In JDK 9 jar files in lib/ext are no longer granted all permissions by default. We deliver a policy file into the JDK 9 build such that JRE/lib/ext/jfxrt.jar is granted all permissions. This allows sandboxed apps that are run with a standard JDK 9 to continue to work.

When we run our JavaFX build, we run it with a JDK that has the jfxrt.jar removed so we can test the jfxrt.jar that we just built. In our sandbox.SandboxAppTest unit test, we set a security manager and also set -Djava.ext.dirs to our local JavaFX build. Once we switch to using JDK 9 to build and test FX 9, this will start failing.