--- a/hotspot/src/share/vm/classfile/dictionary.cpp	Fri Feb 17 02:31:12 2017 +0000
+++ b/hotspot/src/share/vm/classfile/dictionary.cpp	Fri Feb 17 14:47:46 2017 -0500
@@ -61,7 +61,7 @@
   _pd_cache_table = new ProtectionDomainCacheTable(defaultProtectionDomainCacheSize);
 };
 
-ProtectionDomainCacheEntry* Dictionary::cache_get(oop protection_domain) {
+ProtectionDomainCacheEntry* Dictionary::cache_get(Handle protection_domain) {
   return _pd_cache_table->get(protection_domain);
 }
 
@@ -123,9 +123,9 @@
 }
 
 
-void DictionaryEntry::add_protection_domain(Dictionary* dict, oop protection_domain) {
+void DictionaryEntry::add_protection_domain(Dictionary* dict, Handle protection_domain) {
   assert_locked_or_safepoint(SystemDictionary_lock);
-  if (!contains_protection_domain(protection_domain)) {
+  if (!contains_protection_domain(protection_domain())) {
     ProtectionDomainCacheEntry* entry = dict->cache_get(protection_domain);
     ProtectionDomainEntry* new_head =
                 new ProtectionDomainEntry(entry, _pd_set);
@@ -454,7 +454,7 @@
   assert(protection_domain() != NULL,
          "real protection domain should be present");
 
-  entry->add_protection_domain(this, protection_domain());
+  entry->add_protection_domain(this, protection_domain);
 
   assert(entry->contains_protection_domain(protection_domain()),
          "now protection domain should be present");
@@ -505,11 +505,12 @@
 }
 
 
-unsigned int ProtectionDomainCacheTable::compute_hash(oop protection_domain) {
+unsigned int ProtectionDomainCacheTable::compute_hash(Handle protection_domain) {
+  // Identity hash can safepoint, so keep protection domain in a Handle.
   return (unsigned int)(protection_domain->identity_hash());
 }
 
-int ProtectionDomainCacheTable::index_for(oop protection_domain) {
+int ProtectionDomainCacheTable::index_for(Handle protection_domain) {
   return hash_to_index(compute_hash(protection_domain));
 }
 
@@ -619,7 +620,7 @@
   }
 }
 
-ProtectionDomainCacheEntry* ProtectionDomainCacheTable::get(oop protection_domain) {
+ProtectionDomainCacheEntry* ProtectionDomainCacheTable::get(Handle protection_domain) {
   unsigned int hash = compute_hash(protection_domain);
   int index = hash_to_index(hash);
 
@@ -630,9 +631,9 @@
   return entry;
 }
 
-ProtectionDomainCacheEntry* ProtectionDomainCacheTable::find_entry(int index, oop protection_domain) {
+ProtectionDomainCacheEntry* ProtectionDomainCacheTable::find_entry(int index, Handle protection_domain) {
   for (ProtectionDomainCacheEntry* e = bucket(index); e != NULL; e = e->next()) {
-    if (e->protection_domain() == protection_domain) {
+    if (e->protection_domain() == protection_domain()) {
       return e;
     }
   }
@@ -640,7 +641,7 @@
   return NULL;
 }
 
-ProtectionDomainCacheEntry* ProtectionDomainCacheTable::add_entry(int index, unsigned int hash, oop protection_domain) {
+ProtectionDomainCacheEntry* ProtectionDomainCacheTable::add_entry(int index, unsigned int hash, Handle protection_domain) {
   assert_locked_or_safepoint(SystemDictionary_lock);
   assert(index == index_for(protection_domain), "incorrect index?");
   assert(find_entry(index, protection_domain) == NULL, "no double entry");
@@ -651,7 +652,7 @@
 }
 
 void ProtectionDomainCacheTable::free(ProtectionDomainCacheEntry* to_delete) {
-  unsigned int hash = compute_hash(to_delete->protection_domain());
+  unsigned int hash = compute_hash(Handle(Thread::current(), to_delete->protection_domain()));
   int index = hash_to_index(hash);
 
   ProtectionDomainCacheEntry** p = bucket_addr(index);

--- a/hotspot/src/share/vm/classfile/dictionary.hpp	Fri Feb 17 02:31:12 2017 +0000
+++ b/hotspot/src/share/vm/classfile/dictionary.hpp	Fri Feb 17 14:47:46 2017 -0500
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003, 2016, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2017, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -128,7 +128,7 @@
   // Sharing support
   void reorder_dictionary();
 
-  ProtectionDomainCacheEntry* cache_get(oop protection_domain);
+  ProtectionDomainCacheEntry* cache_get(Handle protection_domain);
 
   void print(bool details = true);
 #ifdef ASSERT
@@ -194,23 +194,23 @@
     return (ProtectionDomainCacheEntry**) Hashtable<oop, mtClass>::bucket_addr(i);
   }
 
-  ProtectionDomainCacheEntry* new_entry(unsigned int hash, oop protection_domain) {
-    ProtectionDomainCacheEntry* entry = (ProtectionDomainCacheEntry*) Hashtable<oop, mtClass>::new_entry(hash, protection_domain);
+  ProtectionDomainCacheEntry* new_entry(unsigned int hash, Handle protection_domain) {
+    ProtectionDomainCacheEntry* entry = (ProtectionDomainCacheEntry*) Hashtable<oop, mtClass>::new_entry(hash, protection_domain());
     entry->init();
     return entry;
   }
 
-  static unsigned int compute_hash(oop protection_domain);
+  static unsigned int compute_hash(Handle protection_domain);
 
-  int index_for(oop protection_domain);
-  ProtectionDomainCacheEntry* add_entry(int index, unsigned int hash, oop protection_domain);
-  ProtectionDomainCacheEntry* find_entry(int index, oop protection_domain);
+  int index_for(Handle protection_domain);
+  ProtectionDomainCacheEntry* add_entry(int index, unsigned int hash, Handle protection_domain);
+  ProtectionDomainCacheEntry* find_entry(int index, Handle protection_domain);
 
 public:
 
   ProtectionDomainCacheTable(int table_size);
 
-  ProtectionDomainCacheEntry* get(oop protection_domain);
+  ProtectionDomainCacheEntry* get(Handle protection_domain);
   void free(ProtectionDomainCacheEntry* entry);
 
   void unlink(BoolObjectClosure* cl);
@@ -275,7 +275,7 @@
   // Tells whether a protection is in the approved set.
   bool contains_protection_domain(oop protection_domain) const;
   // Adds a protection domain to the approved set.
-  void add_protection_domain(Dictionary* dict, oop protection_domain);
+  void add_protection_domain(Dictionary* dict, Handle protection_domain);
 
   Klass* klass() const { return (Klass*)literal(); }
   Klass** klass_addr() { return (Klass**)literal_addr(); }