FULL PRODUCT VERSION :
java version "1.8.0_101"
Java(TM) SE Runtime Environment (build 1.8.0_101-b13)
Java HotSpot(TM) Client VM (build 25.101-b13, mixed mode, sharing)

A DESCRIPTION OF THE PROBLEM :
This is a duplicate of https://bugs.openjdk.java.net/browse/JDK-8163845 but that issue was wrongly closed, and I am unable to comment on it.

The issue occurs when the JVM is low on memory.

After decompiling deploy.jar, I deduced that the issue occurs after the ImmutableManifest referenced by com.sun.deploy.cache.CachedJarFile.manifestRef (SoftReference) is garbage collected, but the underlying Manifest referenced by java.util.jar.JarFile.manRef has not been garbage collected.

When CachedJarFile#getManifest() is called, CachedJarFile.manifestRef.get() returns null, but super.getManifest() (JarFile#getManifest()) returns the underlying Manifest (JarFile.manRef), whose Manifest.attr.map has been changed into a Collections.UnmodifiableMap by ImmutableManifest#replaceAttributesMapWithImmutableMap(Attributes) via Reflection.

CachedJarFile#getManifest() then calls Manifest.getMainAttributes()#remove(Object), which throws UnsupportedOperationException because Attributes.map has been replaced with a Collections.UnmodifiableMap.

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Difficult to reproduce because of the conditions required to simulate this issue.


ERROR MESSAGES/STACK TRACES THAT OCCUR :
java.lang.UnsupportedOperationException
                at java.util.Collections$UnmodifiableMap.remove(Unknown Source)
                at java.util.jar.Attributes.remove(Unknown Source)
                at com.sun.deploy.cache.CachedJarFile.getManifest(Unknown Source)
                at com.sun.deploy.security.DeployURLClassPath$JarLoader$2.getManifest(Unknown Source)
                at java.net.URLClassLoader.defineClass(Unknown Source)
                at java.net.URLClassLoader.access$100(Unknown Source)
                at java.net.URLClassLoader$1.run(Unknown Source)
                at java.net.URLClassLoader$1.run(Unknown Source)
                at java.security.AccessController.doPrivileged(Native Method)
                at java.net.URLClassLoader.findClass(Unknown Source)
                at com.sun.jnlp.JNLPClassLoader.findClass(Unknown Source)
                at java.lang.ClassLoader.loadClass(Unknown Source)
                at com.sun.jnlp.JNLPClassLoader.loadClass(Unknown Source)
                at java.lang.ClassLoader.loadClass(Unknown Source)

REPRODUCIBILITY :
This bug can be reproduced rarely.