FULL PRODUCT VERSION :
java version "1.8.0_91"
Java(TM) SE Runtime Environment (build 1.8.0_91-b14)
Java HotSpot(TM) Client VM (build 25.91-b14, mixed mode)


ADDITIONAL OS VERSION INFORMATION :
Windows 7 Professional

A DESCRIPTION OF THE PROBLEM :
A web start application, running fine for years for thousands of customers (99.99% on Windows OSs), can no longer start up if jre 1.8.0_91 is the installed java version (installed by java automatic update).
The same version of the app (including the same jnlp file) works in 1.8.0_51.

Exception:
java.lang.SecurityException: class "org.apache.log4j.spi.RootLogger" does not match trust level of other classes in the same package.

The exception message is in error, all resource jars are signed the same way with the same key.

There could be some random element included: one out of 50 start attempts did actually launch the app.


REGRESSION. Last worked in version 8u73

ADDITIONAL REGRESSION INFORMATION:
java version "1.8.0_91"
Java(TM) SE Runtime Environment (build 1.8.0_91-b14)
Java HotSpot(TM) Client VM (build 25.91-b14, mixed mode)

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
If required, a developer may contact me to get the jnlp file uri.

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
Application startup.
ACTUAL -
Application crash.

ERROR MESSAGES/STACK TRACES THAT OCCUR :
java.lang.SecurityException: class "org.apache.log4j.spi.RootLogger" does not match trust level of other classes in the same package
at com.sun.deploy.security.CPCallbackHandler$ChildElement.checkResource(Unknown Source)
at com.sun.deploy.security.DeployURLClassPath$JarLoader.checkResource(Unknown Source)
at com.sun.deploy.security.DeployURLClassPath$JarLoader.getResource(Unknown Source)
at com.sun.deploy.security.DeployURLClassPath.getResource(Unknown Source)
at java.net.URLClassLoader$1.run(Unknown Source)
at java.net.URLClassLoader$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(Unknown Source)
at com.sun.jnlp.JNLPClassLoader.findClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at com.sun.jnlp.JNLPClassLoader.loadClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at org.slf4j.impl.Log4jLoggerFactory.getLogger(Log4jLoggerFactory.java:66)
at org.slf4j.LoggerFactory.getLogger(LoggerFactory.java:277)
at org.slf4j.LoggerFactory.getLogger(LoggerFactory.java:288)
at griffon.core.GriffonExceptionHandler.<clinit>(GriffonExceptionHandler.java:42)
at org.codehaus.griffon.runtime.core.AbstractGriffonApplication.run(AbstractGriffonApplication.java:91)
at org.codehaus.griffon.runtime.core.AbstractGriffonApplication$run.call(Unknown Source)
at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCall(CallSiteArray.java:45)
at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:108)
at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:120)
at com.owneronline.webstartapp.Launcher.main(Launcher.groovy:11)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at com.sun.javaws.Launcher.executeApplication(Unknown Source)
at com.sun.javaws.Launcher.executeMainClass(Unknown Source)
at com.sun.javaws.Launcher.doLaunchApp(Unknown Source)
at com.sun.javaws.Launcher.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)


REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
This is the jnlp file.

<?xml version='1.0' encoding='UTF-8'?>
<jnlp spec='7.0' version='2.1' codebase='http://owner-staging.developer.com/webstartapp/webstart2&#39;>
  <information>
    <title>ApplicationNamePro 2.0</title>
    <vendor>ownerOnline</vendor>
    <homepage href='http://www.owneronline.com/&#39; />
    <description>ApplicationNamePro 2.0: Automating content distribution for customers of ownerOnline.</description>
    <description kind='one-line'>ownerOnline distribution downloader for several operating systems.</description>
    <description kind='short'>ownerOnline distribution downloader</description>
    <description kind='tooltip'>ApplicationNamePro 2.0</description>
    <icon href='owner-64x64-1.0.png' kind='default' width='64' height='64' />
    <icon href='owner-Splash400x307-2.0.png' kind='splash' width='400' height='307' />
    <icon href='owner-64x64-1.0.png' kind='selected' width='64' height='64' />
    <icon href='owner-64x64-1.0.png' kind='disabled' width='64' height='64' />
    <icon href='owner-64x64-1.0.png' kind='rollover' width='64' height='64' />
    <icon href='owner-64x64-1.0.png' kind='shortcut' width='64' height='64' />
    <offline-allowed />
  </information>
  <security>
    <all-permissions />
  </security>
  <update check='always' policy='always' />
  <resources>
    <property name='jnlp.webstartapp.web_service_base_url' value='http://owner-staging.developer.com/basepath&#39; />
    <property name='jnlp.webstartapp.env' value='staging' />
    <property name='sc.version' value='(sc.version)' />
  </resources>
  <resources os='FreeBSD'>
    <property name='os.name' value='FreeBSD' />
  </resources>
  <resources os='Linux'>
    <property name='os.name' value='Linux' />
  </resources>
  <resources os='Mac\ OS'>
    <property name='os.name' value='Mac OS' />
  </resources>
  <resources os='Mac\ OS\ X'>
    <property name='os.name' value='Mac OS X' />
  </resources>
  <resources os='Solaris'>
    <property name='os.name' value='Solaris' />
  </resources>
  <resources os='SunOS'>
    <property name='os.name' value='SunOS' />
  </resources>
  <resources os='Windows\ NT'>
    <property name='os.name' value='Windows NT' />
  </resources>
  <resources os='Windows\ 95'>
    <property name='os.name' value='Windows 95' />
  </resources>
  <resources os='Windows\ 98'>
    <property name='os.name' value='Windows 98' />
  </resources>
  <resources os='Windows\ CE'>
    <property name='os.name' value='Windows CE' />
  </resources>
  <resources os='Windows\ Me'>
    <property name='os.name' value='Windows Me' />
  </resources>
  <resources os='Windows\ XP'>
    <property name='os.name' value='Windows XP' />
  </resources>
  <resources os='Windows\ Vista'>
    <property name='os.name' value='Windows Vista' />
  </resources>
  <resources os='Windows\ 2000'>
    <property name='os.name' value='Windows 2000' />
  </resources>
  <resources os='Windows\ 2003'>
    <property name='os.name' value='Windows 2003' />
  </resources>
  <resources os='Windows\ 7'>
    <property name='os.name' value='Windows 7' />
  </resources>
  <resources os='Windows\ 8'>
    <property name='os.name' value='Windows 8' />
  </resources>
  <resources os='Windows\ 8.1'>
    <property name='os.name' value='Windows 8.1' />
  </resources>
  <resources os='Windows\ 8.2'>
    <property name='os.name' value='Windows 8.2' />
  </resources>
  <resources os='Windows\ 10'>
    <property name='os.name' value='Windows 10' />
  </resources>
  <resources arch='x86'>
    <property name='os.arch' value='x86' />
  </resources>
  <resources arch='x86_64'>
    <property name='os.arch' value='x86_64' />
  </resources>
  <resources arch='i386'>
    <property name='os.arch' value='i386' />
  </resources>
  <resources arch='i686'>
    <property name='os.arch' value='i686' />
  </resources>
  <resources arch='amd64'>
    <property name='os.arch' value='amd64' />
  </resources>
  <resources arch='ppc'>
    <property name='os.arch' value='ppc' />
  </resources>
  <resources arch='PowerPC'>
    <property name='os.arch' value='PowerPC' />
  </resources>
  <resources arch='ppc64'>
    <property name='os.arch' value='ppc64' />
  </resources>
  <resources arch='sparc'>
    <property name='os.arch' value='sparc' />
  </resources>
  <resources arch='armv'>
    <property name='os.arch' value='armv' />
  </resources>
  <resources arch='armv41'>
    <property name='os.arch' value='armv41' />
  </resources>
  <resources arch='PA-RISC'>
    <property name='os.arch' value='PA-RISC' />
  </resources>
  <resources arch='PA-RISC2.0'>
    <property name='os.arch' value='PA-RISC2.0' />
  </resources>
  <resources arch='IA64N'>
    <property name='os.arch' value='IA64N' />
  </resources>
  <resources arch='Power'>
    <property name='os.arch' value='Power' />
  </resources>
  <resources arch='POWER_RS'>
    <property name='os.arch' value='POWER_RS' />
  </resources>
  <resources arch='02.10.00'>
    <property name='os.arch' value='02.10.00' />
  </resources>
  <resources arch='mips'>
    <property name='os.arch' value='mips' />
  </resources>
  <resources arch='alpha'>
    <property name='os.arch' value='alpha' />
  </resources>
  <resources>
    <j2se version='1.7+' max-heap-size='256m' />
    <jar href='lib/shared__V2.1.jar' />
    <jar href='lib/groovy-swing__V2.3.8.jar' />
    <jar href='lib/groovy-jmx__V2.3.8.jar' />
    <jar href='lib/griffon-guice__V2.1.0.jar' />
    <jar href='lib/jnlp__V1.8.0.5.jar' />
    <jar href='lib/miglayout-swing__V4.2.jar' />
    <jar href='lib/griffon-miglayout-swing-groovy__V1.0.0-SNAPSHOT.jar' />
    <jar href='lib/griffon-core__V2.1.0.jar' />
    <jar href='lib/griffon-swing__V2.1.0.jar' />
    <jar href='lib/griffon-swing-groovy__V2.1.0.jar' />
    <jar href='lib/griffon-groovy__V2.1.0.jar' />
    <jar href='lib/griffon-nuvolaicons-core__V1.0.0.jar' />
    <jar href='lib/griffon-nuvolaicons-swing__V1.0.0.jar' />
    <jar href='lib/griffon-nuvolaicons-swing-groovy__V1.0.0.jar' />
    <jar href='lib/ApplicationNamePro-staging__V2.0.jar' main='true' />
    <jar href='lib/groovy__V2.3.8.jar' />
    <jar href='lib/slf4j-log4j12__V1.7.7.jar' />
    <jar href='lib/xstream__V1.4.2.jar' />
    <jar href='lib/groovy-wslite__V0.7.0.jar' />
    <jar href='lib/com.springsource.org.apache.commons.cli__V1.2.0.jar' />
    <jar href='lib/commons-beanutils__V1.8.0.jar' />
    <jar href='lib/scriptom__V1.6.0.jar' />
    <jar href='lib/guice__V3.0.jar' />
    <jar href='lib/miglayout-core__V4.2.jar' />
    <jar href='lib/javax.inject__V1.jar' />
    <jar href='lib/jsr305__V3.0.0.jar' />
    <jar href='lib/slf4j-api__V1.7.7.jar' />
    <jar href='lib/log4j__V1.2.17.jar' />
    <jar href='lib/xmlpull__V1.1.3.1.jar' />
    <jar href='lib/xpp3_min__V1.1.4c.jar' />
    <jar href='lib/commons-logging__V1.1.1.jar' />
    <jar href='lib/jacob__V1.14.3.jar' />
    <jar href='lib/aopalliance__V1.0.jar' />
    <property name='jnlp.packEnabled' value='true' />
  </resources>
  <application-desc main-class='com.owneronline.webstartapp.Launcher' name='ApplicationNamePro'>
    <argument>-verbose</argument>
  </application-desc>
</jnlp>

---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
None found.
Tried: relaxing all security settings in the java control panel. Fail.
Tried: specify a know good j2se version in jnlp, but THE VALUE IS NOT HONOURED BY WEB START (the old java does not get installed, which one obviously expects in this case). Fail.

And by the way: I would have checked the web start code myself if it had been available in git. Saved you some trouble maybe.