--- a/src/share/classes/javax/crypto/JceSecurityManager.java	Mon Sep 03 14:35:06 2012 +0100
+++ b/src/share/classes/javax/crypto/JceSecurityManager.java	Mon Sep 03 14:33:02 2012 +0100
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1999, 2007, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1999, 2012, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -29,6 +29,8 @@ import java.net.*;
 import java.net.*;
 import java.util.*;
 import java.util.jar.*;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ConcurrentMap;
 
 /**
  * The JCE security manager.
@@ -51,7 +53,10 @@ final class JceSecurityManager extends S
     private static final CryptoPermissions exemptPolicy;
     private static final CryptoAllPermission allPerm;
     private static final Vector TrustedCallersCache = new Vector(2);
-    private static final Map exemptCache = new HashMap();
+    private static final ConcurrentMap<URL,CryptoPermissions> exemptCache =
+            new ConcurrentHashMap<>();
+    private static final CryptoPermissions CACHE_NULL_MARK =
+            new CryptoPermissions();
 
     // singleton instance
     static final JceSecurityManager INSTANCE;
@@ -116,17 +121,19 @@ final class JceSecurityManager extends S
             return defaultPerm;
         }
 
-        CryptoPermissions appPerms;
-        synchronized (this.getClass()) {
-            if (exemptCache.containsKey(callerCodeBase)) {
-                appPerms = (CryptoPermissions)exemptCache.get(callerCodeBase);
-            } else {
-                appPerms = getAppPermissions(callerCodeBase);
-                exemptCache.put(callerCodeBase, appPerms);
-            }
-        }
-
+        CryptoPermissions appPerms = exemptCache.get(callerCodeBase);
         if (appPerms == null) {
+            // no match found in cache
+            synchronized (this.getClass()) {
+                appPerms = exemptCache.get(callerCodeBase);
+                if (appPerms == null) {
+                    appPerms = getAppPermissions(callerCodeBase);
+                    exemptCache.putIfAbsent(callerCodeBase,
+                        (appPerms == null? CACHE_NULL_MARK:appPerms));
+                }
+            }
+        }
+        if (appPerms == null || appPerms == CACHE_NULL_MARK) {
             return defaultPerm;
         }