Update

Author: taoliult

closed/src/java.base/share/classes/openj9/internal/security/RestrictedSecurity.java

@@ -137,6 +137,18 @@ private RestrictedSecurity() {
         super();
     }
 
+    private static boolean isJarVerifierInStackTrace() {
+         java.util.function.Predicate<Class<?>> isJarVerifier =
+                clazz -> "java.util.jar.JarVerifier".equals(clazz.getName())
+                      && "java.base".equals(clazz.getModule().getName());
+
+        java.util.function.Function<Stream<StackWalker.StackFrame>, Boolean> matcher =
+                stream -> stream.map(StackWalker.StackFrame::getDeclaringClass)
+                                .anyMatch(isJarVerifier);
+
+        return StackWalker.getInstance(StackWalker.Option.RETAIN_CLASS_REFERENCE).walk(matcher);
+    }
+
     /**
      * Check loaded profiles' hash values.
      *
@@ -154,19 +166,19 @@ private static void checkHashValues(boolean fromProviders) {
             if (fromProviders) {
                 enableCheckHashes = true;
             }
-            if (enableCheckHashes && (hashPauseCount.get() == 0)) {
+            if (enableCheckHashes && !isJarVerifierInStackTrace() && (hashPauseCount.get() == 0)) {
                 profileParser = null;
                 parser.checkHashValues();
             }
         }
     }
 
     public static void pauseHashCheck() {
-            hashPauseCount.incrementAndGet();
+        hashPauseCount.incrementAndGet();
     }
 
     public static void resumeHashCheck() {
-            hashPauseCount.decrementAndGet();
+        hashPauseCount.decrementAndGet();
     }
 
     /**
@@ -252,6 +264,7 @@ public static boolean isServiceAllowed(Service service) {
      */
     public static boolean canServiceBeRegistered(Service service) {
         if (securityEnabled) {
+            checkHashValues(false);
             return restricts.isRestrictedServiceAllowed(service, false);
         }
         return true;

src/java.base/share/classes/java/util/jar/JarFile.java

@@ -32,9 +32,9 @@
 package java.util.jar;
 
 import jdk.internal.access.SharedSecrets;
-import openj9.internal.security.RestrictedSecurity;
 import jdk.internal.access.JavaUtilZipFileAccess;
 import jdk.internal.misc.ThreadTracker;
+import openj9.internal.security.RestrictedSecurity;
 import sun.security.util.ManifestEntryVerifier;
 import sun.security.util.SignatureFileVerifier;