--- old/src/share/classes/javax/crypto/JceSecurity.java	Fri May 16 15:07:08 2014
+++ new/src/share/classes/javax/crypto/JceSecurity.java	Fri May 16 15:07:08 2014
@@ -219,23 +219,25 @@
      * Retuns the CodeBase for the given class.
      */
     static URL getCodeBase(final Class<?> clazz) {
-        URL url = codeBaseCacheRef.get(clazz);
-        if (url == null) {
-            url = AccessController.doPrivileged(new PrivilegedAction<URL>() {
-                public URL run() {
-                    ProtectionDomain pd = clazz.getProtectionDomain();
-                    if (pd != null) {
-                        CodeSource cs = pd.getCodeSource();
-                        if (cs != null) {
-                            return cs.getLocation();
+        synchronized (codeBaseCacheRef) {
+            URL url = codeBaseCacheRef.get(clazz);
+            if (url == null) {
+                url = AccessController.doPrivileged(new PrivilegedAction<URL>() {
+                    public URL run() {
+                        ProtectionDomain pd = clazz.getProtectionDomain();
+                        if (pd != null) {
+                            CodeSource cs = pd.getCodeSource();
+                            if (cs != null) {
+                                return cs.getLocation();
+                            }
                         }
+                        return NULL_URL;
                     }
-                    return NULL_URL;
-                }
-            });
-            codeBaseCacheRef.put(clazz, url);
+                });
+                codeBaseCacheRef.put(clazz, url);
+            }
+            return (url == NULL_URL) ? null : url;
         }
-        return (url == NULL_URL) ? null : url;
     }
 
     private static void setupJurisdictionPolicies() throws Exception {