A java.security.DomainCombiner provides a means to dynamically
update the ProtectionDomains associated with the current
AccessControlContext.

A DomainCombiner is passed as a parameter to the
appropriate constructor for AccessControlContext.
The newly constructed context is then passed to the
AccessController.doPrivileged(..., context) method
to bind it (and its associated DomainCombiner)
to the current execution thread. Subsequent calls to
AccessController.getContext or AccessController.checkPermission
cause the DomainCombiner.combine method to get invoked.
The DomainCombiner.combiner method can then
update the ProtectionDomains as needed before the domains
are passed to the policy implementation for evaluation.

One consequence of the above approach is that a
DomainCombiner bound to the current execution thread
is lost during a subsequent call to AccessController.doPrivileged.
The reason is because doPrivileged truncates the call stack and
throws away the previously bound AccessControlContext
(where the DomainCombiner resides).
For example, if the current execution thread were
updated with user-specific information, that information
is lost during a call to doPrivileged.

This RFE proposes to modify doPrivileged to retain the combiner.