Behavior of java.net.URLPermission.getActions() contradicts the following assertions:
  
Assertion 1: "If header-names is empty then the colon separator will not be present."

-> colon separator is present in this case

Assertion 2: "Returns the normalized method list and request header list, in the form:
        "method-names : header-names"

where method-names is the list of methods separated by commas and header-names is the list of permitted headers separated by commas.

-> no commas between methods and header-names

Spec: http://download.java.net/jdk9/docs/api/java/net/URLPermission.html

Please find the details and examples in the attached Test.java

api/java_net/URLPermission/GetActions/index.html#GetActionsTests fails due to this issue

The output of the test attached:

jdk/bin/java -showversion Test
java version "9-ea"
Java(TM) SE Runtime Environment (build 9-ea+130)
Java HotSpot(TM) Client VM (build 9-ea+130, mixed mode)

expected:<true> but was:<false>
expected:<GET,DELETE:X-Foo-Request,X-Bar-Request> but was: DELETE,GET:X-Bar-Request,X-Foo-Request