The default implementation of java.security.Policy.implies() and getPermissions() will throw a null pointer exception if a legacy provider is installed on the bootclasspath. This is due to the attempt to syncrhonize access to the pdMapping member.