During investigation of 6647956 (Browser authenticator not working correctly in new Java Plug-In) it was discovered that it is very easy to cause the HTTP authentication code in the core JRE to deadlock. The steps to reproduce the failure are as follows:

1. Install the JRE. This failure has been reproduced as far back as 1.4.2_16 and may even be reproducible in earlier JREs.
2. Use the Java Control Panel to enable the Java Console.
3. Navigate to the test case for 6647956 (http://j2se.east.sun.com/deployment/www/tests/1.6.0_10/6647956/).
4. Use the second link to open the test applet. (Do not navigate to the topmost link, and do not enter the username or password.)
5. Click "Cancel".
6. Click the browser's back button.
7. Navigate again to the applet.

The applet will fail to load because it is deadlocked waiting for a notification that will never arrive:

"thread applet-AuthApplet-2" prio=4 tid=0x0b3dd800 nid=0x3a8 in Object.wait() [0x0bbcf000..0x0bbcfb94]
   java.lang.Thread.State: WAITING (on object monitor)
at java.lang.Object.wait(Native Method)
- waiting on <0x03054848> (a java.util.HashMap)
at java.lang.Object.wait(Object.java:485)
at sun.net.www.protocol.http.AuthenticationInfo.requestIsInProgress(AuthenticationInfo.java:117)
- locked <0x03054848> (a java.util.HashMap)
at sun.net.www.protocol.http.AuthenticationInfo.getServerAuth(AuthenticationInfo.java:258)
at sun.net.www.protocol.http.HttpURLConnection.getServerAuthentication(HttpURLConnection.java:1640)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1087)
- locked <0x02a12cf8> (a sun.net.www.protocol.http.HttpURLConnection)
at AuthApplet.start(AuthApplet.java:20)
at sun.plugin2.applet.Applet2Manager$AppletExecutionRunnable.run(Applet2Manager.java:1508)
at java.lang.Thread.run(Thread.java:619)

It is incredible that such an obvious bug was not discovered until now. The fix should be applied and immediately backported to the latest update releases for all applicable release trains.