FULL PRODUCT VERSION :
java version "1.8.0_91"
Java(TM) SE Runtime Environment (build 1.8.0_91-b14)
Java HotSpot(TM) Client VM (build 25.91-b14, mixed mode)

ADDITIONAL OS VERSION INFORMATION :
Microsoft Windows [Version 6.3.9600]

A DESCRIPTION OF THE PROBLEM :
When launching a simple Web Start application with a dependency on the log4j 1.2.17 library (as can be found on http://mvnrepository.com/artifact/log4j/log4j/1.2.17 ) , with the Web Start application and the log4j library signed with a certificate. We get the "Unable to launch the application." dialog. This error happens because of: Caused by: java.lang.SecurityException: class "org.apache.log4j.spi.RootLogger" does not match trust level of other classes in the same package .

See the crash log below for the full stacktrace.

In our test setup there are only two jars (our own test jar, and the log4j jar).

REGRESSION. Last worked in version 8u73

ADDITIONAL REGRESSION INFORMATION:
java version "1.8.0_73"
Java(TM) SE Runtime Environment (build 1.8.0_73-b02)
Java HotSpot(TM) Client VM (build 25.73-b02, mixed mode, sharing)

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Create a simple Web Start application, with the given source code.

Create a jar for the source code, sign it, add it to the Web Start deployment.
Sign the log4j library, and add it to the Web Start deployment.

Create a simple jnlp file with the two jars as resources.

Launch the Web Start application.

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
The Web Start application launches and shows a simple dialog.
ACTUAL -
The Unable to launch the application dialog because of an application error. Details can be found in the error messages / crash logs field.

ERROR MESSAGES/STACK TRACES THAT OCCUR :
java.lang.ExceptionInInitializerError
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at com.sun.javaws.Launcher.executeApplication(Unknown Source)
at com.sun.javaws.Launcher.executeMainClass(Unknown Source)
at com.sun.javaws.Launcher.doLaunchApp(Unknown Source)
at com.sun.javaws.Launcher.run(Unknown Source)
at java.lang.Thread.run(Thread.java:745)
Caused by: java.lang.SecurityException: class "org.apache.log4j.spi.RootLogger" does not match trust level of other classes in the same package
at com.sun.deploy.security.CPCallbackHandler$ChildElement.checkResource(Unknown Source)
at com.sun.deploy.security.DeployURLClassPath$JarLoader.checkResource(Unknown Source)
at com.sun.deploy.security.DeployURLClassPath$JarLoader.getResource(Unknown Source)
at com.sun.deploy.security.DeployURLClassPath.getResource(Unknown Source)
at java.net.URLClassLoader$1.run(URLClassLoader.java:365)
at java.net.URLClassLoader$1.run(URLClassLoader.java:362)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:361)
at com.sun.jnlp.JNLPClassLoader.findClass(Unknown Source)
at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
at com.sun.jnlp.JNLPClassLoader.loadClass(Unknown Source)
at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
at org.apache.log4j.Logger.getLogger(Logger.java:117)
at com.planonsoftware.webstart.Main.<clinit>(Main.java:18)
... 9 more


REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
// src/com/planonsoftware/webstart/Main.java
package com.planonsoftware.webstart;

import javax.swing.*;
import java.awt.*;

public class Main {
  
  public static void main(String[] args) {
    JFrame frame = new JFrame("Webstart test");
    frame.setDefaultCloseOperation(JFrame.EXIT_ON_CLOSE);
    JLabel label = new JLabel();
    Container content = frame.getContentPane();
    content.add(label, BorderLayout.CENTER);
    String message = "Webstart test";

    label.setText(message);
    frame.pack();
    frame.show();
  }
}

// META-INF/MANIFEST.MF
Manifest-Version: 1.0
Permissions: all-permissions

// test.jnlp
<?xml version="1.0" encoding="UTF-8"?><jnlp spec="1.0+" codebase="http://localhost:8070/webstart_with_logging/">
  <information>
...
  </information>
  <security>
    <all-permissions/>
  </security>
  <resources>
    <j2se version="1.8*" java-vm-args="-da" initial-heap-size="32m" max-heap-size="700m"/>
    <jar href="test.jar"/>
    <jar href="log4j-1.2.17.jar"/>
  </resources>
  <application-desc main-class="com.planonsoftware.webstart.Main"/>
</jnlp>

---------- END SOURCE ----------