src/hotspot/share/oops/instanceKlass.cpp

@@ -240,40 +240,36 @@
       // class as a nest member. If any of these conditions are not met we post the
       // requested exception type (if any) and return NULL
 
       const char* error = NULL;
 
-      // Need to check we have an instance class first
+      // JVMS 5.4.4 indicates package check comes first
+      if (is_same_class_package(k)) {
+
+        // Now check actual membership. We can't be a member if our "host" is
+        // not an instance class.
       if (k->is_instance_klass()) {
         nest_host_k = InstanceKlass::cast(k);
 
         // FIXME: an exception from this is perhaps impossible
         bool is_member = nest_host_k->has_nest_member(this, CHECK_NULL);
         if (is_member) {
-          // Finally check we're in the same package - as there could be collusion
-          // between untrusted types.
-          if (is_same_class_package(nest_host_k)) {
             // save resolved nest-host value
             _nest_host = nest_host_k;
 
             if (log_is_enabled(Trace, class, nestmates)) {
               ResourceMark rm(THREAD);
               log_trace(class, nestmates)("Resolved nest-host of %s to %s",
                                           this->external_name(), k->external_name());
             }
             return nest_host_k;
           }
-          else {
-            error = "types are in different packages";
-          }
         }
-        else {
           error = "current type is not listed as a nest member";
         }
-      }
       else {
-        error = "nest-host is not an instance class!";
+        error = "types are in different packages";
       }
 
       if (log_is_enabled(Trace, class, nestmates)) {
         ResourceMark rm(THREAD);
         log_trace(class, nestmates)("Type %s is not a nest member of resolved type %s: %s",

@@ -312,22 +308,22 @@
 // resolved_nest_hosts
 bool InstanceKlass::has_nestmate_access_to(InstanceKlass* k, TRAPS) {
 
   assert(this != k, "this should be handled by higher-level code");
 
-  // Per the JVMS we first resolve and validate the current class, then
+  // Per JVMS 5.4.4 we first resolve and validate the current class, then
   // the target class k. Resolution exceptions will be passed on by upper
-  // layers. IllegalAccessErrors from membership validation failures will
-  // also be passed through.
+  // layers. IncompatibleClassChangeErrors from membership validation failures
+  // will also be passed through.
 
-  Symbol* iae = vmSymbols::java_lang_IllegalAccessError();
-  InstanceKlass* cur_host = nest_host(iae, THREAD);
+  Symbol* icce = vmSymbols::java_lang_IncompatibleClassChangeError();
+  InstanceKlass* cur_host = nest_host(icce, THREAD);
   if (cur_host == NULL || HAS_PENDING_EXCEPTION) {
     return false;
   }
 
-  Klass* k_nest_host = k->nest_host(iae, THREAD);
+  Klass* k_nest_host = k->nest_host(icce, THREAD);
   if (k_nest_host == NULL || HAS_PENDING_EXCEPTION) {
     return false;
   }
 
   bool access = (cur_host == k_nest_host);