--- a/corba/src/java.corba/share/classes/com/sun/corba/se/spi/orb/ORB.java	Thu Jan 26 21:20:28 2017 +0000
+++ b/corba/src/java.corba/share/classes/com/sun/corba/se/spi/orb/ORB.java	Fri Jan 27 16:28:56 2017 +0000
@@ -31,9 +31,6 @@
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.logging.Logger ;
 
-import java.security.AccessController ;
-import java.security.PrivilegedAction ;
-
 import org.omg.CORBA.TCKind ;
 
 import com.sun.corba.se.pept.broker.Broker ;
@@ -89,9 +86,6 @@
 
 import com.sun.corba.se.impl.presentation.rmi.PresentationManagerImpl ;
 
-import jdk.internal.misc.JavaAWTAccess;
-import jdk.internal.misc.SharedSecrets;
-
 public abstract class ORB extends com.sun.corba.se.org.omg.CORBA.ORB
     implements Broker, TypeCodeFactory
 {
@@ -164,12 +158,9 @@
 
     static class Holder {
         static final PresentationManager defaultPresentationManager =
-            setupPresentationManager();
+                                         setupPresentationManager();
     }
 
-    private static final Map<Object, PresentationManager> pmContexts =
-            new ConcurrentHashMap<>();
-
     private static Map<StringPair, LogWrapperBase> staticWrapperMap =
             new ConcurrentHashMap<>();
 
@@ -198,23 +189,10 @@
         byteBufferPool = null;
     }
 
-    /**
-     * Returns the Presentation Manager for the current thread group, using the ThreadGroup-specific
-     * AppContext to hold it. Creates and records one if needed.
+    /** Get the single instance of the PresentationManager
      */
     public static PresentationManager getPresentationManager()
     {
-        SecurityManager sm = System.getSecurityManager();
-        JavaAWTAccess javaAwtAccess = SharedSecrets.getJavaAWTAccess();
-        if (sm != null && javaAwtAccess != null) {
-            final Object appletContext = javaAwtAccess.getAppletContext();
-            if (appletContext != null) {
-                return pmContexts.computeIfAbsent(appletContext,
-                    x -> setupPresentationManager());
-            }
-        }
-
-        // No security manager or AppletAppContext
         return Holder.defaultPresentationManager;
     }
 

--- a/corba/src/java.corba/share/classes/org/omg/CORBA/ORB.java	Thu Jan 26 21:20:28 2017 +0000
+++ b/corba/src/java.corba/share/classes/org/omg/CORBA/ORB.java	Fri Jan 27 16:28:56 2017 +0000
@@ -36,8 +36,6 @@
 import java.security.AccessController;
 import java.security.PrivilegedAction;
 
-import sun.reflect.misc.ReflectUtil;
-
 /**
  * A class providing APIs for the CORBA Object Request Broker
  * features.  The {@code ORB} class also provides
@@ -188,6 +186,24 @@
     private static final String ORBClassKey = "org.omg.CORBA.ORBClass";
     private static final String ORBSingletonClassKey = "org.omg.CORBA.ORBSingletonClass";
 
+    // check that access to the class is not restricted by the security manager.
+    private static void checkPackageAccess(String name) {
+        SecurityManager s = System.getSecurityManager();
+        if (s != null) {
+            String cname = name.replace('/', '.');
+            if (cname.startsWith("[")) {
+                int b = cname.lastIndexOf('[') + 2;
+                if (b > 1 && b < cname.length()) {
+                    cname = cname.substring(b);
+                }
+            }
+            int i = cname.lastIndexOf('.');
+            if (i != -1) {
+                s.checkPackageAccess(cname.substring(0, i));
+            }
+        }
+    }
+
     //
     // The global instance of the singleton ORB implementation which
     // acts as a factory for typecodes for generated Helper classes.
@@ -318,7 +334,7 @@
    private static ORB create_impl_with_systemclassloader(String className) {
 
         try {
-            ReflectUtil.checkPackageAccess(className);
+            checkPackageAccess(className);
             ClassLoader cl = ClassLoader.getSystemClassLoader();
             Class<org.omg.CORBA.ORB> orbBaseClass = org.omg.CORBA.ORB.class;
             Class<?> singletonOrbClass = Class.forName(className, true, cl).asSubclass(orbBaseClass);
@@ -337,7 +353,7 @@
             cl = ClassLoader.getSystemClassLoader();
 
         try {
-            ReflectUtil.checkPackageAccess(className);
+            checkPackageAccess(className);
             Class<org.omg.CORBA.ORB> orbBaseClass = org.omg.CORBA.ORB.class;
             Class<?> orbClass = Class.forName(className, true, cl).asSubclass(orbBaseClass);
             return (ORB)orbClass.newInstance();

--- a/corba/src/java.corba/share/classes/sun/corba/Bridge.java	Thu Jan 26 21:20:28 2017 +0000
+++ b/corba/src/java.corba/share/classes/sun/corba/Bridge.java	Fri Jan 27 16:28:56 2017 +0000
@@ -29,6 +29,10 @@
 import java.lang.invoke.MethodHandle;
 import java.lang.reflect.Field ;
 import java.lang.reflect.Constructor ;
+import java.lang.StackWalker;
+import java.lang.StackWalker.StackFrame;
+import java.util.Optional;
+import java.util.stream.Stream;
 
 import java.security.AccessController;
 import java.security.Permission;
@@ -58,6 +62,7 @@
  * <li>RuntimePermission "reflectionFactoryAccess"</li>
  * <li>BridgePermission "getBridge"</li>
  * <li>ReflectPermission "suppressAccessChecks"</li>
+ * <li>StackFramePermission "retainClassReference"</li>
  * </ul>
  * <p>
  * All of these permissions are required to obtain and correctly initialize
@@ -89,9 +94,12 @@
     ) ;
 
     private final ReflectionFactory reflectionFactory ;
+    private final StackWalker stackWalker;
 
     private Bridge() {
         reflectionFactory = ReflectionFactory.getReflectionFactory();
+        stackWalker  = StackWalker.getInstance(
+                            StackWalker.Option.RETAIN_CLASS_REFERENCE);
     }
 
     /** Fetch the Bridge singleton.  This requires the following
@@ -100,6 +108,7 @@
      * <li>RuntimePermission "reflectionFactoryAccess"</li>
      * <li>BridgePermission "getBridge"</li>
      * <li>ReflectPermission "suppressAccessChecks"</li>
+     * <li>StackFramePermission "retainClassReference"</li>
      * </ul>
      * @return The singleton instance of the Bridge class
      * @throws SecurityException if the caller does not have the
@@ -118,11 +127,33 @@
         return bridge ;
     }
 
+    /** Returns true if the loader that loaded the frame's declaring class
+     * is a user loader (if it is not the platform class loader or one of
+     * its ancestor).
+     */
+    private boolean isUserLoader(StackFrame sf) {
+        ClassLoader cl = sf.getDeclaringClass().getClassLoader();
+        if (cl == null) return false;
+        ClassLoader p = ClassLoader.getPlatformClassLoader();
+        while (cl != p && p != null) p = p.getParent();
+        return cl != p;
+    }
+
+    private Optional<StackFrame> getLatestUserDefinedLoaderFrame(Stream<StackFrame> stream) {
+        return stream.filter(this::isUserLoader).findFirst();
+    }
+
+
     /** Obtain the latest user defined ClassLoader from the call stack.
      * This is required by the RMI-IIOP specification.
      */
     public final ClassLoader getLatestUserDefinedLoader() {
-        return jdk.internal.misc.VM.latestUserDefinedLoader();
+        // requires getClassLoader permission => needs doPrivileged.
+        PrivilegedAction<ClassLoader> pa = () ->
+            stackWalker.walk(this::getLatestUserDefinedLoaderFrame)
+                .map(sf -> sf.getDeclaringClass().getClassLoader())
+                .orElseGet(() -> ClassLoader.getPlatformClassLoader());
+        return AccessController.doPrivileged(pa);
     }
 
     /**