The JAAS-merged sun.security.provider.PolicyFile incorrectly implements matching against grants with ANDs of principals. It appears to implement "match against the last principal" instead of "match against all the principals".

Execute the attached test program with the attached policy file. It should print false, false, true, but instead prints true, false, true.