaAWTAccess javaAWTAccess = SharedSecrets.getJavaAWTAccess();
-        if (javaAWTAccess == null) {
-            return mainAppContextDefault;
-        } else {
-            if (!javaAWTAccess.isDisposed()) {
-                TimeZone tz = (TimeZone)
-                    javaAWTAccess.get(TimeZone.class);
-                if (tz == null && javaAWTAccess.isMainAppContext()) {
-                    return mainAppContextDefault;
-                } else {
-                    return tz;
+        if (allowSetDefault) {
+            // JavaAWTAccess provides access implementation-private methods without using reflection.
+            JavaAWTAccess javaAWTAccess = SharedSecrets.getJavaAWTAccess();
+            if (javaAWTAccess == null) {
+                return mainAppContextDefault;
+            } else {
+                if (!javaAWTAccess.isDisposed()) {
+                    TimeZone tz = (TimeZone)
+                        javaAWTAccess.get(TimeZone.class);
+                    if (tz == null && javaAWTAccess.isMainAppContext()) {
+                        return mainAppContextDefault;
+                    } else {
+                        return tz;
+                    }
                 }
             }
         }
@@ -745,9 +756,9 @@
     }
 
     /**
-     * Sets the default TimeZone in the AppContext to the given
-     * tz. null is handled special: do nothing if any AppContext
-     * hasn't been used, remove the default TimeZone in the
+     * Sets the default TimeZone in the AppContext to the given tz if
+     * allowSetDefault is true. null is handled special: do nothing if any
+     * AppContext hasn't been used, remove the default TimeZone in the
      * AppContext otherwise.
      *
      * Note that javaAWTAccess may be null if sun.awt.AppContext class hasn't
@@ -756,15 +767,17 @@
      * This works around a build time issue.
      */
     private static void setDefaultInAppContext(TimeZone tz) {
-        // JavaAWTAccess provides access implementation-private methods without using reflection.
-        JavaAWTAccess javaAWTAccess = SharedSecrets.getJavaAWTAccess();
-        if (javaAWTAccess == null) {
-            mainAppContextDefault = tz;
-        } else {
-            if (!javaAWTAccess.isDisposed()) {
-                javaAWTAccess.put(TimeZone.class, tz);
-                if (javaAWTAccess.isMainAppContext()) {
-                    mainAppContextDefault = null;
+        if (allowSetDefault) {
+            // JavaAWTAccess provides access implementation-private methods without using reflection.
+            JavaAWTAccess javaAWTAccess = SharedSecrets.getJavaAWTAccess();
+            if (javaAWTAccess == null) {
+                mainAppContextDefault = tz;
+            } else {
+                if (!javaAWTAccess.isDisposed()) {
+                    javaAWTAccess.put(TimeZone.class, tz);
+                    if (javaAWTAccess.isMainAppContext()) {
+                        mainAppContextDefault = null;
+                    }
                 }
             }
         }