--- old/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Digest.java	2018-09-18 15:57:57.385361951 +0200
+++ new/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Digest.java	2018-09-18 15:57:57.133360255 +0200
@@ -143,7 +143,8 @@
         token.ensureValid();
 
         if (session != null) {
-            if (state == S_INIT && token.explicitCancel == true) {
+            if (state == S_INIT && token.explicitCancel == true
+                    && session.hasObjects() == false) {
                 session = token.killSession(session);
             } else {
                 session = token.releaseSession(session);
@@ -264,7 +265,12 @@
                 token.p11.C_DigestUpdate(session.id(), 0, buffer, 0, bufOfs);
                 bufOfs = 0;
             }
-            token.p11.C_DigestKey(session.id(), p11Key.keyID);
+            p11Key.incNativeKeyRef();
+            try {
+                token.p11.C_DigestKey(session.id(), p11Key.keyID);
+            } finally {
+                p11Key.decNativeKeyRef();
+            }
         } catch (PKCS11Exception e) {
             engineReset();
             throw new ProviderException("update(SecretKey) failed", e);