the patch for 8049824 points to the blacklisted.certs file generated at build time and the diff for the patch

make/ant/Release.build.xml

- <copy file="${basedir}/../jdk/src/share/lib/security/blacklisted.certs"
+ <copy file="${ws.output.generated.root}/../images/j2sdk-image/jre/lib/security/blacklisted.certs"

it calculates path to the cert file using ${ws.output.generated.root}.

perhaps it would be more straightforward to use ${ws.image.jre}