All permission code should be able to do any operation including reflection. In the case of a JavaFX application that uses the javafx.concurrent.Service API this doesn't work correctly when run as a Java Web Start application.

Note that this bug was transferred from JDK-8040699 which was confidential, although it didn't need to be (it did have internal URLs, so those have been moved to Confidential comments so the entire bug doesn't need to be confidential).