--- a/jdk/src/share/classes/javax/security/auth/Subject.java	Sat Sep 07 20:27:20 2013 -0700
+++ b/jdk/src/share/classes/javax/security/auth/Subject.java	Fri Sep 13 15:37:39 2013 +0800
@@ -964,6 +964,10 @@
 
         s.defaultReadObject();
 
+        // Rewrap the principals into a SecureSet
+        principals = Collections.synchronizedSet(new SecureSet<Principal>
+                                (this, PRINCIPAL_SET, principals));
+
         // The Credential {@code Set} is not serialized, but we do not
         // want the default deserialization routine to set it to null.
         this.pubCredentials = Collections.synchronizedSet