--- a/src/share/classes/java/security/CodeSource.java	Mon Apr 16 17:46:24 2012 +0400
+++ b/src/share/classes/java/security/CodeSource.java	Tue Apr 17 14:37:30 2012 +0100
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2011, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2012, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -371,9 +371,8 @@
      */
     private boolean matchLocation(CodeSource that)
         {
-            if (location == null) {
+            if (location == null)
                 return true;
-            }
 
             if ((that == null) || (that.location == null))
                 return false;
@@ -381,32 +380,9 @@
             if (location.equals(that.location))
                 return true;
 
-            if (!location.getProtocol().equals(that.location.getProtocol()))
+            if (!location.getProtocol().equalsIgnoreCase(that.location.getProtocol()))
                 return false;
 
-            String thisHost = location.getHost();
-            String thatHost = that.location.getHost();
-
-            if (thisHost != null) {
-                if (("".equals(thisHost) || "localhost".equals(thisHost)) &&
-                    ("".equals(thatHost) || "localhost".equals(thatHost))) {
-                    // ok
-                } else if (!thisHost.equals(thatHost)) {
-                    if (thatHost == null) {
-                        return false;
-                    }
-                    if (this.sp == null) {
-                        this.sp = new SocketPermission(thisHost, "resolve");
-                    }
-                    if (that.sp == null) {
-                        that.sp = new SocketPermission(thatHost, "resolve");
-                    }
-                    if (!this.sp.implies(that.sp)) {
-                        return false;
-                    }
-                }
-            }
-
             if (location.getPort() != -1) {
                 if (location.getPort() != that.location.getPort())
                     return false;
@@ -443,10 +419,34 @@
                 }
             }
 
-            if (location.getRef() == null)
-                return true;
-            else
-                return location.getRef().equals(that.location.getRef());
+            if (location.getRef() != null) {
+                if (!location.getRef().equals(that.location.getRef()))
+                    return false;
+            }
+
+            String thisHost = location.getHost();
+            String thatHost = that.location.getHost();
+            if (thisHost != null) {
+                if (("".equals(thisHost) || "localhost".equals(thisHost)) &&
+                    ("".equals(thatHost) || "localhost".equals(thatHost))) {
+                    // ok
+                } else if (!thisHost.equalsIgnoreCase(thatHost)) {
+                    if (thatHost == null) {
+                        return false;
+                    }
+                    if (this.sp == null) {
+                        this.sp = new SocketPermission(thisHost, "resolve");
+                    }
+                    if (that.sp == null) {
+                        that.sp = new SocketPermission(thatHost, "resolve");
+                    }
+                    if (!this.sp.implies(that.sp)) {
+                        return false;
+                    }
+                }
+            }
+            // everything matches
+            return true;
         }
 
     /**

--- a/test/java/security/CodeSource/Implies.java	Mon Apr 16 17:46:24 2012 +0400
+++ b/test/java/security/CodeSource/Implies.java	Tue Apr 17 14:37:30 2012 +0100
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2012, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -23,7 +23,7 @@
 
 /*
  * @test
- * @bug 4866847
+ * @bug 4866847 7155693
  * @summary NullPointerException from CodeSource.matchLocation
  */
 
@@ -34,14 +34,27 @@
     public static void main(String[] args) throws Exception {
         URL thisURL = new URL("http", "localhost", "file");
         URL thatURL = new URL("http", null, "file");
+        // should not throw NullPointerException
+        testImplies(thisURL, thatURL, false);
+
+        thisURL = new URL("http", "localhost", "dir/-");
+        thatURL = new URL("HTTP", "localhost", "dir/file");
+        // protocol check should ignore case
+        testImplies(thisURL, thatURL, true);
+
+        System.out.println("test passed");
+    }
+
+    private static void testImplies(URL thisURL, URL thatURL, boolean result)
+        throws SecurityException
+    {
         CodeSource thisCs =
             new CodeSource(thisURL, (java.security.cert.Certificate[]) null);
         CodeSource thatCs =
             new CodeSource(thatURL, (java.security.cert.Certificate[]) null);
 
-        if (thisCs.implies(thatCs)) {
+        if (thisCs.implies(thatCs) != result) {
             throw new SecurityException("test failed");
         }
-        System.out.println("test passed");
     }
 }