If a signed jnlp file lists a lazy jar that is signed with a different certificate than the main jar, or if it contains a signed extension with all jars lazy, then attempting to load a class in that jar can result in showing the security dialog.
In this case the dialog is shown with the URLClassLoader locked.
within the more info dialog the constructor of a JTextArea can then deadlock when callint Class.forName(className, true, Thread.currentThread().getContextClassLoader())

"AWT-EventQueue-1" prio=6 tid=0x02e5bc00 nid=0xf5c waiting for monitor entry [0x
0375e000..0x0375fd94]
   java.lang.Thread.State: BLOCKED (on object monitor)
        at java.lang.Class.forName0(Native Method)
        at java.lang.Class.forName(Unknown Source)
        at java.awt.datatransfer.DataFlavor.tryToLoadClass(Unknown Source)
        at java.awt.datatransfer.DataFlavor.initialize(Unknown Source)
        at java.awt.datatransfer.DataFlavor.<init>(Unknown Source)
        at java.awt.datatransfer.SystemFlavorMap.parseAndStoreReader(Unknown Sou
rce)
        at java.awt.datatransfer.SystemFlavorMap.<init>(Unknown Source)
        at java.awt.datatransfer.SystemFlavorMap.getDefaultFlavorMap(Unknown Sou
rce)
        - locked <0x22efac80> (a java.util.WeakHashMap)
        at java.awt.dnd.DropTarget.<init>(Unknown Source)
        at java.awt.dnd.DropTarget.<init>(Unknown Source)
        at javax.swing.TransferHandler$SwingDropTarget.<init>(Unknown Source)
        at javax.swing.SwingUtilities.installSwingDropTargetAsNecessary(Unknown
Source)
        at javax.swing.JComponent.setTransferHandler(Unknown Source)
        at javax.swing.plaf.basic.BasicTextUI.installDefaults2(Unknown Source)
        at javax.swing.plaf.basic.BasicTextUI.installUI(Unknown Source)
        at javax.swing.JComponent.setUI(Unknown Source)
        at javax.swing.text.JTextComponent.setUI(Unknown Source)
        at javax.swing.text.JTextComponent.updateUI(Unknown Source)
        at javax.swing.text.JTextComponent.<init>(Unknown Source)
        at javax.swing.JTextArea.<init>(Unknown Source)
        at javax.swing.JTextArea.<init>(Unknown Source)
        at com.sun.deploy.ui.MoreInfoDialog.initComponents(MoreInfoDialog.java:133)
        at com.sun.deploy.ui.MoreInfoDialog.<init>(MoreInfoDialog.java:96)
        at com.sun.deploy.ui.DialogTemplate.showMoreInfo(DialogTemplate.java:1319)
        at com.sun.deploy.ui.DialogTemplate.actionPerformed(DialogTemplate.java:


the real problem is, that within the secureThreadGroup, Thread.currentThread().getContextClassLoader() should not be the jnlp class loader.

in deploySysRun, when we create a new thread in the security thread group, we should explicitly set it's contextClassLoader.