foreveGET /app/App.jnlp HTTP/1.1" 304 189 FULL PRODUCT VERSION :
java version "1.8.0_91"
Java(TM) SE Runtime Environment (build 1.8.0_91-b14)
Java HotSpot(TM) Client VM (build 25.91-b14, mixed mode, sharing)

ADDITIONAL OS VERSION INFORMATION :
Microsoft Windows [Version 10.0.10586]

EXTRA RELEVANT SYSTEM CONFIGURATION :
We have the forms applet embedded in a Apex html page. We use Apex to navigate between features and functions. When a form is needed, the apex uses javascript to raise event.

The applet is signed with a trusted certificate, and all the jar files in the applet are signed with the same certificate, and they hold the same manifest

REGRESSION. Last worked in version 8u73

ADDITIONAL REGRESSION INFORMATION:
The page is running on different softbase.dk domains. This particular on kbmetal.softbase.dk
The applet is loaded without warnings.

The manifest is as follows:

Manifest-Version: 1.0
Application-Name: SoftBASE
Permissions: all-permissions
Caller-Allowable-Codebase: 127.0.0.1 *.ottos.ch
  *.softbase.dk *.aluline.dk *.softbase.ch
   *.googleapis.com *.google.com *.gstatic.com *.googleusercontent.com
Codebase: *.ottos.ch *.softbase.dk *.softbase.ch
  *.aluline.dk
Application-Library-Allowable-Codebase: *.ottos.ch
  *.softbase.dk *.softbase.ch *.aluline.dk
Created-By: 1.8.0_45 (Oracle Corporation)

Process:
1) the page opens without problems, and the applet is loaded.
2) A form is opened via the menu. This raises a javascript event.
    - Now the applet looks up a crossdomain.xml on port 80, which is not open, and the applet awaits. After some time 10-30 seconds the applet continues.
3) any following events and calls from the javascript raise no issues. and the page runs smoothly.

Java Plug-in 11.91.2.14
Using JRE version 1.8.0_91-b14 Java HotSpot(TM) Client VM
User home directory = C:\Users\roj.SOFTBASE-2014
----------------------------------------------------
c: clear console window
f: finalize objects on finalization queue
g: garbage collect
h: display this help message
l: dump classloader list
m: print memory usage
o: trigger logging
q: hide console
r: reload policy configuration
s: dump system and deployment properties
t: dump thread list
v: dump thread stack
x: clear classloader cache
0-5: set trace level to <n>
----------------------------------------------------

Warning: Java Plugin support for legacy lifecycle model is deprecated and may be removed in a future release.

basic: Added progress listener: sun.plugin.util.ProgressMonitorAdapter@8132b7
security: Expected Main URL: http://kbmetal.softbase.dk:8090/forms/java/frmall.jar
basic: Plugin2ClassLoader.addURL parent called for http://kbmetal.softbase.dk:8090/forms/java/frmall.jar
basic: Plugin2ClassLoader.addURL parent called for http://kbmetal.softbase.dk:8090/forms/java/FormsGraph.jar
basic: Plugin2ClassLoader.addURL parent called for http://kbmetal.softbase.dk:8090/forms/java/activation.jar
basic: Plugin2ClassLoader.addURL parent called for http://kbmetal.softbase.dk:8090/forms/java/mail.jar
basic: Plugin2ClassLoader.addURL parent called for http://kbmetal.softbase.dk:8090/forms/java/javaSbsMail.jar
basic: Plugin2ClassLoader.addURL parent called for http://kbmetal.softbase.dk:8090/forms/java/SbSfd.jar
basic: Plugin2ClassLoader.addURL parent called for http://kbmetal.softbase.dk:8090/forms/java/sbs_icons.jar
basic: Plugin2ClassLoader.addURL parent called for http://kbmetal.softbase.dk:8090/forms/java/otmb_icons.jar
basic: Plugin2ClassLoader.addURL parent called for http://kbmetal.softbase.dk:8090/forms/java/apex_style.jar
network: Cache entry found [url: http://kbmetal.softbase.dk:8090/forms/java/frmall.jar, version: null]
cache: Adding MemoryCache entry: http://kbmetal.softbase.dk:8090/forms/java/frmall.jar
cache: Resource http://kbmetal.softbase.dk:8090/forms/java/frmall.jar has expired.
network: Connecting http://kbmetal.softbase.dk:8090/forms/java/frmall.jar
...............................................
................................................
See the detailed dump from the java console (attached).

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
No lookup for a crossdomain.xml, or when looked up it should be on the same port as the applet is running. In this case 8090
ACTUAL -
The applet runs on port 8090
the crossdomain.xml is looked up on port 80

The javscript origin is on the same page, so crossdomain should not be nessasery.

REPRODUCIBILITY :
This bug can be reproduced always.