J2EE RI 1.4 uses the default policy implementation in J2SE. At deployment each application creates certain JACC permissions in policy files and then calls Policy.refresh. At runtime a call is made to Policy.implies to check for access permission rights, this results in a lot of calls being made to UnresolvePermission.resolve. The overhead due to this call is about 30% of the total cost of a single method call. This is a significant issue for performance.
The following is cut from emails flowing on the issue
>>> Please see the following optimizeit profiles:
>
>>> http://javaweb.sfbay/~tcng/jsr115-heapdata.html (expanded)
>>> http://javaweb.sfbay/~tcng/jsr115-heapdata1.html (collapsed)
>
>>> One interesting thing is that there are about 80
>>> invocations of PolicyFile.implies() but that
>>> translates into ~17000 invocations of
UnresolvedPermission.resolve()