There two parts to this bug.

PART 1:
The following “compute” and "merge" methods expects wrong permission which is removeProviderProperty{name} against what spec states (removeProviderProperty.{name}),
• Provider# compute(Object key, BiFunction remappingFunction)
• Provider#computeIfAbsent(Object key, Function mappingFunction)
• Provider#computeIfPresent(Object key, BiFunction remappingFunction)
• Provider#merge((Object key, Object value, BiFunction remappingFunction) -- See JDK-8156052
PART 2:
Besides the above problem, I have also noticed peculiar problem specifically originating from the following compute method,
• Provider# compute(Object key, BiFunction remappingFunction)
The issue here is even when I provide the wrong permission (for testing purpose to just pass it and checking any other problems besides security exception) ,this method is internally casting the BiFunction to Function and breaking with ClassCastException.
 
Please find the attached ready-to-run test case .