Merge "Addition of Parameter / MalformedParametersException"
diff --git a/NativeCode.mk b/NativeCode.mk
index cc31819..7c3efbc 100644
--- a/NativeCode.mk
+++ b/NativeCode.mk
@@ -229,7 +229,7 @@
 LOCAL_MODULE_TAGS := optional
 LOCAL_MODULE := libjavacore
 LOCAL_ADDITIONAL_DEPENDENCIES := $(LOCAL_PATH)/NativeCode.mk
-LOCAL_SHARED_LIBRARIES += $(core_shared_libraries) libexpat libicuuc-host libicui18n-host libcrypto libz-host libziparchive
+LOCAL_SHARED_LIBRARIES += $(core_shared_libraries) libexpat libicuuc libicui18n libcrypto libz-host libziparchive
 LOCAL_STATIC_LIBRARIES += $(core_static_libraries)
 LOCAL_MULTILIB := both
 LOCAL_CXX_STL := libc++
@@ -241,7 +241,7 @@
 LOCAL_C_INCLUDES := $(core_c_includes)
 LOCAL_CFLAGS := -D_LARGEFILE64_SOURCE -D_GNU_SOURCE -DLINUX -D__GLIBC__ # Sigh.
 LOCAL_CFLAGS += $(openjdk_cflags)
-LOCAL_SHARED_LIBRARIES := $(core_shared_libraries) libicuuc-host libcrypto libz-host
+LOCAL_SHARED_LIBRARIES := $(core_shared_libraries) libicuuc libcrypto libz-host
 LOCAL_SHARED_LIBRARIES += libopenjdkjvmd libnativehelper
 LOCAL_STATIC_LIBRARIES := $(core_static_libraries) libfdlibm
 LOCAL_MODULE_TAGS := optional
@@ -256,7 +256,7 @@
 LOCAL_C_INCLUDES := $(core_c_includes)
 LOCAL_CFLAGS := -D_LARGEFILE64_SOURCE -D_GNU_SOURCE -DLINUX -D__GLIBC__ # Sigh.
 LOCAL_CFLAGS += $(openjdk_cflags)
-LOCAL_SHARED_LIBRARIES := $(core_shared_libraries) libicuuc-host libcrypto libz-host
+LOCAL_SHARED_LIBRARIES := $(core_shared_libraries) libicuuc libcrypto libz-host
 LOCAL_SHARED_LIBRARIES += libopenjdkjvm libnativehelper
 LOCAL_STATIC_LIBRARIES := $(core_static_libraries) libfdlibm
 LOCAL_MODULE_TAGS := optional
diff --git a/benchmarks/src/benchmarks/StringDexCacheBenchmark.java b/benchmarks/src/benchmarks/StringDexCacheBenchmark.java
new file mode 100644
index 0000000..ce72b4d
--- /dev/null
+++ b/benchmarks/src/benchmarks/StringDexCacheBenchmark.java
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2016 Google Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package benchmarks;
+
+/**
+ * How long does it take to access a string in the dex cache?
+ */
+public class StringDexCacheBenchmark {
+    public int timeStringDexCacheAccess(int reps) {
+        int v = 0;
+        for (int rep = 0; rep < reps; ++rep) {
+          // Deliberately obscured to make optimizations less likely.
+          String s = (rep >= 0) ? "hello, world!" : null;
+          v += s.length();
+        }
+        return v;
+    }
+}
diff --git a/dalvik/src/main/java/dalvik/annotation/optimization/CriticalNative.java b/dalvik/src/main/java/dalvik/annotation/optimization/CriticalNative.java
new file mode 100644
index 0000000..4564b18
--- /dev/null
+++ b/dalvik/src/main/java/dalvik/annotation/optimization/CriticalNative.java
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package dalvik.annotation.optimization;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+/**
+ * Applied to native methods to enable an ART runtime built-in optimization:
+ * methods that are annotated this way can speed up JNI transitions for methods that contain no
+ * objects (in parameters or return values, or as an implicit {@code this}).
+ *
+ * <p>
+ * The native implementation must exclude the {@code JNIEnv} and {@code jclass} parameters from its
+ * function signature. As an additional limitation, the method must be explicitly registered with
+ * {@code RegisterNatives} instead of relying on the built-in dynamic JNI linking.
+ * </p>
+ *
+ * <p>
+ * Performance of JNI transitions:
+ * <ul>
+ * <li>Regular JNI cost in nanoseconds: 115
+ * <li>Fast {@code (!)} JNI cost in nanoseconds: 60
+ * <li>{@literal @}{@link FastNative} cost in nanoseconds: 35
+ * <li>{@literal @}{@code CriticalNative} cost in nanoseconds: 25
+ * </ul>
+ * (Measured on angler-userdebug in 07/2016).
+ * </p>
+ *
+ * <p>
+ * A similar annotation, {@literal @}{@link FastNative}, exists with similar performance guarantees.
+ * However, unlike {@code @CriticalNative} it supports non-statics, object return values, and object
+ * parameters. If a method absolutely must have access to a {@code jobject}, then use
+ * {@literal @}{@link FastNative} instead of this.
+ * </p>
+ *
+ * <p>
+ * This has the side-effect of disabling all garbage collections while executing a critical native
+ * method. Use with extreme caution. Any long-running methods must not be marked with
+ * {@code @CriticalNative} (including usually-fast but generally unbounded methods)!
+ * </p>
+ *
+ * <p>
+ * <b>Deadlock Warning:</b> As a rule of thumb, do not acquire any locks during a critical native
+ * call if they aren't also locally released [before returning to managed code].
+ * </p>
+ *
+ * <p>
+ * Say some code does:
+ *
+ * <code>
+ * critical_native_call_to_grab_a_lock();
+ * does_some_java_work();
+ * critical_native_call_to_release_a_lock();
+ * </code>
+ *
+ * <p>
+ * This code can lead to deadlocks. Say thread 1 just finishes
+ * {@code critical_native_call_to_grab_a_lock()} and is in {@code does_some_java_work()}.
+ * GC kicks in and suspends thread 1. Thread 2 now is in
+ * {@code critical_native_call_to_grab_a_lock()} but is blocked on grabbing the
+ * native lock since it's held by thread 1. Now thread suspension can't finish
+ * since thread 2 can't be suspended since it's doing CriticalNative JNI.
+ * </p>
+ *
+ * <p>
+ * Normal natives don't have the issue since once it's executing in native code,
+ * it is considered suspended from the runtime's point of view.
+ * CriticalNative natives however don't do the state transition done by the normal natives.
+ * </p>
+ *
+ * <p>
+ * This annotation has no effect when used with non-native methods.
+ * The runtime must throw a {@code VerifierError} upon class loading if this is used with a native
+ * method that contains object parameters, an object return value, or a non-static.
+ * </p>
+ *
+ * @hide
+ */
+@Retention(RetentionPolicy.CLASS)  // Save memory, don't instantiate as an object at runtime.
+@Target(ElementType.METHOD)
+public @interface CriticalNative {}
diff --git a/harmony-tests/src/test/java/org/apache/harmony/tests/java/nio/channels/ChannelsTest.java b/harmony-tests/src/test/java/org/apache/harmony/tests/java/nio/channels/ChannelsTest.java
index bd7a1ad..274628a 100644
--- a/harmony-tests/src/test/java/org/apache/harmony/tests/java/nio/channels/ChannelsTest.java
+++ b/harmony-tests/src/test/java/org/apache/harmony/tests/java/nio/channels/ChannelsTest.java
@@ -507,6 +507,7 @@
         // null channel
         try {
             Writer testWriter = Channels.newWriter(null, Charset.forName(CODE_SET).newEncoder(), -1);
+            fail();
         } catch (NullPointerException expected) {
         }
 
@@ -514,6 +515,7 @@
         this.fouts = null;
         try {
             WritableByteChannel wbChannel = Channels.newChannel(this.fouts);
+            fail();
         } catch (NullPointerException expected) {
         }
     }
diff --git a/harmony-tests/src/test/java/org/apache/harmony/tests/java/nio/channels/FileChannelTest.java b/harmony-tests/src/test/java/org/apache/harmony/tests/java/nio/channels/FileChannelTest.java
index d6dacb4..03c472c 100644
--- a/harmony-tests/src/test/java/org/apache/harmony/tests/java/nio/channels/FileChannelTest.java
+++ b/harmony-tests/src/test/java/org/apache/harmony/tests/java/nio/channels/FileChannelTest.java
@@ -1367,6 +1367,7 @@
         ByteBuffer readBuffer = ByteBuffer.allocate(CAPACITY);
         try {
             readOnlyFileChannel.read(readBuffer, Long.MAX_VALUE);
+            fail();
         } catch (IOException expected) {
         }
     }
diff --git a/harmony-tests/src/test/java/org/apache/harmony/tests/java/text/SimpleDateFormatTest.java b/harmony-tests/src/test/java/org/apache/harmony/tests/java/text/SimpleDateFormatTest.java
index 9237fac..16217b2 100644
--- a/harmony-tests/src/test/java/org/apache/harmony/tests/java/text/SimpleDateFormatTest.java
+++ b/harmony-tests/src/test/java/org/apache/harmony/tests/java/text/SimpleDateFormatTest.java
@@ -641,11 +641,13 @@
         SimpleDateFormat pFormat = new SimpleDateFormat("h z", Locale.ENGLISH);
         try {
             pFormat.parse("14 GMT-23");
+            fail();
         } catch (ParseException expected) {
         }
 
         try {
             pFormat.parse("14 GMT+23");
+            fail();
         } catch (ParseException expected) {
         }
     }
diff --git a/harmony-tests/src/test/java/org/apache/harmony/tests/java/util/IdentityHashMapTest.java b/harmony-tests/src/test/java/org/apache/harmony/tests/java/util/IdentityHashMapTest.java
index ee1a372..d68a923 100644
--- a/harmony-tests/src/test/java/org/apache/harmony/tests/java/util/IdentityHashMapTest.java
+++ b/harmony-tests/src/test/java/org/apache/harmony/tests/java/util/IdentityHashMapTest.java
@@ -1080,6 +1080,7 @@
                     return "";
                 }
             });
+            fail();
         } catch (ConcurrentModificationException expected) {}
     }
 
diff --git a/harmony-tests/src/test/java/org/apache/harmony/tests/java/util/ScannerTest.java b/harmony-tests/src/test/java/org/apache/harmony/tests/java/util/ScannerTest.java
index d67b1c9..909dd27 100644
--- a/harmony-tests/src/test/java/org/apache/harmony/tests/java/util/ScannerTest.java
+++ b/harmony-tests/src/test/java/org/apache/harmony/tests/java/util/ScannerTest.java
@@ -46,6 +46,10 @@
 import java.nio.channels.ServerSocketChannel;
 import java.nio.channels.SocketChannel;
 import java.nio.charset.Charset;
+import java.nio.file.Files;
+import java.nio.file.NoSuchFileException;
+import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.InputMismatchException;
@@ -118,6 +122,38 @@
         // TODO: test if the default charset is used.
     }
 
+
+    /**
+     * @tests java.util.Scanner#Scanner(Path)
+     */
+    public void test_ConstructorLjava_nio_file_Path() throws IOException {
+        Path tmpFilePath = Files.createTempFile("TestFileForScanner", ".tmp");
+        String testString = "test";
+        try (OutputStream os = Files.newOutputStream(tmpFilePath)) {
+            os.write(testString.getBytes());
+        }
+        try (Scanner s = new Scanner(tmpFilePath)){
+            assertEquals(testString, s.next());
+            assertFalse(s.hasNext());
+        }
+    }
+
+    /**
+     * @tests java.util.Scanner#Scanner(Path)
+     */
+    public void test_ConstructorLjava_nio_file_Path_Exception() throws IOException {
+        Path nonExistentFilePath = Paths.get("testPath");
+        try (Scanner s = new Scanner(nonExistentFilePath)) {
+            fail();
+        } catch (NoSuchFileException expected) {
+        }
+
+        try (Scanner s = new Scanner((Path) null)) {
+            fail();
+        } catch (NullPointerException expected) {
+        }
+    }
+
     /**
      * @tests java.util.Scanner#Scanner(File, String)
      */
@@ -186,6 +222,83 @@
     }
 
     /**
+     * @tests java.util.Scanner#Scanner(Path, String)
+     */
+    public void test_ConstructorLjava_nio_file_PathLjava_lang_String()
+            throws IOException {
+        Path tmpFilePath = Files.createTempFile("TestFileForScanner", ".tmp");
+        String testString = "परीक्षण";
+        try (OutputStream os = Files.newOutputStream(tmpFilePath)) {
+            os.write(testString.getBytes());
+        }
+        // With correct charset.
+        try (Scanner s = new Scanner(tmpFilePath, Charset.defaultCharset().name())){
+            assertEquals(testString, s.next());
+            assertFalse(s.hasNext());
+        }
+        // With incorrect charset.
+        try (Scanner s = new Scanner(tmpFilePath, "US-ASCII")){
+            if (s.next().equals(testString)) {
+                fail("Should not be able to read with incorrect charset.");
+            }
+        }
+    }
+
+    /**
+     * @tests java.util.Scanner#Scanner(Path, String)
+     */
+    public void test_ConstructorLjava_nio_file_PathLjava_lang_String_Exception()
+            throws IOException {
+        Path nonExistentFilePath = Paths.get("nonExistentFile");
+        Path existentFilePath = Files.createTempFile("TestFileForScanner", ".tmp");
+
+        // File doesn't exist.
+        try (Scanner s = new Scanner(nonExistentFilePath, Charset.defaultCharset().name())) {
+            fail();
+        } catch (NoSuchFileException expected) {
+        }
+
+        // Exception order test.
+        try {
+            s = new Scanner(nonExistentFilePath, null);
+            fail();
+        } catch (NullPointerException expected) {
+        }
+
+        // Invalid charset.
+        try {
+            s = new Scanner(existentFilePath, "invalid charset");
+            fail();
+        } catch (IllegalArgumentException expected) {
+        }
+
+        // Scanner(Path = null, Charset = null)
+        try (Scanner s = new Scanner((Path) null, null)) {
+            fail();
+        } catch (NullPointerException expected) {
+        }
+
+        // Scanner(Path = null, Charset = UTF-8)
+        try (Scanner s = new Scanner((Path) null, "UTF-8")) {
+            fail();
+        } catch (NullPointerException expected) {
+        }
+
+        // Scanner(Path = null, Charset = invalid)
+        try (Scanner s = new Scanner((Path) null, "invalid")) {
+            fail();
+        } catch (NullPointerException expected) {
+        }
+
+        // Scanner(Path, Charset = null)
+        try (Scanner s = new Scanner(existentFilePath, null)) {
+            fail();
+        } catch (NullPointerException expected) {
+        }
+    }
+
+
+    /**
      * @tests java.util.Scanner#Scanner(InputStream)
      */
     public void test_ConstructorLjava_io_InputStream() {
diff --git a/harmony-tests/src/test/java/org/apache/harmony/tests/javax/net/ssl/SSLEngineTest.java b/harmony-tests/src/test/java/org/apache/harmony/tests/javax/net/ssl/SSLEngineTest.java
index 9360c00..8fae7b8 100644
--- a/harmony-tests/src/test/java/org/apache/harmony/tests/javax/net/ssl/SSLEngineTest.java
+++ b/harmony-tests/src/test/java/org/apache/harmony/tests/javax/net/ssl/SSLEngineTest.java
@@ -894,6 +894,7 @@
         SSLEngine sse = getEngine(host, port);
 
         try {
+            // TODO: decide whether OpenSSLEngineImpl should throw ISE (it doesn't) b/31301555
             SSLEngineResult result = sse.wrap(bbs, bbd);
         } catch (IllegalStateException expected) {
         }
diff --git a/harmony-tests/src/test/java/org/apache/harmony/tests/javax/net/ssl/SSLSocketTest.java b/harmony-tests/src/test/java/org/apache/harmony/tests/javax/net/ssl/SSLSocketTest.java
index 861f4a8..a791a77 100644
--- a/harmony-tests/src/test/java/org/apache/harmony/tests/javax/net/ssl/SSLSocketTest.java
+++ b/harmony-tests/src/test/java/org/apache/harmony/tests/javax/net/ssl/SSLSocketTest.java
@@ -249,6 +249,7 @@
 
         try {
             ssl.removeHandshakeCompletedListener(ls);
+            fail();
         } catch (IllegalArgumentException expected) {
         }
 
diff --git a/harmony-tests/src/test/java/org/apache/harmony/tests/javax/net/ssl/TrustManagerFactory1Test.java b/harmony-tests/src/test/java/org/apache/harmony/tests/javax/net/ssl/TrustManagerFactory1Test.java
index 9b5b929..176a832 100644
--- a/harmony-tests/src/test/java/org/apache/harmony/tests/javax/net/ssl/TrustManagerFactory1Test.java
+++ b/harmony-tests/src/test/java/org/apache/harmony/tests/javax/net/ssl/TrustManagerFactory1Test.java
@@ -295,6 +295,7 @@
         for (String validValue : getValidValues()) {
             try {
                 TrustManagerFactory.getInstance(validValue, (Provider) null);
+                fail();
             } catch (IllegalArgumentException expected) {
             }
         }
diff --git a/luni/src/main/java/android/system/Os.java b/luni/src/main/java/android/system/Os.java
index 41f76da..3c29442 100644
--- a/luni/src/main/java/android/system/Os.java
+++ b/luni/src/main/java/android/system/Os.java
@@ -228,7 +228,6 @@
 
   /**
    * See <a href="http://man7.org/linux/man-pages/man2/getxattr.2.html">getxattr(2)</a>
-   * @hide
    */
   public static byte[] getxattr(String path, String name) throws ErrnoException { return Libcore.os.getxattr(path, name); }
 
@@ -276,6 +275,11 @@
   public static void listen(FileDescriptor fd, int backlog) throws ErrnoException { Libcore.os.listen(fd, backlog); }
 
   /**
+   * See <a href="http://man7.org/linux/man-pages/man2/listxattr.2.html">listxattr(2)</a>
+   */
+  public static String[] listxattr(String path) throws ErrnoException { return Libcore.os.listxattr(path); }
+
+  /**
    * See <a href="http://man7.org/linux/man-pages/man2/lseek.2.html">lseek(2)</a>.
    */
   public static long lseek(FileDescriptor fd, long offset, int whence) throws ErrnoException { return Libcore.os.lseek(fd, offset, whence); }
@@ -411,7 +415,10 @@
    */
   public static void remove(String path) throws ErrnoException { Libcore.os.remove(path); }
 
-  /** @hide */ public static void removexattr(String path, String name) throws ErrnoException { Libcore.os.removexattr(path, name); }
+  /**
+   * See <a href="http://man7.org/linux/man-pages/man2/removexattr.2.html">removexattr(2)</a>.
+   */
+  public static void removexattr(String path, String name) throws ErrnoException { Libcore.os.removexattr(path, name); }
 
   /**
    * See <a href="http://man7.org/linux/man-pages/man2/rename.2.html">rename(2)</a>.
@@ -499,7 +506,6 @@
 
   /**
    * See <a href="http://man7.org/linux/man-pages/man2/setxattr.2.html">setxattr(2)</a>
-   * @hide
    */
   public static void setxattr(String path, String name, byte[] value, int flags) throws ErrnoException { Libcore.os.setxattr(path, name, value, flags); };
 
diff --git a/luni/src/main/java/java/security/security.properties b/luni/src/main/java/java/security/security.properties
index 6b9007b..b5f4d25 100644
--- a/luni/src/main/java/java/security/security.properties
+++ b/luni/src/main/java/java/security/security.properties
@@ -62,3 +62,5 @@
 
 # Disable weak algorithms in CertPathVerifier and CertPathBuilder.
 jdk.certpath.disabledAlgorithms=MD2, MD4, RSA keySize < 1024, DSA keySize < 1024, EC keySize < 160
+
+securerandom.strongAlgorithms=SHA1PRNG:AndroidOpenSSL
diff --git a/luni/src/main/java/libcore/io/Base64.java b/luni/src/main/java/libcore/io/Base64.java
index 236c166..f22bef4 100644
--- a/luni/src/main/java/libcore/io/Base64.java
+++ b/luni/src/main/java/libcore/io/Base64.java
@@ -22,7 +22,10 @@
 /**
  * Perform encoding and decoding of Base64 byte arrays as described in
  * http://www.ietf.org/rfc/rfc2045.txt
+ *
+ * @deprecated use {@link java.util.Base64} instead
  */
+@Deprecated
 public final class Base64 {
     private static final byte[] BASE_64_ALPHABET = initializeBase64Alphabet();
 
diff --git a/luni/src/main/java/libcore/io/ForwardingOs.java b/luni/src/main/java/libcore/io/ForwardingOs.java
index b0c0031..ac805e8 100644
--- a/luni/src/main/java/libcore/io/ForwardingOs.java
+++ b/luni/src/main/java/libcore/io/ForwardingOs.java
@@ -111,6 +111,7 @@
     public void lchown(String path, int uid, int gid) throws ErrnoException { os.lchown(path, uid, gid); }
     public void link(String oldPath, String newPath) throws ErrnoException { os.link(oldPath, newPath); }
     public void listen(FileDescriptor fd, int backlog) throws ErrnoException { os.listen(fd, backlog); }
+    public String[] listxattr(String path) throws ErrnoException { return os.listxattr(path); }
     public long lseek(FileDescriptor fd, long offset, int whence) throws ErrnoException { return os.lseek(fd, offset, whence); }
     public StructStat lstat(String path) throws ErrnoException { return os.lstat(path); }
     public void mincore(long address, long byteCount, byte[] vector) throws ErrnoException { os.mincore(address, byteCount, vector); }
diff --git a/luni/src/main/java/libcore/io/Os.java b/luni/src/main/java/libcore/io/Os.java
index 0963962..41b034b 100644
--- a/luni/src/main/java/libcore/io/Os.java
+++ b/luni/src/main/java/libcore/io/Os.java
@@ -103,6 +103,7 @@
     public void lchown(String path, int uid, int gid) throws ErrnoException;
     public void link(String oldPath, String newPath) throws ErrnoException;
     public void listen(FileDescriptor fd, int backlog) throws ErrnoException;
+    public String[] listxattr(String path) throws ErrnoException;
     public long lseek(FileDescriptor fd, long offset, int whence) throws ErrnoException;
     public StructStat lstat(String path) throws ErrnoException;
     public void mincore(long address, long byteCount, byte[] vector) throws ErrnoException;
diff --git a/luni/src/main/java/libcore/io/Posix.java b/luni/src/main/java/libcore/io/Posix.java
index 06339da..1a74678 100644
--- a/luni/src/main/java/libcore/io/Posix.java
+++ b/luni/src/main/java/libcore/io/Posix.java
@@ -105,6 +105,7 @@
     public native void lchown(String path, int uid, int gid) throws ErrnoException;
     public native void link(String oldPath, String newPath) throws ErrnoException;
     public native void listen(FileDescriptor fd, int backlog) throws ErrnoException;
+    public native String[] listxattr(String path) throws ErrnoException;
     public native long lseek(FileDescriptor fd, long offset, int whence) throws ErrnoException;
     public native StructStat lstat(String path) throws ErrnoException;
     public native void mincore(long address, long byteCount, byte[] vector) throws ErrnoException;
diff --git a/luni/src/main/native/libcore_io_Posix.cpp b/luni/src/main/native/libcore_io_Posix.cpp
index cacf62e..d0b3924 100644
--- a/luni/src/main/native/libcore_io_Posix.cpp
+++ b/luni/src/main/native/libcore_io_Posix.cpp
@@ -61,6 +61,7 @@
 #include <memory>
 
 #include <android-base/file.h>
+#include <android-base/strings.h>
 
 #ifndef __unused
 #define __unused __attribute__((__unused__))
@@ -1414,6 +1415,41 @@
     throwIfMinusOne(env, "listen", TEMP_FAILURE_RETRY(listen(fd, backlog)));
 }
 
+static jobjectArray Posix_listxattr(JNIEnv* env, jobject, jstring javaPath) {
+    ScopedUtfChars path(env, javaPath);
+    if (path.c_str() == NULL) {
+        return NULL;
+    }
+
+    while (true) {
+        // Get the current size of the named extended attribute.
+        ssize_t valueLength;
+        if ((valueLength = listxattr(path.c_str(), NULL, 0)) < 0) {
+            throwErrnoException(env, "listxattr");
+            return NULL;
+        }
+
+        // Create the actual byte array.
+        std::string buf(valueLength, '\0');
+        if ((valueLength = listxattr(path.c_str(), &buf[0], valueLength)) < 0) {
+            if (errno == ERANGE) {
+                // The attribute value has changed since last listxattr call and buf no longer fits,
+                // try again.
+                continue;
+            }
+            throwErrnoException(env, "listxattr");
+            return NULL;
+        }
+
+        // Split the output by '\0'.
+        buf.resize(valueLength > 0 ? valueLength - 1 : 0); // Remove the trailing NULL character.
+        std::string delim("\0", 1);
+        auto xattrs = android::base::Split(buf, delim);
+
+        return toStringArray(env, xattrs);
+    }
+}
+
 static jlong Posix_lseek(JNIEnv* env, jobject, jobject javaFd, jlong offset, jint whence) {
     int fd = jniGetFDFromFileDescriptor(env, javaFd);
     return throwIfMinusOne(env, "lseek", TEMP_FAILURE_RETRY(lseek64(fd, offset, whence)));
@@ -2165,6 +2201,7 @@
     NATIVE_METHOD(Posix, lchown, "(Ljava/lang/String;II)V"),
     NATIVE_METHOD(Posix, link, "(Ljava/lang/String;Ljava/lang/String;)V"),
     NATIVE_METHOD(Posix, listen, "(Ljava/io/FileDescriptor;I)V"),
+    NATIVE_METHOD(Posix, listxattr, "(Ljava/lang/String;)[Ljava/lang/String;"),
     NATIVE_METHOD(Posix, lseek, "(Ljava/io/FileDescriptor;JI)J"),
     NATIVE_METHOD(Posix, lstat, "(Ljava/lang/String;)Landroid/system/StructStat;"),
     NATIVE_METHOD(Posix, mincore, "(JJ[B)V"),
diff --git a/luni/src/test/java/libcore/io/OsTest.java b/luni/src/test/java/libcore/io/OsTest.java
index 0beafae..648ac2a 100644
--- a/luni/src/test/java/libcore/io/OsTest.java
+++ b/luni/src/test/java/libcore/io/OsTest.java
@@ -513,9 +513,11 @@
       } catch (ErrnoException e) {
         assertEquals(OsConstants.ENODATA, e.errno);
       }
+      assertFalse(Arrays.asList(Libcore.os.listxattr(path)).contains(NAME_TEST));
 
       Libcore.os.setxattr(path, NAME_TEST, VALUE_CAKE, OsConstants.XATTR_CREATE);
       byte[] xattr_create = Libcore.os.getxattr(path, NAME_TEST);
+      assertTrue(Arrays.asList(Libcore.os.listxattr(path)).contains(NAME_TEST));
       assertEquals(VALUE_CAKE.length, xattr_create.length);
       assertStartsWith(VALUE_CAKE, xattr_create);
 
@@ -528,6 +530,7 @@
 
       Libcore.os.setxattr(path, NAME_TEST, VALUE_PIE, OsConstants.XATTR_REPLACE);
       byte[] xattr_replace = Libcore.os.getxattr(path, NAME_TEST);
+      assertTrue(Arrays.asList(Libcore.os.listxattr(path)).contains(NAME_TEST));
       assertEquals(VALUE_PIE.length, xattr_replace.length);
       assertStartsWith(VALUE_PIE, xattr_replace);
 
@@ -538,12 +541,121 @@
       } catch (ErrnoException e) {
         assertEquals(OsConstants.ENODATA, e.errno);
       }
+      assertFalse(Arrays.asList(Libcore.os.listxattr(path)).contains(NAME_TEST));
 
     } finally {
       file.delete();
     }
   }
 
+  public void test_xattr_NPE() throws Exception {
+    File file = File.createTempFile("xattr", "test");
+    final String path = file.getAbsolutePath();
+    final String NAME_TEST = "user.meow";
+    final byte[] VALUE_CAKE = "cake cake cake".getBytes(StandardCharsets.UTF_8);
+
+    // getxattr
+    try {
+      Libcore.os.getxattr(null, NAME_TEST);
+      fail();
+    } catch (NullPointerException expected) { }
+    try {
+      Libcore.os.getxattr(path, null);
+      fail();
+    } catch (NullPointerException expected) { }
+
+    // listxattr
+    try {
+      Libcore.os.listxattr(null);
+      fail();
+    } catch (NullPointerException expected) { }
+
+    // removexattr
+    try {
+      Libcore.os.removexattr(null, NAME_TEST);
+      fail();
+    } catch (NullPointerException expected) { }
+    try {
+      Libcore.os.removexattr(path, null);
+      fail();
+    } catch (NullPointerException expected) { }
+
+    // setxattr
+    try {
+      Libcore.os.setxattr(null, NAME_TEST, VALUE_CAKE, OsConstants.XATTR_CREATE);
+      fail();
+    } catch (NullPointerException expected) { }
+    try {
+      Libcore.os.setxattr(path, null, VALUE_CAKE, OsConstants.XATTR_CREATE);
+      fail();
+    } catch (NullPointerException expected) { }
+    try {
+      Libcore.os.setxattr(path, NAME_TEST, null, OsConstants.XATTR_CREATE);
+      fail();
+    } catch (NullPointerException expected) { }
+  }
+
+  public void test_xattr_Errno() throws Exception {
+    File file = File.createTempFile("xattr", "test");
+    final String path = file.getAbsolutePath();
+    final String NAME_TEST = "user.meow";
+    final byte[] VALUE_CAKE = "cake cake cake".getBytes(StandardCharsets.UTF_8);
+
+    // ENOENT, No such file or directory.
+    try {
+      Libcore.os.getxattr("", NAME_TEST);
+      fail();
+    } catch (ErrnoException e) {
+      assertEquals(OsConstants.ENOENT, e.errno);
+    }
+    try {
+      Libcore.os.listxattr("");
+      fail();
+    } catch (ErrnoException e) {
+      assertEquals(OsConstants.ENOENT, e.errno);
+    }
+    try {
+      Libcore.os.removexattr("", NAME_TEST);
+      fail();
+    } catch (ErrnoException e) {
+      assertEquals(OsConstants.ENOENT, e.errno);
+    }
+    try {
+      Libcore.os.setxattr("", NAME_TEST, VALUE_CAKE, OsConstants.XATTR_CREATE);
+      fail();
+    } catch (ErrnoException e) {
+      assertEquals(OsConstants.ENOENT, e.errno);
+    }
+
+    // ENOTSUP, Extended attributes are not supported by the filesystem, or are disabled.
+    try {
+      Libcore.os.getxattr("/proc/version", NAME_TEST);
+      fail();
+    } catch (ErrnoException e) {
+      assertEquals(OsConstants.ENOTSUP, e.errno);
+    }
+    try {
+      // Linux listxattr does not set errno.
+      Libcore.os.listxattr("/proc/version");
+    } catch (ErrnoException e) {
+      fail();
+    }
+    try {
+      Libcore.os.removexattr("/proc/version", "security.selinux");
+      fail();
+    } catch (ErrnoException e) {
+      assertEquals(OsConstants.ENOTSUP, e.errno);
+    }
+    try {
+      Libcore.os.setxattr("/proc/version", NAME_TEST, VALUE_CAKE, OsConstants.XATTR_CREATE);
+      fail();
+    } catch (ErrnoException e) {
+      // For setxattr, EACCES or ENOTSUP is set depending on whether running with root permission.
+      assertTrue(e.errno == OsConstants.EACCES ||
+                 e.errno == OsConstants.ENOTSUP);
+    }
+  }
+
   public void test_realpath() throws Exception {
       File tmpDir = new File(System.getProperty("java.io.tmpdir"));
       // This is a chicken and egg problem. We have no way of knowing whether
diff --git a/luni/src/test/java/libcore/java/lang/OldSystemTest.java b/luni/src/test/java/libcore/java/lang/OldSystemTest.java
index 1ecfbfa..dc5741f 100644
--- a/luni/src/test/java/libcore/java/lang/OldSystemTest.java
+++ b/luni/src/test/java/libcore/java/lang/OldSystemTest.java
@@ -321,13 +321,14 @@
         } catch(NullPointerException expected) {
         }
 
-        // Trivial positive test for System.load: Attempt to load a libart.so - it's guaranteed
-        // to exist and is whitelisted for use from applications.
+        // Trivial positive test for System.load: Attempt to load a liblog.so - it's guaranteed
+        // to exist and is whitelisted for use from applications. Also, it's in the library search
+        // path for host builds.
         final ClassLoader cl = getClass().getClassLoader();
         // ClassLoader.findLibrary has protected access, so it's guaranteed to exist.
         final Method m = ClassLoader.class.getDeclaredMethod("findLibrary", String.class);
         assertNotNull(m);
-        String libPath = (String) m.invoke(cl, "art");
+        String libPath = (String) m.invoke(cl, "log");
         assertNotNull(libPath);
         System.load(new File(libPath).getAbsolutePath());
 
diff --git a/luni/src/test/java/libcore/java/lang/ref/FinalizeTest.java b/luni/src/test/java/libcore/java/lang/ref/FinalizeTest.java
index 55e70033..6962671 100644
--- a/luni/src/test/java/libcore/java/lang/ref/FinalizeTest.java
+++ b/luni/src/test/java/libcore/java/lang/ref/FinalizeTest.java
@@ -72,9 +72,16 @@
     // Helper function since we do not want a vreg to keep the allocated object live.
     // For b/25851249
     private void exceptionInConstructor() {
+        boolean thrown = false;
         try {
             new ConstructionFails();
+            // can't fail() here since AssertionFailedError extends AssertionError, which
+            // we expect
         } catch (AssertionError expected) {
+            thrown = true;
+        }
+        if (!thrown) {
+            fail();
         }
     }
 
diff --git a/luni/src/test/java/libcore/java/net/AbstractCookiesTest.java b/luni/src/test/java/libcore/java/net/AbstractCookiesTest.java
index d6424a0..63e252c 100644
--- a/luni/src/test/java/libcore/java/net/AbstractCookiesTest.java
+++ b/luni/src/test/java/libcore/java/net/AbstractCookiesTest.java
@@ -521,17 +521,9 @@
         HttpCookie cookieA = createCookie("a", "android", ".android.com", "/source");
         HttpCookie cookieB = createCookie("b", "banana", "code.google.com", "/p/android");
 
-        try {
-            cookieStore.add(null, cookieA);
-        } catch (NullPointerException expected) {
-            // the RI crashes even though the cookie does get added to the store; sigh
-            expected.printStackTrace();
-        }
+        cookieStore.add(null, cookieA);
         assertEquals(Arrays.asList(cookieA), cookieStore.getCookies());
-        try {
-            cookieStore.add(null, cookieB);
-        } catch (NullPointerException expected) {
-        }
+        cookieStore.add(null, cookieB);
         assertEquals(Arrays.asList(cookieA, cookieB), cookieStore.getCookies());
 
         try {
diff --git a/luni/src/test/java/libcore/java/net/DatagramSocketTest.java b/luni/src/test/java/libcore/java/net/DatagramSocketTest.java
index ad5326b..85526cc 100644
--- a/luni/src/test/java/libcore/java/net/DatagramSocketTest.java
+++ b/luni/src/test/java/libcore/java/net/DatagramSocketTest.java
@@ -88,4 +88,13 @@
       }
     }
   }
+
+  public void test_setTrafficClass() throws Exception {
+    DatagramSocket s = new DatagramSocket();
+
+    for (int i = 0; i <= 255; ++i) {
+      s.setTrafficClass(i);
+      assertEquals(i, s.getTrafficClass());
+    }
+  }
 }
diff --git a/luni/src/test/java/libcore/java/net/SocketTest.java b/luni/src/test/java/libcore/java/net/SocketTest.java
index e2d3964..f273f8e 100644
--- a/luni/src/test/java/libcore/java/net/SocketTest.java
+++ b/luni/src/test/java/libcore/java/net/SocketTest.java
@@ -51,6 +51,9 @@
     // This hostname is required to resolve to 127.0.0.1 and ::1 for all tests to pass.
     private static final String ALL_LOOPBACK_HOSTNAME = "loopback46.unittest.grpc.io";
 
+    // From net/inet_ecn.h
+    private static final int INET_ECN_MASK = 0x3;
+
     // See http://b/2980559.
     public void test_close() throws Exception {
         Socket s = new Socket();
@@ -249,8 +252,14 @@
 
     public void test_setTrafficClass() throws Exception {
         Socket s = new Socket();
-        s.setTrafficClass(123);
-        assertEquals(123, s.getTrafficClass());
+
+        for (int i = 0; i <= 255; ++i) {
+            s.setTrafficClass(i);
+
+            // b/30909505
+            // Linux does not set ECN bits for STREAM sockets, so these bits should be zero.
+            assertEquals(i & ~INET_ECN_MASK, s.getTrafficClass());
+        }
     }
 
     public void testReadAfterClose() throws Exception {
@@ -531,21 +540,27 @@
         // Test all Socket ctors
         try {
             new SocketThatFailOnClose("localhost", 1);
+            fail();
         } catch(IOException expected) {}
         try {
             new SocketThatFailOnClose(InetAddress.getLocalHost(), 1);
+            fail();
         } catch(IOException expected) {}
         try {
             new SocketThatFailOnClose("localhost", 1, null, 0);
+            fail();
         } catch(IOException expected) {}
         try {
             new SocketThatFailOnClose(InetAddress.getLocalHost(), 1, null, 0);
+            fail();
         } catch(IOException expected) {}
         try {
             new SocketThatFailOnClose("localhost", 1, true);
+            fail();
         } catch(IOException expected) {}
         try {
             new SocketThatFailOnClose(InetAddress.getLocalHost(), 1, true);
+            fail();
         } catch(IOException expected) {}
     }
 
diff --git a/luni/src/test/java/libcore/java/net/URLConnectionTest.java b/luni/src/test/java/libcore/java/net/URLConnectionTest.java
index 1bc31d5..d1d26a8 100644
--- a/luni/src/test/java/libcore/java/net/URLConnectionTest.java
+++ b/luni/src/test/java/libcore/java/net/URLConnectionTest.java
@@ -154,7 +154,7 @@
         // allow (but strip) trailing \n, \r and \r\n
         // assertForbiddenRequestHeaderValue("\r");
         // End of workaround
-        assertForbiddenRequestHeaderValue("\t");
+        assertEquals("a valid\tvalue", setAndReturnRequestHeaderValue("a valid\tvalue"));
         assertForbiddenRequestHeaderValue("\u001f");
         assertForbiddenRequestHeaderValue("\u007f");
 
diff --git a/luni/src/test/java/libcore/java/nio/channels/AsynchronousChannelGroupTest.java b/luni/src/test/java/libcore/java/nio/channels/AsynchronousChannelGroupTest.java
index 28e30e0..0ddf0bc 100644
--- a/luni/src/test/java/libcore/java/nio/channels/AsynchronousChannelGroupTest.java
+++ b/luni/src/test/java/libcore/java/nio/channels/AsynchronousChannelGroupTest.java
@@ -99,6 +99,7 @@
         // It should not be possible to bind a new channel.
         try {
             AsynchronousServerSocketChannel.open(acg);
+            fail();
         } catch (ShutdownChannelGroupException expected) {}
 
         // ExecutorService hasn't yet terminated as the channel is still open.
@@ -127,6 +128,7 @@
         // It should not be possible to bind a new channel.
         try {
             AsynchronousServerSocketChannel.open(acg);
+            fail();
         } catch (ShutdownChannelGroupException expected) {}
 
         acg.shutdownNow();
diff --git a/luni/src/test/java/libcore/java/nio/channels/DatagramChannelMulticastTest.java b/luni/src/test/java/libcore/java/nio/channels/DatagramChannelMulticastTest.java
index 1e7cefe..0951302 100644
--- a/luni/src/test/java/libcore/java/nio/channels/DatagramChannelMulticastTest.java
+++ b/luni/src/test/java/libcore/java/nio/channels/DatagramChannelMulticastTest.java
@@ -1156,11 +1156,13 @@
 
         try {
             membershipKey.block(UNICAST_IPv4_1);
+            fail();
         } catch (IllegalStateException expected) {
         }
 
         try {
             membershipKey.unblock(UNICAST_IPv4_1);
+            fail();
         } catch (IllegalStateException expected) {
         }
 
diff --git a/luni/src/test/java/libcore/java/nio/channels/DatagramChannelTest.java b/luni/src/test/java/libcore/java/nio/channels/DatagramChannelTest.java
index f3bd7ff..6943a53 100644
--- a/luni/src/test/java/libcore/java/nio/channels/DatagramChannelTest.java
+++ b/luni/src/test/java/libcore/java/nio/channels/DatagramChannelTest.java
@@ -209,6 +209,7 @@
         socketAddress = new InetSocketAddress(Inet4Address.LOOPBACK, 0);
         try {
             channel.bind(socketAddress);
+            fail();
         } catch (ClosedChannelException expected) {}
     }
 
diff --git a/luni/src/test/java/libcore/java/nio/channels/MembershipKeyTest.java b/luni/src/test/java/libcore/java/nio/channels/MembershipKeyTest.java
index 43cc26d..7f385a0 100644
--- a/luni/src/test/java/libcore/java/nio/channels/MembershipKeyTest.java
+++ b/luni/src/test/java/libcore/java/nio/channels/MembershipKeyTest.java
@@ -161,6 +161,7 @@
         init(true);
         try {
             key.block(sourceAddress);
+            fail();
         } catch (IllegalStateException expected) {}
     }
 
diff --git a/luni/src/test/java/libcore/java/nio/channels/SocketChannelTest.java b/luni/src/test/java/libcore/java/nio/channels/SocketChannelTest.java
index 72609ee..9cd916d 100644
--- a/luni/src/test/java/libcore/java/nio/channels/SocketChannelTest.java
+++ b/luni/src/test/java/libcore/java/nio/channels/SocketChannelTest.java
@@ -321,6 +321,7 @@
         socketAddress = new InetSocketAddress(Inet4Address.LOOPBACK, 0);
         try {
             sc.bind(socketAddress);
+            fail();
         } catch (ClosedChannelException expected) {
         }
     }
diff --git a/luni/src/test/java/libcore/java/nio/file/Files2Test.java b/luni/src/test/java/libcore/java/nio/file/Files2Test.java
index 61b8878..d4f50a7 100644
--- a/luni/src/test/java/libcore/java/nio/file/Files2Test.java
+++ b/luni/src/test/java/libcore/java/nio/file/Files2Test.java
@@ -217,10 +217,12 @@
         FileAttribute<Set<PosixFilePermission>> attr = PosixFilePermissions.asFileAttribute(perm);
         try {
             Files.setPosixFilePermissions(null, perm);
+            fail();
         } catch(NullPointerException expected) {}
 
         try {
             Files.setPosixFilePermissions(filesSetup.getDataFilePath(), null);
+            fail();
         } catch(NullPointerException expected) {}
     }
 
diff --git a/luni/src/test/java/libcore/java/security/DomainLoadStoreParameterTest.java b/luni/src/test/java/libcore/java/security/DomainLoadStoreParameterTest.java
new file mode 100644
index 0000000..2c2e4b8
--- /dev/null
+++ b/luni/src/test/java/libcore/java/security/DomainLoadStoreParameterTest.java
@@ -0,0 +1,109 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package libcore.java.security;
+
+import junit.framework.TestCase;
+
+import java.net.URI;
+import java.security.KeyStore;
+import java.security.DomainLoadStoreParameter;
+import java.util.HashMap;
+import java.util.Map;
+
+public class DomainLoadStoreParameterTest extends TestCase {
+    private static final String KEY_STORE_NAME = "keyStoreName";
+    private KeyStore.ProtectionParameter protectionParameter;
+    private URI validConfigurationURI;
+
+    @Override
+    public void setUp() throws Exception {
+        super.setUp();
+        protectionParameter = new KeyStore.ProtectionParameter() {};
+        validConfigurationURI = new URI("http://UriForConfiguration.SergioRulesTheWorld.com/");
+    }
+
+    public void testConstructor_nullValues_throwException() throws Exception {
+        try {
+            new DomainLoadStoreParameter(null /* configuration */,
+                    createNonEmptyParameters(KEY_STORE_NAME, protectionParameter));
+            fail("configuration can't be null when creating DomainLoadStoreParameter");
+        } catch (NullPointerException expected) {
+        }
+
+        try {
+            new DomainLoadStoreParameter(validConfigurationURI, null /* protectionParameters */);
+            fail("protection parameters can't be null when creating DomainLoadStoreParameter");
+        } catch (NullPointerException expected) {
+        }
+    }
+
+    /**
+     * Check that it returns the configuration specified in the constructor.
+     */
+    public void testGetConfiguration() {
+        DomainLoadStoreParameter domainLoadStoreParameter =
+                new DomainLoadStoreParameter(validConfigurationURI,
+                        createNonEmptyParameters(KEY_STORE_NAME, protectionParameter));
+        assertSame(validConfigurationURI, domainLoadStoreParameter.getConfiguration());
+    }
+
+    public void testGetProtectionParams() {
+        Map<String, KeyStore.ProtectionParameter> protectionParameters =
+                createNonEmptyParameters(KEY_STORE_NAME, protectionParameter);
+        DomainLoadStoreParameter domainLoadStoreParameter =
+                new DomainLoadStoreParameter(validConfigurationURI, protectionParameters);
+        Map<String, KeyStore.ProtectionParameter> returnedParams =
+                domainLoadStoreParameter.getProtectionParams();
+        assertEquals(protectionParameters, returnedParams);
+
+        // Trying to add to the returned set throws an exception
+        try {
+            returnedParams.put("some_other_keystore", protectionParameter);
+            fail("The parameters returned by getProtectionParams should be unmodifiable");
+        } catch (UnsupportedOperationException expected) {
+        }
+
+        // Adding to the map passed as parameter doesn't change value in the
+        // {@code DomainLoadStoreParameter}, ie, it holds a copy.
+        Map<String, KeyStore.ProtectionParameter> originalProtectionParameters
+                = new HashMap<>(protectionParameters);
+        protectionParameters.put("some_other_keystore", protectionParameter);
+        assertEquals(originalProtectionParameters,
+                domainLoadStoreParameter.getProtectionParams());
+
+    }
+
+    /**
+     * Getter for the protection parameters in this domain.
+     *
+     * Check that always returns null. Keystore domains do not support a protection parameter.
+     */
+    public void testGetProtectionParameter() {
+        DomainLoadStoreParameter domainLoadStoreParameter =
+                new DomainLoadStoreParameter(validConfigurationURI,
+                        createNonEmptyParameters("keyStoreName", protectionParameter));
+        // Check that always returns null. Keystore domains do not support a protection parameter.
+        assertNull(domainLoadStoreParameter.getProtectionParameter());
+    }
+
+    private Map<String, KeyStore.ProtectionParameter> createNonEmptyParameters(
+            String keyStoreName, KeyStore.ProtectionParameter protectionParameter) {
+        Map<String, KeyStore.ProtectionParameter> protectionParameters = new HashMap<>();
+        protectionParameters.put(keyStoreName, protectionParameter);
+        return protectionParameters;
+    }
+}
diff --git a/luni/src/test/java/libcore/java/security/PKCS12AttributeTest.java b/luni/src/test/java/libcore/java/security/PKCS12AttributeTest.java
new file mode 100644
index 0000000..d77f0e2
--- /dev/null
+++ b/luni/src/test/java/libcore/java/security/PKCS12AttributeTest.java
@@ -0,0 +1,195 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License
+ */
+
+package java.security;
+
+import junit.framework.TestCase;
+
+import java.io.IOException;
+import java.util.Arrays;
+
+
+public class PKCS12AttributeTest extends TestCase {
+    private static final String PKCS9_EMAIL_ADDRESS_OID = "1.2.840.113549.1.9.1";
+    private static final String PKCS9_CONTENT_TYPE_OID = "1.2.840.113549.1.9.3";
+    private static final String PKCS7_SIGNED_DATA_OID = "1.2.840.113549.1.7.2";
+    private static final String EXAMPLE_EMAIL_ADDRESS = "someemail@server.com";
+    private static final String EXAMPLE_EMAIL_ADDRESS_2 = "someotheremail@server.com";
+    private static final String EXAMPLE_SEQUENCE_OF_EMAILS =
+            "[" + EXAMPLE_EMAIL_ADDRESS + ", " + EXAMPLE_EMAIL_ADDRESS_2 + "]";
+
+    /*
+     * Encoded attribute obtained using BouncyCastle as an oracle for the known answer:
+     *
+            DERSequence s = new DERSequence(new ASN1Encodable[] {
+                new ASN1ObjectIdentifier("1.2.840.113549.1.9.1"),
+                new DERSet(new ASN1Encodable[] { new DERUTF8String("someemail@server.com") })
+            });
+            System.out.println(Arrays.toString(s.getEncoded()));
+     */
+    private static final byte[] ENCODED_ATTRIBUTE_UTF8_EMAIL_ADDRESS = new byte[] {
+            48, 35, 6, 9, 42, -122, 72, -122, -9, 13, 1, 9, 1, 49, 22, 12, 20, 115, 111, 109,
+            101, 101, 109, 97, 105, 108, 64, 115, 101, 114, 118, 101, 114, 46, 99, 111, 109
+    };
+
+    /*
+     * Encoded attribute obtained using BouncyCastle as an oracle for the known answer:
+     *
+            DERSequence s = new DERSequence(new ASN1Encodable[] {
+                new ASN1ObjectIdentifier("1.2.840.113549.1.9.1"),
+                    new DERSet(new ASN1Encodable[] {
+                        new DEROctetString("someemail@server.com".getBytes())
+                    })
+            });
+            System.out.println(Arrays.toString(s.getEncoded()));
+    */
+    private static final byte[] ENCODED_ATTRIBUTE_OCTET_EMAIL_ADDRESS = new byte[] {
+            48, 35, 6, 9, 42, -122, 72, -122, -9, 13, 1, 9, 1, 49, 22, 4, 20, 115, 111, 109,
+            101, 101, 109, 97, 105, 108, 64, 115, 101, 114, 118, 101, 114, 46, 99, 111, 109
+    };
+
+    /*
+     * Encoded attribute obtained using BouncyCastle as an oracle for the known answer:
+     *
+            DERSequence s = new DERSequence(new ASN1Encodable[] {
+                new ASN1ObjectIdentifier("1.2.840.113549.1.9.1"),
+                new DERSet(new ASN1Encodable[] {
+                    new DERUTF8String("someemail@server.com"),
+                    new DERUTF8String("someotheremail@server.com"),
+                })
+            });
+     */
+    private static final byte[] ENCODED_ATTRIBUTE_SEQUENCE_OF_EMAIL_ADDRESSES = new byte[] {
+            48, 62, 6, 9, 42, -122, 72, -122, -9, 13, 1, 9, 1, 49, 49, 12, 20, 115, 111, 109,
+            101, 101, 109, 97, 105, 108, 64, 115, 101, 114, 118, 101, 114, 46, 99, 111, 109, 12, 25,
+            115, 111, 109, 101, 111, 116, 104, 101, 114, 101, 109, 97, 105, 108, 64, 115, 101,
+            114, 118, 101, 114, 46, 99, 111, 109
+    };
+
+    /*
+     * Encoded attribute obtained using BouncyCastle as an oracle for the known answer:
+     *
+            DERSequence s = new DERSequence(new ASN1Encodable[] {
+                new ASN1ObjectIdentifier("1.2.840.113549.1.9.3"),
+                new DERSet(new ASN1Encodable[] {
+                    new ASN1ObjectIdentifier("1.2.840.113549.1.7.2")
+                })
+            });
+            System.out.println(Arrays.toString(s.getEncoded()));
+    */
+    private static final byte[] ENCODED_ATTRIBUTE_CONTENT_TYPE_SIGNED_DATA = new byte[] {
+            48, 24, 6, 9, 42, -122, 72, -122, -9, 13, 1, 9, 3, 49, 11, 6, 9, 42, -122, 72, -122, -9,
+            13, 1, 7, 2
+    };
+
+    /*
+      echo -n 'someemail@server.com' | recode ../x1 | tr $'\x0a' ' ' \
+          | sed 's/, /:/g' | sed 's/0x//g'
+     */
+    private static final String EXAMPLE_EMAIL_AS_HEX_BYTES =
+            "73:6F:6D:65:65:6D:61:69:6C:40:73:65:72:76:65:72:2E:63:6F:6D";
+
+    public void test_Constructor_String_String_success() {
+        PKCS12Attribute att = new PKCS12Attribute(PKCS9_EMAIL_ADDRESS_OID, EXAMPLE_EMAIL_ADDRESS);
+        assertEquals(PKCS9_EMAIL_ADDRESS_OID, att.getName());
+        assertEquals(EXAMPLE_EMAIL_ADDRESS, att.getValue());
+    }
+
+    public void test_Constructor_String_String_nullOID_throwsException() {
+        try {
+            new PKCS12Attribute(null, EXAMPLE_EMAIL_ADDRESS);
+            fail("Constructor allowed a null OID");
+        } catch(NullPointerException expected) {
+        }
+    }
+
+    public void test_Constructor_String_String_nullValue_throwsException() {
+        try {
+            new PKCS12Attribute(PKCS9_EMAIL_ADDRESS_OID, null);
+            fail("Constructor allowed a null value");
+        } catch(NullPointerException expected) {
+        }
+    }
+
+    public void test_Constructor_String_String_wrongOID_throwsException() {
+        try {
+            PKCS12Attribute att =
+                    new PKCS12Attribute("IDontThinkThisIsAnOID", EXAMPLE_EMAIL_ADDRESS);
+            fail("Constructor allowed an invalid OID");
+        } catch(IllegalArgumentException expected) {
+        }
+    }
+
+    public void test_Constructor_byteArray_success() {
+        PKCS12Attribute att = new PKCS12Attribute(ENCODED_ATTRIBUTE_UTF8_EMAIL_ADDRESS);
+        assertEquals(PKCS9_EMAIL_ADDRESS_OID, att.getName());
+        assertEquals(EXAMPLE_EMAIL_ADDRESS, att.getValue());
+    }
+
+    public void testConstructor_byteArray_nullEncoded_throwsException() {
+        try {
+            new PKCS12Attribute(null);
+            fail("Constructor accepted null encoded value");
+        } catch (NullPointerException expected) {
+        }
+    }
+
+    public void test_Constructor_byteArray_wrongEncoding_throwsException() {
+        try {
+            new PKCS12Attribute(new byte[]{3, 14, 16});
+            fail("Constructor accepted invalid encoding");
+        } catch (IllegalArgumentException expected) {
+        }
+    }
+
+    public void test_Constructor_String_String_sequenceValue() {
+        PKCS12Attribute att = new PKCS12Attribute(
+                PKCS9_EMAIL_ADDRESS_OID, EXAMPLE_SEQUENCE_OF_EMAILS);
+        assertEquals(PKCS9_EMAIL_ADDRESS_OID, att.getName());
+        assertEquals(EXAMPLE_SEQUENCE_OF_EMAILS, att.getValue());
+        assertEquals(Arrays.toString(ENCODED_ATTRIBUTE_SEQUENCE_OF_EMAIL_ADDRESSES),
+                Arrays.toString(att.getEncoded()));
+    }
+
+    public void test_Constructor_String_String_hexValues() {
+        PKCS12Attribute att = new PKCS12Attribute(
+                PKCS9_EMAIL_ADDRESS_OID, EXAMPLE_EMAIL_AS_HEX_BYTES);
+        assertEquals(PKCS9_EMAIL_ADDRESS_OID, att.getName());
+        assertEquals(EXAMPLE_EMAIL_AS_HEX_BYTES, att.getValue());
+        // When specified as hex bytes, the underlying encoding is a DER octet string.
+        assertEquals(Arrays.toString(ENCODED_ATTRIBUTE_OCTET_EMAIL_ADDRESS),
+                Arrays.toString(att.getEncoded()));
+    }
+
+    public void test_Equals() {
+        PKCS12Attribute att = new PKCS12Attribute(
+                PKCS9_EMAIL_ADDRESS_OID, EXAMPLE_EMAIL_ADDRESS);
+        assertTrue(att.equals(att));
+        assertFalse(att.equals(new Object()));
+        assertFalse(att.equals(null));
+        assertTrue(att.equals(new PKCS12Attribute(ENCODED_ATTRIBUTE_UTF8_EMAIL_ADDRESS)));
+        assertFalse(att.equals(
+                new PKCS12Attribute(ENCODED_ATTRIBUTE_SEQUENCE_OF_EMAIL_ADDRESSES)));
+    }
+
+    /* Test the case in which the value encoded is an object id.*/
+    public void test_encoding_ObjectIdValue() {
+        PKCS12Attribute att = new PKCS12Attribute(ENCODED_ATTRIBUTE_CONTENT_TYPE_SIGNED_DATA);
+        assertEquals(PKCS9_CONTENT_TYPE_OID, att.getName());
+        /* Value is correctly decoded to a string. */
+        assertEquals(PKCS7_SIGNED_DATA_OID, att.getValue());
+    }
+}
diff --git a/luni/src/test/java/libcore/java/security/PrivilegedActionExceptionTest.java b/luni/src/test/java/libcore/java/security/PrivilegedActionExceptionTest.java
new file mode 100644
index 0000000..6f74dd8
--- /dev/null
+++ b/luni/src/test/java/libcore/java/security/PrivilegedActionExceptionTest.java
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package libcore.java.security;
+
+import org.junit.Test;
+
+import java.security.PrivilegedActionException;
+
+import static org.junit.Assert.assertSame;
+
+public class PrivilegedActionExceptionTest {
+
+    /**
+     * PrivilegedActionException's constructor argument may be rethrown by getException() or
+     * getCause().
+     * b/31360928
+     */
+    @Test
+    public void testGetException() {
+        Exception e = new Exception();
+        PrivilegedActionException pae = new PrivilegedActionException(e);
+
+        assertSame(e, pae.getException());
+        assertSame(e, pae.getCause());
+    }
+}
diff --git a/luni/src/test/java/libcore/java/security/ProviderTest.java b/luni/src/test/java/libcore/java/security/ProviderTest.java
index d525cf0..d9d0d31 100644
--- a/luni/src/test/java/libcore/java/security/ProviderTest.java
+++ b/luni/src/test/java/libcore/java/security/ProviderTest.java
@@ -41,9 +41,12 @@
 import java.util.Locale;
 import java.util.Map;
 import java.util.Map.Entry;
+import java.util.Objects;
 import java.util.Set;
 import java.util.TreeMap;
+import java.util.function.BiFunction;
 import java.util.function.Consumer;
+import java.util.function.Function;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 import javax.crypto.Cipher;
@@ -554,6 +557,46 @@
     }
 
     @SuppressWarnings("serial")
+    public void testProviderService_newInstance_PrivateClass_throws()
+            throws Exception {
+        MockProvider provider = new MockProvider("MockProvider");
+
+        provider.putServiceForTest(new Provider.Service(provider, "CertStore", "FOO",
+                CertStoreSpiPrivateClass.class.getName(), null, null));
+
+        Security.addProvider(provider);
+        // The class for the service is private, it must fail with NoSuchAlgorithmException
+        try {
+            Provider.Service service = provider.getService("CertStore", "FOO");
+            service.newInstance(null);
+            fail();
+        } catch (NoSuchAlgorithmException expected) {
+        } finally {
+            Security.removeProvider(provider.getName());
+        }
+    }
+
+    @SuppressWarnings("serial")
+    public void testProviderService_newInstance_PrivateEmptyConstructor_throws()
+            throws Exception {
+        MockProvider provider = new MockProvider("MockProvider");
+
+        provider.putServiceForTest(new Provider.Service(provider, "CertStore", "FOO",
+                CertStoreSpiPrivateEmptyConstructor.class.getName(), null, null));
+
+        Security.addProvider(provider);
+        // The empty constructor is private, it must fail with NoSuchAlgorithmException
+        try {
+            Provider.Service service = provider.getService("CertStore", "FOO");
+            service.newInstance(null);
+            fail();
+        } catch (NoSuchAlgorithmException expected) {
+        } finally {
+            Security.removeProvider(provider.getName());
+        }
+    }
+
+    @SuppressWarnings("serial")
     public void testProviderService_AliasDoesNotEraseCanonical_Success()
             throws Exception {
         // Make sure we start with a "known good" alias for this OID.
@@ -632,6 +675,45 @@
         }
     }
 
+    private static class CertStoreSpiPrivateClass extends CertStoreSpi {
+        public CertStoreSpiPrivateClass()
+                throws InvalidAlgorithmParameterException {
+            super(null);
+        }
+
+        @Override
+        public Collection<? extends Certificate> engineGetCertificates(CertSelector selector)
+                throws CertStoreException {
+            throw new UnsupportedOperationException();
+        }
+
+        @Override
+        public Collection<? extends CRL> engineGetCRLs(CRLSelector selector)
+                throws CertStoreException {
+            throw new UnsupportedOperationException();
+        }
+    }
+
+    private static class CertStoreSpiPrivateEmptyConstructor extends CertStoreSpi {
+        private CertStoreSpiPrivateEmptyConstructor(CertStoreParameters params)
+                throws InvalidAlgorithmParameterException {
+            super(null);
+        }
+
+        @Override
+        public Collection<? extends Certificate> engineGetCertificates(CertSelector selector)
+                throws CertStoreException {
+            throw new UnsupportedOperationException();
+        }
+
+        @Override
+        public Collection<? extends CRL> engineGetCRLs(CRLSelector selector)
+                throws CertStoreException {
+            throw new UnsupportedOperationException();
+        }
+    }
+
+
     public static class MyCertStoreParameters implements CertStoreParameters {
         public Object clone() {
             return new MyCertStoreParameters();
@@ -692,6 +774,118 @@
                 "class2.algorithm1",
                 mapOf("class1.algorithm1", "impl1"),
                 true /* mustChangeSecurityVersion */);
+        performHashMapOperationAndCheckResults(
+                COMPUTE,
+                mapOf("class1.algorithm1", "impl1"),
+                // It's really difficult to find an example of this that sounds realistic
+                // for a Provider...
+                new Pair("class1.algorithm1", CONCAT),
+                mapOf("class1.algorithm1", "class1.algorithm1impl1"),
+                true);
+        performHashMapOperationAndCheckResults(
+                PUT_IF_ABSENT,
+                mapOf("class1.algorithm1", "impl1"),
+                new Pair("class1.algorithm1", "impl2"),
+                // Don't put because key is absent.
+                mapOf("class1.algorithm1", "impl1"),
+                true);
+        performHashMapOperationAndCheckResults(
+                PUT_IF_ABSENT,
+                mapOf("class1.algorithm1", "impl1"),
+                new Pair("class2.algorithm2", "impl2"),
+                mapOf("class1.algorithm1", "impl1", "class2.algorithm2", "impl2"),
+                true);
+        performHashMapOperationAndCheckResults(
+                PUT_IF_ABSENT,
+                mapOf("class1.algorithm1", "impl1"),
+                new Pair("class2.algorithm2", "impl2"),
+                mapOf("class1.algorithm1", "impl1", "class2.algorithm2", "impl2"),
+                true);
+        performHashMapOperationAndCheckResults(
+                COMPUTE_IF_PRESENT,
+                mapOf("class1.algorithm1", "impl1"),
+                new Pair("class1.algorithm1", CONCAT),
+                mapOf("class1.algorithm1", "class1.algorithm1impl1"),
+                true);
+        performHashMapOperationAndCheckResults(
+                COMPUTE_IF_PRESENT,
+                mapOf("class1.algorithm1", "impl1"),
+                new Pair("class2.algorithm2", CONCAT),
+                // Don't compute because is not present.
+                mapOf("class1.algorithm1", "impl1"),
+                true);
+        performHashMapOperationAndCheckResults(
+                COMPUTE_IF_ABSENT,
+                mapOf("class1.algorithm1", "impl1"),
+                new Pair("class2.algorithm2", TO_UPPER_CASE),
+                mapOf("class1.algorithm1", "impl1", "class2.algorithm2", "CLASS2.ALGORITHM2"),
+                true);
+        performHashMapOperationAndCheckResults(
+                COMPUTE_IF_ABSENT,
+                mapOf("class1.algorithm1", "impl1"),
+                new Pair("class1.algorithm1", TO_UPPER_CASE),
+                // Don't compute because if not absent.
+                mapOf("class1.algorithm1", "impl1"),
+                true);
+        performHashMapOperationAndCheckResults(
+                REPLACE_USING_KEY,
+                mapOf("class1.algorithm1", "impl1", "class2.algorithm2", "impl2"),
+                new Pair("class1.algorithm1", "impl3"),
+                mapOf("class1.algorithm1", "impl3", "class2.algorithm2", "impl2"),
+                true);
+        performHashMapOperationAndCheckResults(
+                REPLACE_USING_KEY,
+                mapOf("class1.algorithm1", "impl1", "class2.algorithm2", "impl2"),
+                new Pair("class1.algorithm3", "impl3"),
+                // Do not replace as the key is not present.
+                mapOf("class1.algorithm1", "impl1", "class2.algorithm2", "impl2"),
+                true);
+        performHashMapOperationAndCheckResults(
+                REPLACE_USING_KEY_AND_VALUE,
+                mapOf("class1.algorithm1", "impl1", "class2.algorithm2", "impl2"),
+                new Pair(new Pair("class1.algorithm1", "impl1"), "impl3"),
+                mapOf("class1.algorithm1", "impl3", "class2.algorithm2", "impl2"),
+                true);
+        performHashMapOperationAndCheckResults(
+                REPLACE_USING_KEY_AND_VALUE,
+                mapOf("class1.algorithm1", "impl1", "class2.algorithm2", "impl2"),
+                new Pair(new Pair("class1.algorithm1", "impl4"), "impl3"),
+                // Do not replace as the key/value pair is not present.
+                mapOf("class1.algorithm1", "impl1", "class2.algorithm2", "impl2"),
+                true);
+        performHashMapOperationAndCheckResults(
+                REPLACE_ALL,
+                mapOf("class1.algorithm1", "impl1", "class2.algorithm2", "impl2"),
+                // Applying simply CONCAT will affect internal mappings of the provider (version,
+                // info, name, etc)
+                CONCAT_IF_STARTING_WITH_CLASS,
+                mapOf("class1.algorithm1", "class1.algorithm1impl1",
+                        "class2.algorithm2", "class2.algorithm2impl2"),
+                true);
+        performHashMapOperationAndCheckResults(
+                MERGE,
+                mapOf("class1.algorithm1", "impl1", "class2.algorithm2", "impl2"),
+                new Pair(new Pair("class1.algorithm1", "impl3"), CONCAT),
+                // The key is present, so the function is used.
+                mapOf("class1.algorithm1", "impl1impl3",
+                        "class2.algorithm2", "impl2"),
+                true);
+        performHashMapOperationAndCheckResults(
+                MERGE,
+                mapOf("class1.algorithm1", "impl1", "class2.algorithm2", "impl2"),
+                new Pair(new Pair("class3.algorithm3", "impl3"), CONCAT),
+                // The key is not present, so the value is used.
+                mapOf("class1.algorithm1", "impl1",
+                        "class2.algorithm2", "impl2",
+                        "class3.algorithm3", "impl3"),
+                true);
+    }
+
+    public void test_getOrDefault() {
+        Provider p = new MockProvider("MockProvider");
+        p.put("class1.algorithm1", "impl1");
+        assertEquals("impl1", p.getOrDefault("class1.algorithm1", "default"));
+        assertEquals("default", p.getOrDefault("thisIsNotInTheProvider", "default"));
     }
 
     private static class Pair<A, B> {
@@ -714,17 +908,77 @@
     }
 
     private static final Consumer<ProviderAndOperationParameter<Pair<String, String>>> PUT =
-            (ProviderAndOperationParameter<Pair<String, String>> provAndParam) ->
-                {
-                    provAndParam.provider.put(provAndParam.operationParameters.first,
+            provAndParam ->
+                    provAndParam.provider.put(
+                            provAndParam.operationParameters.first,
                             provAndParam.operationParameters.second);
-                };
+
     private static final Consumer<ProviderAndOperationParameter<Map<String, String>>> PUT_ALL =
-            (ProviderAndOperationParameter<Map<String, String>> provAndParam) ->
-                    provAndParam.provider.putAll(provAndParam.operationParameters);
+            provAndParam -> provAndParam.provider.putAll(provAndParam.operationParameters);
+
     private static final Consumer<ProviderAndOperationParameter<String>> REMOVE =
-            (ProviderAndOperationParameter<String> provAndParam) ->
-                    provAndParam.provider.remove(provAndParam.operationParameters);
+            provAndParam -> provAndParam.provider.remove(provAndParam.operationParameters);
+
+    private static final Consumer<ProviderAndOperationParameter<
+            Pair<String, BiFunction<Object, Object, Object>>>> COMPUTE =
+                    provAndParam -> provAndParam.provider.compute(
+                            provAndParam.operationParameters.first,
+                            provAndParam.operationParameters.second);
+
+    private static final BiFunction<Object, Object, Object> CONCAT =
+            (a, b) -> Objects.toString(a) + Objects.toString(b);
+
+    private static final Consumer<ProviderAndOperationParameter<Pair<String, String>>>
+            PUT_IF_ABSENT = provAndParam ->
+                    provAndParam.provider.putIfAbsent(
+                            provAndParam.operationParameters.first,
+                            provAndParam.operationParameters.second);
+
+    private static final Consumer<ProviderAndOperationParameter<
+            Pair<String, BiFunction<Object, Object, Object>>>> COMPUTE_IF_PRESENT =
+                    provAndParam -> provAndParam.provider.computeIfPresent(
+                            provAndParam.operationParameters.first,
+                            provAndParam.operationParameters.second);
+
+    private static final Consumer<ProviderAndOperationParameter<
+            Pair<String, Function<Object, Object>>>> COMPUTE_IF_ABSENT =
+                    provAndParam -> provAndParam.provider.computeIfAbsent(
+                            provAndParam.operationParameters.first,
+                            provAndParam.operationParameters.second);
+
+    private static final Function<Object, Object> TO_UPPER_CASE =
+            s -> Objects.toString(s).toUpperCase();
+
+    private static final Consumer<ProviderAndOperationParameter<Pair<String, String>>>
+            REPLACE_USING_KEY = provAndParam ->
+                    provAndParam.provider.replace(
+                            provAndParam.operationParameters.first,
+                            provAndParam.operationParameters.second);
+
+    private static final Consumer<ProviderAndOperationParameter<Pair<Pair<String, String>, String>>>
+            REPLACE_USING_KEY_AND_VALUE = provAndParam ->
+            provAndParam.provider.replace(
+                    provAndParam.operationParameters.first.first,
+                    provAndParam.operationParameters.first.second,
+                    provAndParam.operationParameters.second);
+
+    private static final Consumer<ProviderAndOperationParameter<
+                BiFunction<Object, Object, Object>>> REPLACE_ALL =
+                        provAndParam -> provAndParam.provider.replaceAll(
+                                provAndParam.operationParameters);
+
+    private static final BiFunction<Object, Object, Object> CONCAT_IF_STARTING_WITH_CLASS =
+            (a, b) -> (Objects.toString(a).startsWith("class"))
+                    ? Objects.toString(a) + Objects.toString(b)
+                    : b;
+
+    private static final Consumer<ProviderAndOperationParameter<
+                    Pair<Pair<String, String>, BiFunction<Object, Object, Object>>>>
+            MERGE = provAndParam -> provAndParam.provider.merge(
+                    provAndParam.operationParameters.first.first,
+                    provAndParam.operationParameters.first.second,
+                    provAndParam.operationParameters.second);
+
 
 
     private static Map<String, String> mapOf(String... elements) {
diff --git a/luni/src/test/java/libcore/java/security/SecureRandomTest.java b/luni/src/test/java/libcore/java/security/SecureRandomTest.java
index 7eb3b45..2224c70 100644
--- a/luni/src/test/java/libcore/java/security/SecureRandomTest.java
+++ b/luni/src/test/java/libcore/java/security/SecureRandomTest.java
@@ -174,4 +174,40 @@
                     SecureRandom.DEFAULT_SDK_TARGET_FOR_CRYPTO_PROVIDER_WORKAROUND);
         }
     }
+
+    /**
+     * Test that the strong instance is from OpenSSLProvider (as specified in security.properties)
+     * even if there are other providers installed.
+     */
+    public void testGetInstanceStrong() throws Exception {
+        Provider openSSLProvider = null;
+        for (Provider p : Security.getProviders()) {
+            if (p.getClass().getName().equals("com.android.org.conscrypt.OpenSSLProvider")) {
+                openSSLProvider = p;
+            }
+        }
+        if (openSSLProvider == null) {
+            throw new IllegalStateException("OpenSSLProvider not found");
+        }
+
+        // Default comes from the OpenSSLProvider
+        assertEquals(openSSLProvider, SecureRandom.getInstance("SHA1PRNG").getProvider());
+        assertEquals(openSSLProvider, new SecureRandom().getProvider());
+
+        Provider weakProvider = new Provider("MockWeakSecureRandomProvider", 1.0, "For testing") {
+        };
+        weakProvider.put("SecureRandom.SHA1PRNG", ProviderTest.SecureRandom1.class.getName());
+
+        // Insert a different provider with highest priority.
+        try {
+            Security.insertProviderAt(weakProvider, 1);
+            // Default comes from the weak provider.
+            assertEquals(weakProvider, SecureRandom.getInstance("SHA1PRNG").getProvider());
+            assertEquals(weakProvider, new SecureRandom().getProvider());
+            // Strong SecureRandom comes from the OpenSSLProvider.
+            assertEquals(openSSLProvider, SecureRandom.getInstanceStrong().getProvider());
+        } finally {
+            Security.removeProvider(weakProvider.getName());
+        }
+    }
 }
diff --git a/luni/src/test/java/libcore/java/security/cert/X509CRLTest.java b/luni/src/test/java/libcore/java/security/cert/X509CRLTest.java
index 1611120..817ad28 100644
--- a/luni/src/test/java/libcore/java/security/cert/X509CRLTest.java
+++ b/luni/src/test/java/libcore/java/security/cert/X509CRLTest.java
@@ -16,6 +16,8 @@
 
 package libcore.java.security.cert;
 
+import sun.security.provider.X509Factory;
+import sun.security.x509.X509CRLImpl;
 import tests.support.resource.Support_Resources;
 
 import java.io.BufferedReader;
@@ -146,6 +148,14 @@
         }
     }
 
+    public void test_X509CRLImpl_verify() throws Exception {
+        CertificateFactory f = CertificateFactory.getInstance("X.509");
+        X509CRL crlRsa = getCRL(f, CRL_RSA);
+        X509CRLImpl interned = X509Factory.intern(crlRsa);
+        X509Certificate caCert = getCertificate(f, CERT_CRL_CA);
+        interned.verify(caCert.getPublicKey(), f.getProvider());
+    }
+
     public void test_Provider() throws Exception {
         final ByteArrayOutputStream errBuffer = new ByteArrayOutputStream();
         PrintStream out = new PrintStream(errBuffer);
@@ -184,14 +194,45 @@
         X509CRL crlRsa = getCRL(f, CRL_RSA);
 
         X509Certificate caCert = getCertificate(f, CERT_CRL_CA);
+
+        // Test the "verify" method that doesn't specify the provider.
         crlRsa.verify(caCert.getPublicKey());
 
+        // Test the "verify" method that does specify the provider.
+        try {
+            crlRsa.verify(caCert.getPublicKey(), f.getProvider());
+        } catch (UnsupportedOperationException unsupportedOperationException) {
+            // TODO(31294527): X590CRL objects from AndroidOpenSSL do not have this method.
+            // The "default" implementation from OpenJDK results in an infinite loop, so in libcore
+            // we throw an UnsupportedOperationException instead.
+            if (!f.getProvider().getName().equals("AndroidOpenSSL")) {
+                throw unsupportedOperationException;
+            }
+        }
+
         X509Certificate dsaCert = getCertificate(f, CERT_DSA);
+
+        // Test the "verify" method that does specify the provider.
         try {
             crlRsa.verify(dsaCert.getPublicKey());
             fail("should not verify using incorrect key type");
         } catch (InvalidKeyException expected) {
         }
+
+        // Test the "verify" method that does specify the provider.
+        try {
+            crlRsa.verify(dsaCert.getPublicKey(), f.getProvider());
+            fail("should not verify using incorrect key type");
+        } catch (InvalidKeyException expected) {
+
+        } catch (UnsupportedOperationException unsupportedOperationException) {
+            // TODO(31294527): X590CRL objects from AndroidOpenSSL do not have this method.
+            // The "default" implementation from OpenJDK results in an infinite loop, so in libcore
+            // we throw an UnsupportedOperationException instead.
+            if (!f.getProvider().getName().equals("AndroidOpenSSL")) {
+                throw unsupportedOperationException;
+            }
+        }
     }
 
     private void getType(CertificateFactory f) throws Exception {
diff --git a/luni/src/test/java/libcore/java/util/Base64Test.java b/luni/src/test/java/libcore/java/util/Base64Test.java
new file mode 100644
index 0000000..30aa177
--- /dev/null
+++ b/luni/src/test/java/libcore/java/util/Base64Test.java
@@ -0,0 +1,1138 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+package libcore.java.util;
+
+import junit.framework.TestCase;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.nio.ByteBuffer;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Base64;
+import java.util.Base64.Decoder;
+import java.util.Base64.Encoder;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Random;
+import java.util.Set;
+
+import static java.nio.charset.StandardCharsets.US_ASCII;
+import static java.util.Arrays.copyOfRange;
+
+public class Base64Test extends TestCase {
+
+    /**
+     * The base 64 alphabet from RFC 4648 Table 1.
+     */
+    private static final Set<Character> TABLE_1 =
+            Collections.unmodifiableSet(new LinkedHashSet<>(Arrays.asList(
+                    'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M',
+                    'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z',
+                    'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm',
+                    'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z',
+                    '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '+', '/'
+            )));
+
+    /**
+     * The "URL and Filename safe" Base 64 Alphabet from RFC 4648 Table 2.
+     */
+    private static final Set<Character> TABLE_2 =
+            Collections.unmodifiableSet(new LinkedHashSet<>(Arrays.asList(
+                    'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M',
+                    'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z',
+                    'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm',
+                    'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z',
+                    '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '-', '_'
+            )));
+
+    public void testAlphabet_plain() {
+        checkAlphabet(TABLE_1, "", Base64.getEncoder());
+    }
+
+    public void testAlphabet_mime() {
+        checkAlphabet(TABLE_1, "\r\n", Base64.getMimeEncoder());
+    }
+
+    public void testAlphabet_url() {
+        checkAlphabet(TABLE_2, "", Base64.getUrlEncoder());
+    }
+
+    private static void checkAlphabet(Set<Character> expectedAlphabet, String lineSeparator,
+            Encoder encoder) {
+        assertEquals("Base64 alphabet size must be 64 characters", 64, expectedAlphabet.size());
+        byte[] bytes = new byte[256];
+        for (int i = 0; i < 256; i++) {
+            bytes[i] = (byte) i;
+        }
+        Set<Character> actualAlphabet = new HashSet<>();
+
+        byte[] encodedBytes = encoder.encode(bytes);
+        // ignore the padding
+        int endIndex = encodedBytes.length;
+        while (endIndex > 0 && encodedBytes[endIndex - 1] == '=') {
+            endIndex--;
+        }
+        for (byte b : Arrays.copyOfRange(encodedBytes, 0, endIndex)) {
+            char c = (char) b;
+            actualAlphabet.add(c);
+        }
+        for (char c : lineSeparator.toCharArray()) {
+            assertTrue(actualAlphabet.remove(c));
+        }
+        assertEquals(expectedAlphabet, actualAlphabet);
+    }
+
+    /**
+     * Checks decoding of bytes containing a value outside of the allowed
+     * {@link #TABLE_1 "basic" alphabet}.
+     */
+    public void testDecoder_extraChars_basic() throws Exception {
+        Decoder basicDecoder = Base64.getDecoder(); // uses Table 1
+        // Check failure cases common to both RFC4648 Table 1 and Table 2 decoding.
+        checkDecoder_extraChars_common(basicDecoder);
+
+        // Tests characters that are part of RFC4848 Table 2 but not Table 1.
+        assertDecodeThrowsIAe(basicDecoder, "_aGVsbG8sIHdvcmx");
+        assertDecodeThrowsIAe(basicDecoder, "aGV_sbG8sIHdvcmx");
+        assertDecodeThrowsIAe(basicDecoder, "aGVsbG8sIHdvcmx_");
+    }
+
+    /**
+     * Checks decoding of bytes containing a value outside of the allowed
+     * {@link #TABLE_2 url alphabet}.
+     */
+    public void testDecoder_extraChars_url() throws Exception {
+        Decoder urlDecoder = Base64.getUrlDecoder(); // uses Table 2
+        // Check failure cases common to both RFC4648 table 1 and table 2 decoding.
+        checkDecoder_extraChars_common(urlDecoder);
+
+        // Tests characters that are part of RFC4848 Table 1 but not Table 2.
+        assertDecodeThrowsIAe(urlDecoder, "/aGVsbG8sIHdvcmx");
+        assertDecodeThrowsIAe(urlDecoder, "aGV/sbG8sIHdvcmx");
+        assertDecodeThrowsIAe(urlDecoder, "aGVsbG8sIHdvcmx/");
+    }
+
+    /**
+     * Checks characters that are bad both in RFC4648 {@link #TABLE_1} and
+     * in {@link #TABLE_2} based decoding.
+     */
+    private static void checkDecoder_extraChars_common(Decoder decoder) throws Exception {
+        // Characters outside alphabet before padding.
+        assertDecodeThrowsIAe(decoder, " aGVsbG8sIHdvcmx");
+        assertDecodeThrowsIAe(decoder, "aGV sbG8sIHdvcmx");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmx ");
+        assertDecodeThrowsIAe(decoder, "*aGVsbG8sIHdvcmx");
+        assertDecodeThrowsIAe(decoder, "aGV*sbG8sIHdvcmx");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmx*");
+        assertDecodeThrowsIAe(decoder, "\r\naGVsbG8sIHdvcmx");
+        assertDecodeThrowsIAe(decoder, "aGV\r\nsbG8sIHdvcmx");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmx\r\n");
+        assertDecodeThrowsIAe(decoder, "\naGVsbG8sIHdvcmx");
+        assertDecodeThrowsIAe(decoder, "aGV\nsbG8sIHdvcmx");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmx\n");
+
+        // padding 0
+        assertEquals("hello, world", decodeToAscii(decoder, "aGVsbG8sIHdvcmxk"));
+        // Extra padding
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxk=");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxk==");
+        // Characters outside alphabet intermixed with (too much) padding.
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxk =");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxk = = ");
+
+        // padding 1
+        assertEquals("hello, world?!", decodeToAscii(decoder, "aGVsbG8sIHdvcmxkPyE="));
+        // Missing padding
+        assertEquals("hello, world?!", decodeToAscii(decoder, "aGVsbG8sIHdvcmxkPyE"));
+        // Characters outside alphabet before padding.
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkPyE =");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkPyE*=");
+        // Trailing characters, otherwise valid.
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkPyE= ");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkPyE=*");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkPyE=X");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkPyE=XY");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkPyE=XYZ");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkPyE=XYZA");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkPyE=\n");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkPyE=\r\n");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkPyE= ");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkPyE==");
+        // Characters outside alphabet intermixed with (too much) padding.
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkPyE ==");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkPyE = = ");
+
+        // padding 2
+        assertEquals("hello, world.", decodeToAscii(decoder, "aGVsbG8sIHdvcmxkLg=="));
+        // Missing padding
+        assertEquals("hello, world.", decodeToAscii(decoder, "aGVsbG8sIHdvcmxkLg"));
+        // Partially missing padding
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkLg=");
+        // Characters outside alphabet before padding.
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkLg ==");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkLg*==");
+        // Trailing characters, otherwise valid.
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkLg== ");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkLg==*");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkLg==X");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkLg==XY");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkLg==XYZ");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkLg==XYZA");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkLg==\n");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkLg==\r\n");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkLg== ");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkLg===");
+        // Characters outside alphabet inside padding.
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkLg= =");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkLg=*=");
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkLg=\r\n=");
+        // Characters inside alphabet inside padding.
+        assertDecodeThrowsIAe(decoder, "aGVsbG8sIHdvcmxkLg=X=");
+    }
+
+    public void testDecoder_extraChars_mime() throws Exception {
+        Decoder mimeDecoder = Base64.getMimeDecoder();
+
+        // Characters outside alphabet before padding.
+        assertEquals("hello, world", decodeToAscii(mimeDecoder, " aGVsbG8sIHdvcmxk"));
+        assertEquals("hello, world", decodeToAscii(mimeDecoder, "aGV sbG8sIHdvcmxk"));
+        assertEquals("hello, world", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxk "));
+        assertEquals("hello, world", decodeToAscii(mimeDecoder, "_aGVsbG8sIHdvcmxk"));
+        assertEquals("hello, world", decodeToAscii(mimeDecoder, "aGV_sbG8sIHdvcmxk"));
+        assertEquals("hello, world", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxk_"));
+        assertEquals("hello, world", decodeToAscii(mimeDecoder, "*aGVsbG8sIHdvcmxk"));
+        assertEquals("hello, world", decodeToAscii(mimeDecoder, "aGV*sbG8sIHdvcmxk"));
+        assertEquals("hello, world", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxk*"));
+        assertEquals("hello, world", decodeToAscii(mimeDecoder, "\r\naGVsbG8sIHdvcmxk"));
+        assertEquals("hello, world", decodeToAscii(mimeDecoder, "aGV\r\nsbG8sIHdvcmxk"));
+        assertEquals("hello, world", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxk\r\n"));
+        assertEquals("hello, world", decodeToAscii(mimeDecoder, "\naGVsbG8sIHdvcmxk"));
+        assertEquals("hello, world", decodeToAscii(mimeDecoder, "aGV\nsbG8sIHdvcmxk"));
+        assertEquals("hello, world", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxk\n"));
+
+        // padding 0
+        assertEquals("hello, world", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxk"));
+        // Extra padding
+        assertDecodeThrowsIAe(mimeDecoder, "aGVsbG8sIHdvcmxk=");
+        assertDecodeThrowsIAe(mimeDecoder, "aGVsbG8sIHdvcmxk==");
+        // Characters outside alphabet intermixed with (too much) padding.
+        assertDecodeThrowsIAe(mimeDecoder, "aGVsbG8sIHdvcmxk =");
+        assertDecodeThrowsIAe(mimeDecoder, "aGVsbG8sIHdvcmxk = = ");
+
+        // padding 1
+        assertEquals("hello, world?!", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxkPyE="));
+        // Missing padding
+        assertEquals("hello, world?!", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxkPyE"));
+        // Characters outside alphabet before padding.
+        assertEquals("hello, world?!", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxkPyE ="));
+        assertEquals("hello, world?!", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxkPyE*="));
+        // Trailing characters, otherwise valid.
+        assertEquals("hello, world?!", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxkPyE= "));
+        assertEquals("hello, world?!", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxkPyE=*"));
+        assertDecodeThrowsIAe(mimeDecoder, "aGVsbG8sIHdvcmxkPyE=X");
+        assertDecodeThrowsIAe(mimeDecoder, "aGVsbG8sIHdvcmxkPyE=XY");
+        assertDecodeThrowsIAe(mimeDecoder, "aGVsbG8sIHdvcmxkPyE=XYZ");
+        assertDecodeThrowsIAe(mimeDecoder, "aGVsbG8sIHdvcmxkPyE=XYZA");
+        assertEquals("hello, world?!", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxkPyE=\n"));
+        assertEquals("hello, world?!", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxkPyE=\r\n"));
+        assertEquals("hello, world?!", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxkPyE= "));
+        assertEquals("hello, world?!", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxkPyE=="));
+        // Characters outside alphabet intermixed with (too much) padding.
+        assertEquals("hello, world?!", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxkPyE =="));
+        assertEquals("hello, world?!", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxkPyE = = "));
+
+        // padding 2
+        assertEquals("hello, world.", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxkLg=="));
+        // Missing padding
+        assertEquals("hello, world.", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxkLg"));
+        // Partially missing padding
+        assertDecodeThrowsIAe(mimeDecoder, "aGVsbG8sIHdvcmxkLg=");
+        // Characters outside alphabet before padding.
+        assertEquals("hello, world.", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxkLg =="));
+        assertEquals("hello, world.", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxkLg*=="));
+        // Trailing characters, otherwise valid.
+        assertEquals("hello, world.", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxkLg== "));
+        assertEquals("hello, world.", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxkLg==*"));
+        assertDecodeThrowsIAe(mimeDecoder, "aGVsbG8sIHdvcmxkLg==X");
+        assertDecodeThrowsIAe(mimeDecoder, "aGVsbG8sIHdvcmxkLg==XY");
+        assertDecodeThrowsIAe(mimeDecoder, "aGVsbG8sIHdvcmxkLg==XYZ");
+        assertDecodeThrowsIAe(mimeDecoder, "aGVsbG8sIHdvcmxkLg==XYZA");
+        assertEquals("hello, world.", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxkLg==\n"));
+        assertEquals("hello, world.", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxkLg==\r\n"));
+        assertEquals("hello, world.", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxkLg== "));
+        assertEquals("hello, world.", decodeToAscii(mimeDecoder, "aGVsbG8sIHdvcmxkLg==="));
+
+        // Characters outside alphabet inside padding are not allowed by the MIME decoder.
+        assertDecodeThrowsIAe(mimeDecoder, "aGVsbG8sIHdvcmxkLg= =");
+        assertDecodeThrowsIAe(mimeDecoder, "aGVsbG8sIHdvcmxkLg=*=");
+        assertDecodeThrowsIAe(mimeDecoder, "aGVsbG8sIHdvcmxkLg=\r\n=");
+
+        // Characters inside alphabet inside padding.
+        assertDecodeThrowsIAe(mimeDecoder, "aGVsbG8sIHdvcmxkLg=X=");
+    }
+
+    public void testDecoder_nonPrintableBytes_basic() throws Exception {
+        checkDecoder_nonPrintableBytes_table1(Base64.getDecoder());
+    }
+
+    public void testDecoder_nonPrintableBytes_mime() throws Exception {
+        checkDecoder_nonPrintableBytes_table1(Base64.getMimeDecoder());
+    }
+
+    /**
+     * Check decoding sample non-ASCII byte[] values from a {@link #TABLE_1}
+     * encoded String.
+     */
+    private static void checkDecoder_nonPrintableBytes_table1(Decoder decoder) throws Exception {
+        assertArrayPrefixEquals(SAMPLE_NON_ASCII_BYTES, 0, decoder.decode(""));
+        assertArrayPrefixEquals(SAMPLE_NON_ASCII_BYTES, 1, decoder.decode("/w=="));
+        assertArrayPrefixEquals(SAMPLE_NON_ASCII_BYTES, 2, decoder.decode("/+4="));
+        assertArrayPrefixEquals(SAMPLE_NON_ASCII_BYTES, 3, decoder.decode("/+7d"));
+        assertArrayPrefixEquals(SAMPLE_NON_ASCII_BYTES, 4, decoder.decode("/+7dzA=="));
+        assertArrayPrefixEquals(SAMPLE_NON_ASCII_BYTES, 5, decoder.decode("/+7dzLs="));
+        assertArrayPrefixEquals(SAMPLE_NON_ASCII_BYTES, 6, decoder.decode("/+7dzLuq"));
+        assertArrayPrefixEquals(SAMPLE_NON_ASCII_BYTES, 7, decoder.decode("/+7dzLuqmQ=="));
+        assertArrayPrefixEquals(SAMPLE_NON_ASCII_BYTES, 8, decoder.decode("/+7dzLuqmYg="));
+    }
+
+    /**
+     * Check decoding sample non-ASCII byte[] values from a {@link #TABLE_2}
+     * (url safe) encoded String.
+     */
+    public void testDecoder_nonPrintableBytes_url() throws Exception {
+        Decoder decoder = Base64.getUrlDecoder();
+        assertArrayPrefixEquals(SAMPLE_NON_ASCII_BYTES, 0, decoder.decode(""));
+        assertArrayPrefixEquals(SAMPLE_NON_ASCII_BYTES, 1, decoder.decode("_w=="));
+        assertArrayPrefixEquals(SAMPLE_NON_ASCII_BYTES, 2, decoder.decode("_-4="));
+        assertArrayPrefixEquals(SAMPLE_NON_ASCII_BYTES, 3, decoder.decode("_-7d"));
+        assertArrayPrefixEquals(SAMPLE_NON_ASCII_BYTES, 4, decoder.decode("_-7dzA=="));
+        assertArrayPrefixEquals(SAMPLE_NON_ASCII_BYTES, 5, decoder.decode("_-7dzLs="));
+        assertArrayPrefixEquals(SAMPLE_NON_ASCII_BYTES, 6, decoder.decode("_-7dzLuq"));
+        assertArrayPrefixEquals(SAMPLE_NON_ASCII_BYTES, 7, decoder.decode("_-7dzLuqmQ=="));
+        assertArrayPrefixEquals(SAMPLE_NON_ASCII_BYTES, 8, decoder.decode("_-7dzLuqmYg="));
+    }
+
+    private static final byte[] SAMPLE_NON_ASCII_BYTES = { (byte) 0xff, (byte) 0xee, (byte) 0xdd,
+            (byte) 0xcc, (byte) 0xbb, (byte) 0xaa,
+            (byte) 0x99, (byte) 0x88, (byte) 0x77 };
+
+    public void testDecoder_closedStream() {
+        try {
+            closedDecodeStream().available();
+            fail("Should have thrown");
+        } catch (IOException expected) {
+        }
+        try {
+            closedDecodeStream().read();
+            fail("Should have thrown");
+        } catch (IOException expected) {
+        }
+        try {
+            closedDecodeStream().read(new byte[23]);
+            fail("Should have thrown");
+        } catch (IOException expected) {
+        }
+
+        try {
+            closedDecodeStream().read(new byte[23], 0, 1);
+            fail("Should have thrown");
+        } catch (IOException expected) {
+        }
+    }
+
+    private static InputStream closedDecodeStream() {
+        InputStream result = Base64.getDecoder().wrap(new ByteArrayInputStream(new byte[0]));
+        try {
+            result.close();
+        } catch (IOException e) {
+            fail(e.getMessage());
+        }
+        return result;
+    }
+
+    /**
+     * Tests {@link Decoder#decode(byte[], byte[])} for correctness as well as
+     * for consistency with other methods tested elsewhere.
+     */
+    public void testDecoder_decodeArrayToArray() {
+        Decoder decoder = Base64.getDecoder();
+
+        // Empty input
+        assertEquals(0, decoder.decode(new byte[0], new byte[0]));
+
+        // Test data for non-empty input
+        String inputString = "YWJjZWZnaGk=";
+        byte[] input = inputString.getBytes(US_ASCII);
+        String expectedString = "abcefghi";
+        byte[] decodedBytes = expectedString.getBytes(US_ASCII);
+        // check test data consistency with other methods that are tested elsewhere
+        assertRoundTrip(Base64.getEncoder(), decoder, inputString, decodedBytes);
+
+        // Non-empty input: output array too short
+        byte[] tooShort = new byte[decodedBytes.length - 1];
+        try {
+            decoder.decode(input, tooShort);
+            fail();
+        } catch (IllegalArgumentException expected) {
+        }
+
+        // Non-empty input: output array longer than required
+        byte[] tooLong = new byte[decodedBytes.length + 1];
+        int tooLongBytesDecoded = decoder.decode(input, tooLong);
+        assertEquals(decodedBytes.length, tooLongBytesDecoded);
+        assertEquals(0, tooLong[tooLong.length - 1]);
+        assertArrayPrefixEquals(tooLong, decodedBytes.length, decodedBytes);
+
+        // Non-empty input: output array has exact minimum required size
+        byte[] justRight = new byte[decodedBytes.length];
+        int justRightBytesDecoded = decoder.decode(input, justRight);
+        assertEquals(decodedBytes.length, justRightBytesDecoded);
+        assertArrayEquals(decodedBytes, justRight);
+
+    }
+
+    public void testDecoder_decodeByteBuffer() {
+        Decoder decoder = Base64.getDecoder();
+
+        byte[] emptyByteArray = new byte[0];
+        ByteBuffer emptyByteBuffer = ByteBuffer.wrap(emptyByteArray);
+        ByteBuffer emptyDecodedBuffer = decoder.decode(emptyByteBuffer);
+        assertEquals(emptyByteBuffer, emptyDecodedBuffer);
+        assertNotSame(emptyByteArray, emptyDecodedBuffer);
+
+        // Test the two types of byte buffer.
+        String inputString = "YWJjZWZnaGk=";
+        byte[] input = inputString.getBytes(US_ASCII);
+        String expectedString = "abcefghi";
+        byte[] expectedBytes = expectedString.getBytes(US_ASCII);
+
+        ByteBuffer inputBuffer = ByteBuffer.allocate(input.length);
+        inputBuffer.put(input);
+        inputBuffer.position(0);
+        checkDecoder_decodeByteBuffer(decoder, inputBuffer, expectedBytes);
+
+        inputBuffer = ByteBuffer.allocateDirect(input.length);
+        inputBuffer.put(input);
+        inputBuffer.position(0);
+        checkDecoder_decodeByteBuffer(decoder, inputBuffer, expectedBytes);
+    }
+
+    private static void checkDecoder_decodeByteBuffer(
+            Decoder decoder, ByteBuffer inputBuffer, byte[] expectedBytes) {
+        assertEquals(0, inputBuffer.position());
+        assertEquals(inputBuffer.remaining(), inputBuffer.limit());
+        int inputLength = inputBuffer.remaining();
+
+        ByteBuffer decodedBuffer = decoder.decode(inputBuffer);
+
+        assertEquals(inputLength, inputBuffer.position());
+        assertEquals(0, inputBuffer.remaining());
+        assertEquals(inputLength, inputBuffer.limit());
+        assertEquals(0, decodedBuffer.position());
+        assertEquals(expectedBytes.length, decodedBuffer.remaining());
+        assertEquals(expectedBytes.length, decodedBuffer.limit());
+    }
+
+    public void testDecoder_decodeByteBuffer_invalidData() {
+        Decoder decoder = Base64.getDecoder();
+
+        // Test the two types of byte buffer.
+        String inputString = "AAAA AAAA";
+        byte[] input = inputString.getBytes(US_ASCII);
+
+        ByteBuffer inputBuffer = ByteBuffer.allocate(input.length);
+        inputBuffer.put(input);
+        inputBuffer.position(0);
+        checkDecoder_decodeByteBuffer_invalidData(decoder, inputBuffer);
+
+        inputBuffer = ByteBuffer.allocateDirect(input.length);
+        inputBuffer.put(input);
+        inputBuffer.position(0);
+        checkDecoder_decodeByteBuffer_invalidData(decoder, inputBuffer);
+    }
+
+    private static void checkDecoder_decodeByteBuffer_invalidData(
+            Decoder decoder, ByteBuffer inputBuffer) {
+        assertEquals(0, inputBuffer.position());
+        assertEquals(inputBuffer.remaining(), inputBuffer.limit());
+        int limit = inputBuffer.limit();
+
+        try {
+            decoder.decode(inputBuffer);
+            fail();
+        } catch (IllegalArgumentException expected) {
+        }
+
+        assertEquals(0, inputBuffer.position());
+        assertEquals(limit, inputBuffer.remaining());
+        assertEquals(limit, inputBuffer.limit());
+    }
+
+    public void testDecoder_nullArgs() {
+        checkDecoder_nullArgs(Base64.getDecoder());
+        checkDecoder_nullArgs(Base64.getMimeDecoder());
+        checkDecoder_nullArgs(Base64.getUrlDecoder());
+    }
+
+    private static void checkDecoder_nullArgs(Decoder decoder) {
+        assertThrowsNpe(() -> decoder.decode((byte[]) null));
+        assertThrowsNpe(() -> decoder.decode((String) null));
+        assertThrowsNpe(() -> decoder.decode(null, null));
+        assertThrowsNpe(() -> decoder.decode((ByteBuffer) null));
+        assertThrowsNpe(() -> decoder.wrap(null));
+    }
+
+    public void testEncoder_nullArgs() {
+        checkEncoder_nullArgs(Base64.getEncoder());
+        checkEncoder_nullArgs(Base64.getMimeEncoder());
+        checkEncoder_nullArgs(Base64.getUrlEncoder());
+        checkEncoder_nullArgs(Base64.getMimeEncoder(20, new byte[] { '*' }));
+        checkEncoder_nullArgs(Base64.getEncoder().withoutPadding());
+        checkEncoder_nullArgs(Base64.getMimeEncoder().withoutPadding());
+        checkEncoder_nullArgs(Base64.getUrlEncoder().withoutPadding());
+        checkEncoder_nullArgs(Base64.getMimeEncoder(20, new byte[] { '*' }).withoutPadding());
+
+    }
+
+    private static void checkEncoder_nullArgs(Encoder encoder) {
+        assertThrowsNpe(() -> encoder.encode((byte[]) null));
+        assertThrowsNpe(() -> encoder.encodeToString(null));
+        assertThrowsNpe(() -> encoder.encode(null, null));
+        assertThrowsNpe(() -> encoder.encode((ByteBuffer) null));
+        assertThrowsNpe(() -> encoder.wrap(null));
+    }
+
+    public void testEncoder_nonPrintableBytes() throws Exception {
+        Encoder encoder = Base64.getUrlEncoder();
+        assertEquals("", encoder.encodeToString(copyOfRange(SAMPLE_NON_ASCII_BYTES, 0, 0)));
+        assertEquals("_w==", encoder.encodeToString(copyOfRange(SAMPLE_NON_ASCII_BYTES, 0, 1)));
+        assertEquals("_-4=", encoder.encodeToString(copyOfRange(SAMPLE_NON_ASCII_BYTES, 0, 2)));
+        assertEquals("_-7d", encoder.encodeToString(copyOfRange(SAMPLE_NON_ASCII_BYTES, 0, 3)));
+        assertEquals("_-7dzA==", encoder.encodeToString(copyOfRange(SAMPLE_NON_ASCII_BYTES, 0, 4)));
+        assertEquals("_-7dzLs=", encoder.encodeToString(copyOfRange(SAMPLE_NON_ASCII_BYTES, 0, 5)));
+        assertEquals("_-7dzLuq", encoder.encodeToString(copyOfRange(SAMPLE_NON_ASCII_BYTES, 0, 6)));
+        assertEquals("_-7dzLuqmQ==", encoder.encodeToString(copyOfRange(SAMPLE_NON_ASCII_BYTES, 0, 7)));
+        assertEquals("_-7dzLuqmYg=", encoder.encodeToString(copyOfRange(SAMPLE_NON_ASCII_BYTES, 0, 8)));
+    }
+
+    public void testEncoder_lineLength() throws Exception {
+        String in_56 = "abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcd";
+        String in_57 = in_56 + "e";
+        String in_58 = in_56 + "ef";
+        String in_59 = in_56 + "efg";
+        String in_60 = in_56 + "efgh";
+        String in_61 = in_56 + "efghi";
+
+        String prefix = "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXphYmNkZWZnaGlqa2xtbm9wcXJzdHV2d3h5emFi";
+        String out_56 = prefix + "Y2Q=";
+        String out_57 = prefix + "Y2Rl";
+        String out_58 = prefix + "Y2Rl\r\nZg==";
+        String out_59 = prefix + "Y2Rl\r\nZmc=";
+        String out_60 = prefix + "Y2Rl\r\nZmdo";
+        String out_61 = prefix + "Y2Rl\r\nZmdoaQ==";
+
+        Encoder encoder = Base64.getMimeEncoder();
+        Decoder decoder = Base64.getMimeDecoder();
+        assertEquals("", encodeFromAscii(encoder, decoder, ""));
+        assertEquals(out_56, encodeFromAscii(encoder, decoder, in_56));
+        assertEquals(out_57, encodeFromAscii(encoder, decoder, in_57));
+        assertEquals(out_58, encodeFromAscii(encoder, decoder, in_58));
+        assertEquals(out_59, encodeFromAscii(encoder, decoder, in_59));
+        assertEquals(out_60, encodeFromAscii(encoder, decoder, in_60));
+        assertEquals(out_61, encodeFromAscii(encoder, decoder, in_61));
+
+        encoder = Base64.getUrlEncoder();
+        decoder = Base64.getUrlDecoder();
+        assertEquals(out_56.replaceAll("\r\n", ""), encodeFromAscii(encoder, decoder, in_56));
+        assertEquals(out_57.replaceAll("\r\n", ""), encodeFromAscii(encoder, decoder, in_57));
+        assertEquals(out_58.replaceAll("\r\n", ""), encodeFromAscii(encoder, decoder, in_58));
+        assertEquals(out_59.replaceAll("\r\n", ""), encodeFromAscii(encoder, decoder, in_59));
+        assertEquals(out_60.replaceAll("\r\n", ""), encodeFromAscii(encoder, decoder, in_60));
+        assertEquals(out_61.replaceAll("\r\n", ""), encodeFromAscii(encoder, decoder, in_61));
+    }
+
+    public void testGetMimeEncoder_invalidLineSeparator() {
+        byte[] invalidLineSeparator = { 'A' };
+        try {
+            Base64.getMimeEncoder(20, invalidLineSeparator);
+            fail();
+        } catch (IllegalArgumentException expected) {
+        }
+
+        try {
+            Base64.getMimeEncoder(0, invalidLineSeparator);
+            fail();
+        } catch (IllegalArgumentException expected) {
+        }
+
+        try {
+            Base64.getMimeEncoder(20, null);
+            fail();
+        } catch (NullPointerException expected) {
+        }
+
+        try {
+            Base64.getMimeEncoder(0, null);
+            fail();
+        } catch (NullPointerException expected) {
+        }
+    }
+
+    public void testEncoder_closedStream() {
+        try {
+            closedEncodeStream().write(100);
+            fail("Should have thrown");
+        } catch (IOException expected) {
+        }
+        try {
+            closedEncodeStream().write(new byte[100]);
+            fail("Should have thrown");
+        } catch (IOException expected) {
+        }
+
+        try {
+            closedEncodeStream().write(new byte[100], 0, 1);
+            fail("Should have thrown");
+        } catch (IOException expected) {
+        }
+    }
+
+    private static OutputStream closedEncodeStream() {
+        OutputStream result = Base64.getEncoder().wrap(new ByteArrayOutputStream());
+        try {
+            result.close();
+        } catch (IOException e) {
+            fail(e.getMessage());
+        }
+        return result;
+    }
+
+
+    /**
+     * Tests {@link Decoder#decode(byte[], byte[])} for correctness.
+     */
+    public void testEncoder_encodeArrayToArray() {
+        Encoder encoder = Base64.getEncoder();
+
+        // Empty input
+        assertEquals(0, encoder.encode(new byte[0], new byte[0]));
+
+        // Test data for non-empty input
+        byte[] input = "abcefghi".getBytes(US_ASCII);
+        String expectedString = "YWJjZWZnaGk=";
+        byte[] encodedBytes = expectedString.getBytes(US_ASCII);
+
+        // Non-empty input: output array too short
+        byte[] tooShort = new byte[encodedBytes.length - 1];
+        try {
+            encoder.encode(input, tooShort);
+            fail();
+        } catch (IllegalArgumentException expected) {
+        }
+
+        // Non-empty input: output array longer than required
+        byte[] tooLong = new byte[encodedBytes.length + 1];
+        int tooLongBytesEncoded = encoder.encode(input, tooLong);
+        assertEquals(encodedBytes.length, tooLongBytesEncoded);
+        assertEquals(0, tooLong[tooLong.length - 1]);
+        assertArrayPrefixEquals(tooLong, encodedBytes.length, encodedBytes);
+
+        // Non-empty input: output array has exact minimum required size
+        byte[] justRight = new byte[encodedBytes.length];
+        int justRightBytesEncoded = encoder.encode(input, justRight);
+        assertEquals(encodedBytes.length, justRightBytesEncoded);
+        assertArrayEquals(encodedBytes, justRight);
+    }
+
+    public void testEncoder_encodeByteBuffer() {
+        Encoder encoder = Base64.getEncoder();
+
+        byte[] emptyByteArray = new byte[0];
+        ByteBuffer emptyByteBuffer = ByteBuffer.wrap(emptyByteArray);
+        ByteBuffer emptyEncodedBuffer = encoder.encode(emptyByteBuffer);
+        assertEquals(emptyByteBuffer, emptyEncodedBuffer);
+        assertNotSame(emptyByteArray, emptyEncodedBuffer);
+
+        // Test the two types of byte buffer.
+        byte[] input = "abcefghi".getBytes(US_ASCII);
+        String expectedString = "YWJjZWZnaGk=";
+        byte[] expectedBytes = expectedString.getBytes(US_ASCII);
+
+        ByteBuffer inputBuffer = ByteBuffer.allocate(input.length);
+        inputBuffer.put(input);
+        inputBuffer.position(0);
+        testEncoder_encodeByteBuffer(encoder, inputBuffer, expectedBytes);
+
+        inputBuffer = ByteBuffer.allocateDirect(input.length);
+        inputBuffer.put(input);
+        inputBuffer.position(0);
+        testEncoder_encodeByteBuffer(encoder, inputBuffer, expectedBytes);
+    }
+
+    private static void testEncoder_encodeByteBuffer(
+            Encoder encoder, ByteBuffer inputBuffer, byte[] expectedBytes) {
+        assertEquals(0, inputBuffer.position());
+        assertEquals(inputBuffer.remaining(), inputBuffer.limit());
+        int inputLength = inputBuffer.remaining();
+
+        ByteBuffer encodedBuffer = encoder.encode(inputBuffer);
+
+        assertEquals(inputLength, inputBuffer.position());
+        assertEquals(0, inputBuffer.remaining());
+        assertEquals(inputLength, inputBuffer.limit());
+        assertEquals(0, encodedBuffer.position());
+        assertEquals(expectedBytes.length, encodedBuffer.remaining());
+        assertEquals(expectedBytes.length, encodedBuffer.limit());
+    }
+
+    /**
+     * Checks that all encoders/decoders map {@code new byte[0]} to "" and vice versa.
+     */
+    public void testRoundTrip_empty() {
+        checkRoundTrip_empty(Base64.getEncoder(), Base64.getDecoder());
+        checkRoundTrip_empty(Base64.getMimeEncoder(), Base64.getMimeDecoder());
+        byte[] sep = new byte[] { '\r', '\n' };
+        checkRoundTrip_empty(Base64.getMimeEncoder(-1, sep), Base64.getMimeDecoder());
+        checkRoundTrip_empty(Base64.getMimeEncoder(20, new byte[0]), Base64.getMimeDecoder());
+        checkRoundTrip_empty(Base64.getMimeEncoder(23, sep), Base64.getMimeDecoder());
+        checkRoundTrip_empty(Base64.getMimeEncoder(76, sep), Base64.getMimeDecoder());
+        checkRoundTrip_empty(Base64.getUrlEncoder(), Base64.getUrlDecoder());
+    }
+
+    private static void checkRoundTrip_empty(Encoder encoder, Decoder decoder) {
+        assertRoundTrip(encoder, decoder, "", new byte[0]);
+    }
+
+    /**
+     * Encoding of byte values 0..255 using the non-URL alphabet.
+     */
+    private static final String ALL_BYTE_VALUES_ENCODED =
+            "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8gISIjJCUmJygpKissLS4vMDEyMzQ1Njc4" +
+                    "OTo7PD0+P0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcXV5fYGFiY2RlZmdoaWprbG1ub3Bx" +
+                    "cnN0dXZ3eHl6e3x9fn+AgYKDhIWGh4iJiouMjY6PkJGSk5SVlpeYmZqbnJ2en6ChoqOkpaanqKmq" +
+                    "q6ytrq+wsbKztLW2t7i5uru8vb6/wMHCw8TFxsfIycrLzM3Oz9DR0tPU1dbX2Nna29zd3t/g4eLj" +
+                    "5OXm5+jp6uvs7e7v8PHy8/T19vf4+fr7/P3+/w==";
+
+    public void testRoundTrip_allBytes_plain() {
+        checkRoundTrip_allBytes_singleLine(Base64.getEncoder(), Base64.getDecoder());
+    }
+
+    /**
+     * Checks that if the lineSeparator is empty or the line length is {@code <= 3}
+     * or larger than the data to be encoded, a single line is returned.
+     */
+    public void testRoundTrip_allBytes_mime_singleLine() {
+        Decoder decoder = Base64.getMimeDecoder();
+        checkRoundTrip_allBytes_singleLine(Base64.getMimeEncoder(76, new byte[0]), decoder);
+
+        // Line lengths <= 3 mean no wrapping; the separator is ignored in that case.
+        byte[] separator = new byte[] { '*' };
+        checkRoundTrip_allBytes_singleLine(Base64.getMimeEncoder(Integer.MIN_VALUE, separator),
+                decoder);
+        checkRoundTrip_allBytes_singleLine(Base64.getMimeEncoder(-1, separator), decoder);
+        checkRoundTrip_allBytes_singleLine(Base64.getMimeEncoder(0, separator), decoder);
+        checkRoundTrip_allBytes_singleLine(Base64.getMimeEncoder(1, separator), decoder);
+        checkRoundTrip_allBytes_singleLine(Base64.getMimeEncoder(2, separator), decoder);
+        checkRoundTrip_allBytes_singleLine(Base64.getMimeEncoder(3, separator), decoder);
+
+        // output fits into the permitted line length
+        checkRoundTrip_allBytes_singleLine(Base64.getMimeEncoder(
+                ALL_BYTE_VALUES_ENCODED.length(), separator), decoder);
+        checkRoundTrip_allBytes_singleLine(Base64.getMimeEncoder(Integer.MAX_VALUE, separator),
+                decoder);
+    }
+
+    /**
+     * Checks round-trip encoding/decoding for a few simple examples that
+     * should work the same across three Encoder/Decoder pairs: This is
+     * because they only use characters that are in both RFC 4648 Table 1
+     * and Table 2, and are short enough to fit into a single line.
+     */
+    public void testRoundTrip_simple_basic() throws Exception {
+        // uses Table 1, never adds linebreaks
+        checkRoundTrip_simple(Base64.getEncoder(), Base64.getDecoder());
+        // uses Table 1, allows 76 chars in a line
+        checkRoundTrip_simple(Base64.getMimeEncoder(), Base64.getMimeDecoder());
+        // uses Table 2, never adds linebreaks
+        checkRoundTrip_simple(Base64.getUrlEncoder(), Base64.getUrlDecoder());
+    }
+
+    private static void checkRoundTrip_simple(Encoder encoder, Decoder decoder) throws Exception {
+        assertRoundTrip(encoder, decoder, "YQ==", "a".getBytes(US_ASCII));
+        assertRoundTrip(encoder, decoder, "YWI=", "ab".getBytes(US_ASCII));
+        assertRoundTrip(encoder, decoder, "YWJj", "abc".getBytes(US_ASCII));
+        assertRoundTrip(encoder, decoder, "YWJjZA==", "abcd".getBytes(US_ASCII));
+    }
+
+    /** check a range of possible line lengths */
+    public void testRoundTrip_allBytes_mime_lineLength() {
+        Decoder decoder = Base64.getMimeDecoder();
+        byte[] separator = new byte[] { '*' };
+        checkRoundTrip_allBytes(Base64.getMimeEncoder(4, separator), decoder,
+                wrapLines("*", ALL_BYTE_VALUES_ENCODED, 4));
+        checkRoundTrip_allBytes(Base64.getMimeEncoder(8, separator), decoder,
+                wrapLines("*", ALL_BYTE_VALUES_ENCODED, 8));
+        checkRoundTrip_allBytes(Base64.getMimeEncoder(20, separator), decoder,
+                wrapLines("*", ALL_BYTE_VALUES_ENCODED, 20));
+        checkRoundTrip_allBytes(Base64.getMimeEncoder(100, separator), decoder,
+                wrapLines("*", ALL_BYTE_VALUES_ENCODED, 100));
+        checkRoundTrip_allBytes(Base64.getMimeEncoder(Integer.MAX_VALUE & ~3, separator), decoder,
+                wrapLines("*", ALL_BYTE_VALUES_ENCODED, Integer.MAX_VALUE & ~3));
+    }
+
+    public void testRoundTrip_allBytes_mime_lineLength_defaultsTo76Chars() {
+        checkRoundTrip_allBytes(Base64.getMimeEncoder(), Base64.getMimeDecoder(),
+                wrapLines("\r\n", ALL_BYTE_VALUES_ENCODED, 76));
+    }
+
+    /**
+     * checks that the specified line length is rounded down to the nearest multiple of 4.
+     */
+    public void testRoundTrip_allBytes_mime_lineLength_isRoundedDown() {
+        Decoder decoder = Base64.getMimeDecoder();
+        byte[] separator = new byte[] { '\r', '\n' };
+        checkRoundTrip_allBytes(Base64.getMimeEncoder(60, separator), decoder,
+                wrapLines("\r\n", ALL_BYTE_VALUES_ENCODED, 60));
+        checkRoundTrip_allBytes(Base64.getMimeEncoder(63, separator), decoder,
+                wrapLines("\r\n", ALL_BYTE_VALUES_ENCODED, 60));
+        checkRoundTrip_allBytes(Base64.getMimeEncoder(10, separator), decoder,
+                wrapLines("\r\n", ALL_BYTE_VALUES_ENCODED, 8));
+    }
+
+    public void testRoundTrip_allBytes_url() {
+        String encodedUrl = ALL_BYTE_VALUES_ENCODED.replace('+', '-').replace('/', '_');
+        checkRoundTrip_allBytes(Base64.getUrlEncoder(), Base64.getUrlDecoder(), encodedUrl);
+    }
+
+    /**
+     * Checks round-trip encoding/decoding of all byte values 0..255 for
+     * the case where the Encoder doesn't add any linebreaks.
+     */
+    private static void checkRoundTrip_allBytes_singleLine(Encoder encoder, Decoder decoder) {
+        checkRoundTrip_allBytes(encoder, decoder, ALL_BYTE_VALUES_ENCODED);
+    }
+
+    /**
+     * Checks that byte values 0..255, in order, are encoded to exactly
+     * the given String (including any linebreaks, if present) and that
+     * that String can be decoded back to the same byte values.
+     *
+     * @param encoded the expected encoded representation of the (unsigned)
+     *        byte values 0..255, in order.
+     */
+    private static void checkRoundTrip_allBytes(Encoder encoder, Decoder decoder, String encoded) {
+        byte[] bytes = new byte[256];
+        for (int i = 0; i < 256; i++) {
+            bytes[i] = (byte) i;
+        }
+        assertRoundTrip(encoder, decoder, encoded, bytes);
+    }
+
+    public void testRoundTrip_variousSizes_plain() {
+        checkRoundTrip_variousSizes(Base64.getEncoder(), Base64.getDecoder());
+    }
+
+    public void testRoundTrip_variousSizes_mime() {
+        checkRoundTrip_variousSizes(Base64.getMimeEncoder(), Base64.getMimeDecoder());
+    }
+
+    public void testRoundTrip_variousSizes_url() {
+        checkRoundTrip_variousSizes(Base64.getUrlEncoder(), Base64.getUrlDecoder());
+    }
+
+    /**
+     * Checks that various-sized inputs survive a round trip.
+     */
+    private static void checkRoundTrip_variousSizes(Encoder encoder, Decoder decoder) {
+        Random random = new Random(7654321);
+        for (int numBytes : new int [] { 0, 1, 2, 75, 76, 77, 80, 100, 1234 }) {
+            byte[] bytes = new byte[numBytes];
+            random.nextBytes(bytes);
+            byte[] result = decoder.decode(encoder.encode(bytes));
+            assertArrayEquals(bytes, result);
+        }
+    }
+
+    public void testRoundtrip_wrap_basic() throws Exception {
+        Encoder encoder = Base64.getEncoder();
+        Decoder decoder = Base64.getDecoder();
+        checkRoundTrip_wrapInputStream(encoder, decoder);
+    }
+
+    public void testRoundtrip_wrap_mime() throws Exception {
+        Encoder encoder = Base64.getMimeEncoder();
+        Decoder decoder = Base64.getMimeDecoder();
+        checkRoundTrip_wrapInputStream(encoder, decoder);
+    }
+
+    public void testRoundTrip_wrap_url() throws Exception {
+        Encoder encoder = Base64.getUrlEncoder();
+        Decoder decoder = Base64.getUrlDecoder();
+        checkRoundTrip_wrapInputStream(encoder, decoder);
+    }
+
+    /**
+     * Checks that the {@link Decoder#wrap(InputStream) wrapping} an
+     * InputStream of encoded data yields the plain data that was
+     * previously {@link Encoder#encode(byte[]) encoded}.
+     */
+    private static void checkRoundTrip_wrapInputStream(Encoder encoder, Decoder decoder)
+            throws IOException {
+        Random random = new Random(32176L);
+        int[] writeLengths = { -10, -5, -1, 0, 1, 1, 2, 2, 3, 10, 100 };
+
+        // Test input needs to be at least 2048 bytes to fill up the
+        // read buffer of Base64InputStream.
+        byte[] plain = new byte[4567];
+        random.nextBytes(plain);
+        byte[] encoded = encoder.encode(plain);
+        byte[] actual = new byte[plain.length * 2];
+        int b;
+
+        // ----- test decoding ("encoded" -> "plain") -----
+
+        // read as much as it will give us in one chunk
+        ByteArrayInputStream bais = new ByteArrayInputStream(encoded);
+        InputStream b64is = decoder.wrap(bais);
+        int ap = 0;
+        while ((b = b64is.read(actual, ap, actual.length - ap)) != -1) {
+            ap += b;
+        }
+        assertArrayPrefixEquals(actual, ap, plain);
+
+        // read individual bytes
+        bais = new ByteArrayInputStream(encoded);
+        b64is = decoder.wrap(bais);
+        ap = 0;
+        while ((b = b64is.read()) != -1) {
+            actual[ap++] = (byte) b;
+        }
+        assertArrayPrefixEquals(actual, ap, plain);
+
+        // mix reads of variously-sized arrays with one-byte reads
+        bais = new ByteArrayInputStream(encoded);
+        b64is = decoder.wrap(bais);
+        ap = 0;
+        while (true) {
+            int l = writeLengths[random.nextInt(writeLengths.length)];
+            if (l >= 0) {
+                b = b64is.read(actual, ap, l);
+                if (b == -1) {
+                    break;
+                }
+                ap += b;
+            } else {
+                for (int i = 0; i < -l; ++i) {
+                    if ((b = b64is.read()) == -1) {
+                        break;
+                    }
+                    actual[ap++] = (byte) b;
+                }
+            }
+        }
+        assertArrayPrefixEquals(actual, ap, plain);
+    }
+
+    public void testDecoder_wrap_singleByteReads() throws IOException {
+        InputStream in = Base64.getDecoder().wrap(new ByteArrayInputStream("/v8=".getBytes()));
+        assertEquals(254, in.read());
+        assertEquals(255, in.read());
+        assertEquals(-1, in.read());
+    }
+
+    public void testEncoder_withoutPadding() {
+        byte[] bytes = new byte[] { (byte) 0xFE, (byte) 0xFF };
+        assertEquals("/v8=", Base64.getEncoder().encodeToString(bytes));
+        assertEquals("/v8", Base64.getEncoder().withoutPadding().encodeToString(bytes));
+
+        assertEquals("/v8=", Base64.getMimeEncoder().encodeToString(bytes));
+        assertEquals("/v8", Base64.getMimeEncoder().withoutPadding().encodeToString(bytes));
+
+        assertEquals("_v8=", Base64.getUrlEncoder().encodeToString(bytes));
+        assertEquals("_v8", Base64.getUrlEncoder().withoutPadding().encodeToString(bytes));
+    }
+
+    public void testEncoder_wrap_plain() throws Exception {
+        checkWrapOutputStreamConsistentWithEncode(Base64.getEncoder());
+    }
+
+    public void testEncoder_wrap_url() throws Exception {
+        checkWrapOutputStreamConsistentWithEncode(Base64.getUrlEncoder());
+    }
+
+    public void testEncoder_wrap_mime() throws Exception {
+        checkWrapOutputStreamConsistentWithEncode(Base64.getMimeEncoder());
+    }
+
+    /** A way of writing bytes to an OutputStream. */
+    interface WriteStrategy {
+        void write(byte[] bytes, OutputStream out) throws IOException;
+    }
+
+    private static void checkWrapOutputStreamConsistentWithEncode(Encoder encoder)
+            throws Exception {
+        final Random random = new Random(32176L);
+
+        // one large write(byte[]) of the whole input
+        WriteStrategy allAtOnce = (bytes, out) -> out.write(bytes);
+        checkWrapOutputStreamConsistentWithEncode(encoder, allAtOnce);
+
+        // many calls to write(int)
+        WriteStrategy byteWise = (bytes, out) -> {
+            for (byte b : bytes) {
+                out.write(b);
+            }
+        };
+        checkWrapOutputStreamConsistentWithEncode(encoder, byteWise);
+
+        // intermixed sequences of write(int) with
+        // write(byte[],int,int) of various lengths.
+        WriteStrategy mixed = (bytes, out) -> {
+            int[] writeLengths = { -10, -5, -1, 0, 1, 1, 2, 2, 3, 10, 100 };
+            int p = 0;
+            while (p < bytes.length) {
+                int l = writeLengths[random.nextInt(writeLengths.length)];
+                l = Math.min(l, bytes.length - p);
+                if (l >= 0) {
+                    out.write(bytes, p, l);
+                    p += l;
+                } else {
+                    l = Math.min(-l, bytes.length - p);
+                    for (int i = 0; i < l; ++i) {
+                        out.write(bytes[p + i]);
+                    }
+                    p += l;
+                }
+            }
+        };
+        checkWrapOutputStreamConsistentWithEncode(encoder, mixed);
+    }
+
+    /**
+     * Checks that writing to a wrap()ping OutputStream produces the same
+     * output on the wrapped stream as {@link Encoder#encode(byte[])}.
+     */
+    private static void checkWrapOutputStreamConsistentWithEncode(Encoder encoder,
+            WriteStrategy writeStrategy) throws IOException {
+        Random random = new Random(32176L);
+        // Test input needs to be at least 1024 bytes to test filling
+        // up the write(int) buffer of Base64OutputStream.
+        byte[] plain = new byte[1234];
+        random.nextBytes(plain);
+        byte[] encodeResult = encoder.encode(plain);
+        ByteArrayOutputStream wrappedOutputStream = new ByteArrayOutputStream();
+        try (OutputStream plainOutputStream = encoder.wrap(wrappedOutputStream)) {
+            writeStrategy.write(plain, plainOutputStream);
+        }
+        assertArrayEquals(encodeResult, wrappedOutputStream.toByteArray());
+    }
+
+    /** Decodes a string, returning the resulting bytes interpreted as an ASCII String. */
+    private static String decodeToAscii(Decoder decoder, String encoded) throws Exception {
+        byte[] plain = decoder.decode(encoded);
+        return new String(plain, US_ASCII);
+    }
+
+    /**
+     * Checks round-trip encoding/decoding of {@code plain}.
+     *
+     * @param plain an ASCII String
+     * @return the Base64-encoded value of the ASCII codepoints from {@code plain}
+     */
+    private static String encodeFromAscii(Encoder encoder, Decoder decoder, String plain)
+            throws Exception {
+        String encoded = encoder.encodeToString(plain.getBytes(US_ASCII));
+        String decoded = decodeToAscii(decoder, encoded);
+        assertEquals(plain, decoded);
+        return encoded;
+    }
+
+    /**
+     * Rewraps {@code s} by inserting {@lineSeparator} every {@code lineLength} characters,
+     * but not at the end.
+     */
+    private static String wrapLines(String lineSeparator, String s, int lineLength) {
+        return String.join(lineSeparator, breakLines(s, lineLength));
+    }
+
+    /**
+     * Splits {@code s} into a list of substrings, each except possibly the last one
+     * exactly {@code lineLength} characters long.
+     */
+    private static List<String> breakLines(String longString, int lineLength) {
+        List<String> lines = new ArrayList<>();
+        for (int pos = 0; pos < longString.length(); pos += lineLength) {
+            lines.add(longString.substring(pos, Math.min(longString.length(), pos + lineLength)));
+        }
+        return lines;
+    }
+
+    /** Assert that decoding the specific String throws IllegalArgumentException. */
+    private static void assertDecodeThrowsIAe(Decoder decoder, String invalidEncoded)
+            throws Exception {
+        try {
+            decoder.decode(invalidEncoded);
+            fail("should have failed to decode");
+        } catch (IllegalArgumentException e) {
+        }
+    }
+
+    /**
+     * Asserts that the given String decodes to the bytes, and that the bytes encode
+     * to the given String.
+     */
+    private static void assertRoundTrip(Encoder encoder, Decoder decoder, String encoded,
+            byte[] bytes) {
+        assertEquals(encoded, encoder.encodeToString(bytes));
+        assertArrayEquals(bytes, decoder.decode(encoded));
+    }
+
+    /** Asserts that actual equals the first len bytes of expected. */
+    private static void assertArrayPrefixEquals(byte[] expected, int len, byte[] actual) {
+        assertArrayEquals(copyOfRange(expected, 0, len), actual);
+    }
+
+    /** Checks array contents. */
+    private static void assertArrayEquals(byte[] expected, byte[] actual) {
+        if (!Arrays.equals(expected, actual)) {
+            fail("Expected " + hexString(expected) + ", got " + hexString(actual));
+        }
+    }
+
+    private static String hexString(byte[] bytes) {
+        StringBuilder sb = new StringBuilder("0x");
+        for (byte b : bytes) {
+            sb.append(Integer.toHexString(b & 0xff));
+        }
+        return sb.toString();
+    }
+
+    private static void assertThrowsNpe(Runnable runnable) {
+        try {
+            runnable.run();
+            fail("Should have thrown NullPointerException");
+        } catch (NullPointerException expected) {
+        }
+    }
+
+}
diff --git a/luni/src/test/java/libcore/java/util/BitSetTest.java b/luni/src/test/java/libcore/java/util/BitSetTest.java
index c4e8ad3..41d4e53 100644
--- a/luni/src/test/java/libcore/java/util/BitSetTest.java
+++ b/luni/src/test/java/libcore/java/util/BitSetTest.java
@@ -34,6 +34,22 @@
         assertEquals("{2, 4, 10}", bs.toString());
     }
 
+    // b/31234459
+    public void test_toString_highestPossibleBitSet() {
+        // 2^28 bytes for the bits in the BitSet, plus extra bytes for everything else
+        int bytesRequired = (1 << 28) + (1 << 27);
+        if (Runtime.getRuntime().maxMemory() < bytesRequired) {
+            return;
+        }
+        try {
+            BitSet bitSet = new BitSet();
+            bitSet.set(Integer.MAX_VALUE);
+            assertEquals("{2147483647}", bitSet.toString());
+        } catch (OutOfMemoryError e) {
+            // ignore
+        }
+    }
+
     private static void assertBitSet(BitSet bs, long[] longs, String s) {
         for (int i = 0; i < 64 * longs.length; ++i) {
             assertEquals(bs.toString(), ((longs[i / 64] & (1L << (i % 64))) != 0), bs.get(i));
diff --git a/luni/src/test/java/libcore/java/util/CollectionsTest.java b/luni/src/test/java/libcore/java/util/CollectionsTest.java
index f3284c0..3c951b5 100644
--- a/luni/src/test/java/libcore/java/util/CollectionsTest.java
+++ b/luni/src/test/java/libcore/java/util/CollectionsTest.java
@@ -28,6 +28,7 @@
 import java.util.NoSuchElementException;
 import java.util.Spliterator;
 
+import junit.framework.AssertionFailedError;
 import junit.framework.TestCase;
 
 public final class CollectionsTest extends TestCase {
@@ -629,12 +630,14 @@
         checkedMap2.putIfAbsent(1, A_STRING);
         try {
             checkedMap2.putIfAbsent(1, NOT_A_STRING);
+            fail();
         } catch (ClassCastException expected) {}
 
         // When key is absent
         checkedMap2.clear();
         try {
             checkedMap2.putIfAbsent(1, NOT_A_STRING);
+            fail();
         } catch (ClassCastException expected) {}
     }
 
@@ -657,6 +660,7 @@
 
         try {
             checkedMap2.replace(1, NOT_A_STRING);
+            fail();
         } catch (ClassCastException expected) {}
     }
 
@@ -672,6 +676,7 @@
 
         try {
             checkedMap2.replace(1, 1, NOT_A_STRING);
+            fail();
         } catch (ClassCastException expected) {}
     }
 
@@ -685,15 +690,16 @@
         Map checkedMap2 = Collections.checkedMap(new HashMap<>(), Integer.class, String.class);
         checkedMap2.put(1, A_STRING);
 
-        // When key is present
-        try {
-            checkedMap2.computeIfAbsent(1, k -> NOT_A_STRING);
-        } catch (ClassCastException expected) {}
+        // When key is present, function should not be invoked
+        assertSame(A_STRING, checkedMap2.computeIfAbsent(1, k -> {
+            throw new AssertionFailedError("key present: function should not be invoked");
+        }));
 
-        // When key is absent
+        // When key is absent, computed value's type should be checked
         checkedMap2.clear();
         try {
             checkedMap2.computeIfAbsent(1, k -> NOT_A_STRING);
+            fail();
         } catch (ClassCastException expected) {}
     }
 
@@ -709,6 +715,7 @@
 
         try {
             checkedMap2.computeIfPresent(1, (k, v) -> NOT_A_STRING);
+            fail();
         } catch (ClassCastException expected) {}
     }
 
@@ -721,6 +728,7 @@
         checkedMap2.put(1, A_STRING);
         try {
             checkedMap2.compute(1, (k, v) -> NOT_A_STRING);
+            fail();
         } catch (ClassCastException expected) {}
     }
 
@@ -736,6 +744,7 @@
 
         try {
             checkedMap2.merge(1, A_STRING, (v1, v2) -> NOT_A_STRING);
+            fail();
         } catch (ClassCastException expected) {}
     }
 }
diff --git a/luni/src/test/java/libcore/java/util/HashtableTest.java b/luni/src/test/java/libcore/java/util/HashtableTest.java
index ca2027c..4a61147 100644
--- a/luni/src/test/java/libcore/java/util/HashtableTest.java
+++ b/luni/src/test/java/libcore/java/util/HashtableTest.java
@@ -101,6 +101,7 @@
 
         try {
             ht.replaceAll((k, v) -> null);
+            fail();
         } catch (NullPointerException expected) {}
     }
 
diff --git a/luni/src/test/java/libcore/java/util/concurrent/CopyOnWriteArrayListTest.java b/luni/src/test/java/libcore/java/util/concurrent/CopyOnWriteArrayListTest.java
index 631cc30..4d9a648 100644
--- a/luni/src/test/java/libcore/java/util/concurrent/CopyOnWriteArrayListTest.java
+++ b/luni/src/test/java/libcore/java/util/concurrent/CopyOnWriteArrayListTest.java
@@ -318,11 +318,6 @@
         assertEquals(-3.0, l.get(0));
         assertEquals(2.0, l.get(1));
         assertEquals(5.0, l.get(2));
-
-        try {
-            l.sort((v1, v2) -> v1.compareTo(v2));
-        } catch (NullPointerException expected) {
-        }
     }
 
     public void test_forEach() {
@@ -341,6 +336,7 @@
 
         try {
             l.forEach(null);
+            fail();
         } catch (NullPointerException expected) {
         }
     }
@@ -406,11 +402,6 @@
         assertEquals(9, (int)completeList.get(3));
         assertEquals(22, (int)completeList.get(4));
         assertEquals(12, (int)completeList.get(5));
-
-        try {
-            l.sort((v1, v2) -> v1.compareTo(v2));
-        } catch (NullPointerException expected) {
-        }
     }
 
     public void test_subList_forEach() {
@@ -430,6 +421,7 @@
 
         try {
             l.forEach(null);
+            fail();
         } catch (NullPointerException expected) {
         }
     }
diff --git a/luni/src/test/java/libcore/java/util/prefs/OldPreferenceChangeEventTest.java b/luni/src/test/java/libcore/java/util/prefs/OldPreferenceChangeEventTest.java
index d77a11c..2f07129 100644
--- a/luni/src/test/java/libcore/java/util/prefs/OldPreferenceChangeEventTest.java
+++ b/luni/src/test/java/libcore/java/util/prefs/OldPreferenceChangeEventTest.java
@@ -130,13 +130,6 @@
         private boolean addDispatched = false;
         protected boolean result = false;
 
-        public synchronized void waitForEvent() {
-            try {
-                wait(500);
-            } catch (InterruptedException expected) {
-            }
-        }
-
         public synchronized void preferenceChange(PreferenceChangeEvent pce) {
             changed++;
             addDispatched = true;
diff --git a/luni/src/test/java/libcore/java/util/zip/AbstractZipFileTest.java b/luni/src/test/java/libcore/java/util/zip/AbstractZipFileTest.java
index 9e049c0..a6e400e 100644
--- a/luni/src/test/java/libcore/java/util/zip/AbstractZipFileTest.java
+++ b/luni/src/test/java/libcore/java/util/zip/AbstractZipFileTest.java
@@ -458,6 +458,7 @@
         // setCrc takes a long, not an int, so -1 isn't a valid CRC32 (because it's 64 bits).
         try {
             ze.setCrc(-1);
+            fail();
         } catch (IllegalArgumentException expected) {
         }
 
diff --git a/luni/src/test/java/libcore/javax/crypto/CipherTest.java b/luni/src/test/java/libcore/javax/crypto/CipherTest.java
index 04a74fd..1127559 100644
--- a/luni/src/test/java/libcore/javax/crypto/CipherTest.java
+++ b/luni/src/test/java/libcore/javax/crypto/CipherTest.java
@@ -1300,6 +1300,7 @@
 
         try {
             c.getOutputSize(0);
+            fail();
         } catch (IllegalStateException expected) {
         }
 
@@ -3730,6 +3731,9 @@
         }
     }
 
+    // Test that when reading GCM parameters encoded using ASN1, a value for the tag size
+    // not present indicates a value of 12.
+    // https://b/29876633
     public void test_DefaultGCMTagSizeAlgorithmParameterSpec() throws Exception {
         final String AES = "AES";
         final String AES_GCM = "AES/GCM/NoPadding";
@@ -3742,14 +3746,12 @@
             (byte) 14,    // DER encoding : total length
             (byte) 4,     // DER encoding : tag_OctetString
             (byte) 12,    // DER encoding : counter length
-            // Note that IV's size 12 bytes is recommended, but authentication tag size should be 16
-            // bytes.
             (byte) 0, (byte) 0, (byte) 0, (byte) 0, (byte) 0, (byte) 0,
             (byte) 0, (byte) 0, (byte) 0, (byte) 0, (byte) 0, (byte) 0 });
         cipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(key, AES), param);
         byte[] ciphertext = cipher.update(input);
         byte[] tag = cipher.doFinal();
-        assertEquals(16, tag.length);
+        assertEquals(12, tag.length);
     }
 
     public void testAES_ECB_PKCS5Padding_ShortBuffer_Failure() throws Exception {
diff --git a/luni/src/test/java/libcore/javax/net/ssl/KeyStoreBuilderParametersTest.java b/luni/src/test/java/libcore/javax/net/ssl/KeyStoreBuilderParametersTest.java
index 5b8f6e6..d73e4a3 100644
--- a/luni/src/test/java/libcore/javax/net/ssl/KeyStoreBuilderParametersTest.java
+++ b/luni/src/test/java/libcore/javax/net/ssl/KeyStoreBuilderParametersTest.java
@@ -47,6 +47,7 @@
     public void test_init_List_null() {
         try {
             new KeyStoreBuilderParameters((List) null);
+            fail();
         } catch (NullPointerException expected) {
         }
     }
diff --git a/luni/src/test/java/libcore/javax/net/ssl/SSLContextTest.java b/luni/src/test/java/libcore/javax/net/ssl/SSLContextTest.java
index 533849c..603baa1 100644
--- a/luni/src/test/java/libcore/javax/net/ssl/SSLContextTest.java
+++ b/luni/src/test/java/libcore/javax/net/ssl/SSLContextTest.java
@@ -57,6 +57,7 @@
         assertNotNull(sslContext);
         try {
             sslContext.init(null, null, null);
+            fail();
         } catch (KeyManagementException expected) {
         }
     }
@@ -64,6 +65,7 @@
     public void test_SSLContext_setDefault() throws Exception {
         try {
             SSLContext.setDefault(null);
+            fail();
         } catch (NullPointerException expected) {
         }
 
diff --git a/luni/src/test/java/libcore/javax/net/ssl/SSLSessionTest.java b/luni/src/test/java/libcore/javax/net/ssl/SSLSessionTest.java
index bc2b626..5691dfb 100644
--- a/luni/src/test/java/libcore/javax/net/ssl/SSLSessionTest.java
+++ b/luni/src/test/java/libcore/javax/net/ssl/SSLSessionTest.java
@@ -242,6 +242,7 @@
         TestSSLSessions s = TestSSLSessions.create();
         try {
             s.invalid.getValue(null);
+            fail();
         } catch (IllegalArgumentException expected) {
         }
         assertNull(s.invalid.getValue("BOGUS"));
diff --git a/luni/src/test/java/libcore/javax/net/ssl/SSLSocketTest.java b/luni/src/test/java/libcore/javax/net/ssl/SSLSocketTest.java
index d17e32b..5e94b21 100644
--- a/luni/src/test/java/libcore/javax/net/ssl/SSLSocketTest.java
+++ b/luni/src/test/java/libcore/javax/net/ssl/SSLSocketTest.java
@@ -80,6 +80,8 @@
 import libcore.tlswire.handshake.CipherSuite;
 import libcore.tlswire.handshake.ClientHello;
 import libcore.tlswire.handshake.CompressionMethod;
+import libcore.tlswire.handshake.EllipticCurve;
+import libcore.tlswire.handshake.EllipticCurvesHelloExtension;
 import libcore.tlswire.handshake.HandshakeMessage;
 import libcore.tlswire.handshake.HelloExtension;
 import libcore.tlswire.handshake.ServerNameHelloExtension;
@@ -1693,6 +1695,31 @@
         }, getSSLSocketFactoriesToTest());
     }
 
+    public void test_SSLSocket_ClientHello_supportedCurves() throws Exception {
+        ForEachRunner.runNamed(new ForEachRunner.Callback<SSLSocketFactory>() {
+            @Override
+            public void run(SSLSocketFactory sslSocketFactory) throws Exception {
+                ClientHello clientHello = captureTlsHandshakeClientHello(sslSocketFactory);
+
+                EllipticCurvesHelloExtension ecExtension = (EllipticCurvesHelloExtension)
+                        clientHello.findExtensionByType(HelloExtension.TYPE_ELLIPTIC_CURVES);
+                final String[] supportedCurves;
+                if (ecExtension == null) {
+                    supportedCurves = new String[0];
+                } else {
+                    assertTrue(ecExtension.wellFormed);
+                    supportedCurves = new String[ecExtension.supported.size()];
+                    for (int i = 0; i < ecExtension.supported.size(); i++) {
+                        EllipticCurve curve = ecExtension.supported.get(i);
+                        supportedCurves[i] = curve.toString();
+                    }
+                }
+
+                StandardNames.assertDefaultEllipticCurves(supportedCurves);
+            }
+        }, getSSLSocketFactoriesToTest());
+    }
+
     public void test_SSLSocket_ClientHello_clientProtocolVersion() throws Exception {
         ForEachRunner.runNamed(new ForEachRunner.Callback<SSLSocketFactory>() {
             @Override
diff --git a/luni/src/test/java/libcore/xml/KxmlSerializerTest.java b/luni/src/test/java/libcore/xml/KxmlSerializerTest.java
index 5f68a99..fffb3f1 100644
--- a/luni/src/test/java/libcore/xml/KxmlSerializerTest.java
+++ b/luni/src/test/java/libcore/xml/KxmlSerializerTest.java
@@ -129,14 +129,17 @@
         serializer.startTag(NAMESPACE, "tag");
         try {
             serializer.attribute(NAMESPACE, "attr", "a\ud83d\u0040b");
+            fail();
         } catch (IllegalArgumentException expected) {
         }
         try {
             serializer.text("c\ud83d\u0040d");
+            fail();
         } catch (IllegalArgumentException expected) {
         }
         try {
             serializer.cdsect("e\ud83d\u0040f");
+            fail();
         } catch (IllegalArgumentException expected) {
         }
     }
diff --git a/luni/src/test/java/org/apache/harmony/crypto/tests/javax/crypto/CipherTest.java b/luni/src/test/java/org/apache/harmony/crypto/tests/javax/crypto/CipherTest.java
index b4da1b8..e893670 100644
--- a/luni/src/test/java/org/apache/harmony/crypto/tests/javax/crypto/CipherTest.java
+++ b/luni/src/test/java/org/apache/harmony/crypto/tests/javax/crypto/CipherTest.java
@@ -561,6 +561,7 @@
         }
         try {
             Cipher.getMaxAllowedKeyLength("");
+            fail();
         } catch (NoSuchAlgorithmException expected) {
         }
         try {
diff --git a/luni/src/test/java/org/apache/harmony/luni/tests/java/net/URLConnectionTest.java b/luni/src/test/java/org/apache/harmony/luni/tests/java/net/URLConnectionTest.java
index a768863..61c6d03 100644
--- a/luni/src/test/java/org/apache/harmony/luni/tests/java/net/URLConnectionTest.java
+++ b/luni/src/test/java/org/apache/harmony/luni/tests/java/net/URLConnectionTest.java
@@ -530,6 +530,7 @@
         uc2.connect();
         try {
             uc2.getInputStream();
+            fail();
         } catch (Throwable expected) {
         }
     }
diff --git a/luni/src/test/java/org/apache/harmony/security/tests/java/security/KeyStore2Test.java b/luni/src/test/java/org/apache/harmony/security/tests/java/security/KeyStore2Test.java
index d303903..dd325b1 100644
--- a/luni/src/test/java/org/apache/harmony/security/tests/java/security/KeyStore2Test.java
+++ b/luni/src/test/java/org/apache/harmony/security/tests/java/security/KeyStore2Test.java
@@ -892,6 +892,7 @@
 
         try {
             keyStore.entryInstanceOf(null, KeyStore.SecretKeyEntry.class);
+            fail();
         } catch (NullPointerException expected) {
         }
 
@@ -924,6 +925,7 @@
 
         try {
             keyStore.store(new ByteArrayOutputStream(), "pwd".toCharArray());
+            fail();
         } catch (KeyStoreException expected) {
         }
 
diff --git a/luni/src/test/java/org/apache/harmony/security/tests/java/security/KeyStoreSpiTest.java b/luni/src/test/java/org/apache/harmony/security/tests/java/security/KeyStoreSpiTest.java
index a85459b..be3e6d1 100644
--- a/luni/src/test/java/org/apache/harmony/security/tests/java/security/KeyStoreSpiTest.java
+++ b/luni/src/test/java/org/apache/harmony/security/tests/java/security/KeyStoreSpiTest.java
@@ -77,18 +77,12 @@
                 KeyStore.TrustedCertificateEntry.class));
 
         try {
-            assertFalse(ksSpi.engineEntryInstanceOf(null,
-                    KeyStore.TrustedCertificateEntry.class));
+            ksSpi.engineEntryInstanceOf(null, KeyStore.TrustedCertificateEntry.class);
+            fail();
         } catch (NullPointerException expected) {
         }
 
-        try {
-            assertFalse(ksSpi.engineEntryInstanceOf(
-                    "test_engineEntryInstanceOf_Alias1", null));
-        } catch (NullPointerException expected) {
-        }
-
-
+        assertFalse(ksSpi.engineEntryInstanceOf("test_engineEntryInstanceOf_Alias1", null));
     }
 
     public void testKeyStoreSpi01() throws IOException,
@@ -111,6 +105,7 @@
 
         try {
             ksSpi.engineStore(null);
+            fail();
         } catch (UnsupportedOperationException expected) {
         }
         assertNull("Not null entry", ksSpi.engineGetEntry("aaa", null));
diff --git a/luni/src/test/java/org/apache/harmony/security/tests/java/security/SignatureTest.java b/luni/src/test/java/org/apache/harmony/security/tests/java/security/SignatureTest.java
index d00e18a..1f9aa4b 100644
--- a/luni/src/test/java/org/apache/harmony/security/tests/java/security/SignatureTest.java
+++ b/luni/src/test/java/org/apache/harmony/security/tests/java/security/SignatureTest.java
@@ -558,7 +558,9 @@
     }
 
     @SuppressWarnings("unused")
-    protected static class MySignature extends Signature implements Cloneable {
+    // Needs to be public as this is checked by the provider class when providing an instance of
+    // a class
+    public static class MySignature extends Signature implements Cloneable {
 
         public MySignature() {
             super("TestSignature");
diff --git a/luni/src/test/java/tests/security/cert/X509CertSelectorTest.java b/luni/src/test/java/tests/security/cert/X509CertSelectorTest.java
index 1616efb..1ef25fd 100644
--- a/luni/src/test/java/tests/security/cert/X509CertSelectorTest.java
+++ b/luni/src/test/java/tests/security/cert/X509CertSelectorTest.java
@@ -859,6 +859,7 @@
         for (int i = 0; i < invalidValues.length; i++) {
             try {
                 selector.setBasicConstraints(-3);
+                fail();
             } catch (IllegalArgumentException expected) {
             }
         }
diff --git a/luni/src/test/java/tests/security/cert/X509Certificate2Test.java b/luni/src/test/java/tests/security/cert/X509Certificate2Test.java
index 03b0243..bf736d5 100644
--- a/luni/src/test/java/tests/security/cert/X509Certificate2Test.java
+++ b/luni/src/test/java/tests/security/cert/X509Certificate2Test.java
@@ -306,16 +306,19 @@
 
         try {
             l.clear();
+            fail();
         } catch (UnsupportedOperationException expected) {
         }
 
         try {
             l.add("Test");
+            fail();
         } catch (UnsupportedOperationException expected) {
         }
 
         try {
             l.remove(0);
+            fail();
         } catch (UnsupportedOperationException expected) {
         }
     }
diff --git a/non_openjdk_java_files.mk b/non_openjdk_java_files.mk
index 839067e..9a3ef03 100644
--- a/non_openjdk_java_files.mk
+++ b/non_openjdk_java_files.mk
@@ -36,6 +36,7 @@
   dalvik/src/main/java/dalvik/annotation/TestTarget.java \
   dalvik/src/main/java/dalvik/annotation/TestTargetClass.java \
   dalvik/src/main/java/dalvik/annotation/Throws.java \
+  dalvik/src/main/java/dalvik/annotation/optimization/CriticalNative.java \
   dalvik/src/main/java/dalvik/annotation/optimization/FastNative.java \
   dalvik/src/main/java/dalvik/bytecode/OpcodeInfo.java \
   dalvik/src/main/java/dalvik/bytecode/Opcodes.java \
diff --git a/ojluni/src/main/java/java/io/DataInput.java b/ojluni/src/main/java/java/io/DataInput.java
index e4b7e83..3e0f0dd 100644
--- a/ojluni/src/main/java/java/io/DataInput.java
+++ b/ojluni/src/main/java/java/io/DataInput.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1995, 2006, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1995, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -26,12 +26,12 @@
 package java.io;
 
 /**
- * The <code>DataInput</code> interface provides
+ * The {@code DataInput} interface provides
  * for reading bytes from a binary stream and
  * reconstructing from them data in any of
  * the Java primitive types. There is also
  * a
- * facility for reconstructing a <code>String</code>
+ * facility for reconstructing a {@code String}
  * from data in
  * <a href="#modified-utf-8">modified UTF-8</a>
  * format.
@@ -39,146 +39,101 @@
  * It is generally true of all the reading
  * routines in this interface that if end of
  * file is reached before the desired number
- * of bytes has been read, an <code>EOFException</code>
- * (which is a kind of <code>IOException</code>)
+ * of bytes has been read, an {@code EOFException}
+ * (which is a kind of {@code IOException})
  * is thrown. If any byte cannot be read for
- * any reason other than end of file, an <code>IOException</code>
- * other than <code>EOFException</code> is
- * thrown. In particular, an <code>IOException</code>
+ * any reason other than end of file, an {@code IOException}
+ * other than {@code EOFException} is
+ * thrown. In particular, an {@code IOException}
  * may be thrown if the input stream has been
  * closed.
  *
- * <h4><a name="modified-utf-8">Modified UTF-8</a></h4>
+ * <h3><a name="modified-utf-8">Modified UTF-8</a></h3>
  * <p>
  * Implementations of the DataInput and DataOutput interfaces represent
  * Unicode strings in a format that is a slight modification of UTF-8.
  * (For information regarding the standard UTF-8 format, see section
  * <i>3.9 Unicode Encoding Forms</i> of <i>The Unicode Standard, Version
  * 4.0</i>).
- * Note that in the following tables, the most significant bit appears in the
+ * Note that in the following table, the most significant bit appears in the
  * far left-hand column.
- * <p>
- * All characters in the range <code>'&#92;u0001'</code> to
- * <code>'&#92;u007F'</code> are represented by a single byte:
  *
  * <blockquote>
- *   <table border="1" cellspacing="0" cellpadding="8" width="50%"
+ *   <table border="1" cellspacing="0" cellpadding="8"
  *          summary="Bit values and bytes">
  *     <tr>
- *       <td></td>
- *       <th id="bit">Bit Values</th>
+ *       <th colspan="9"><span style="font-weight:normal">
+ *         All characters in the range {@code '\u005Cu0001'} to
+ *         {@code '\u005Cu007F'} are represented by a single byte:</span></th>
  *     </tr>
  *     <tr>
- *       <th id="byte1">Byte 1</th>
- *       <td>
- *         <table border="1" cellspacing="0" width="100%">
- *           <tr>
- *             <td width="12%"><center>0</center>
- *             <td colspan="7"><center>bits 6-0</center>
- *           </tr>
- *         </table>
- *       </td>
- *     </tr>
- *   </table>
- * </blockquote>
- *
- * <p>
- * The null character <code>'&#92;u0000'</code> and characters in the
- * range <code>'&#92;u0080'</code> to <code>'&#92;u07FF'</code> are
- * represented by a pair of bytes:
- *
- * <blockquote>
- *   <table border="1" cellspacing="0" cellpadding="8" width="50%"
- *          summary="Bit values and bytes">
- *     <tr>
  *       <td></td>
- *       <th id="bit">Bit Values</th>
+ *       <th colspan="8" id="bit_a">Bit Values</th>
  *     </tr>
  *     <tr>
- *       <th id="byte1">Byte 1</th>
- *       <td>
- *         <table border="1" cellspacing="0" width="100%">
- *           <tr>
- *             <td width="12%"><center>1</center>
- *             <td width="13%"><center>1</center>
- *             <td width="12%"><center>0</center>
- *             <td colspan="5"><center>bits 10-6</center>
- *           </tr>
- *         </table>
- *       </td>
+ *       <th id="byte1_a">Byte 1</th>
+ *       <td><center>0</center>
+ *       <td colspan="7"><center>bits 6-0</center>
  *     </tr>
  *     <tr>
- *       <th id="byte2">Byte 2</th>
- *       <td>
- *         <table border="1" cellspacing="0" width="100%">
- *           <tr>
- *             <td width="12%"><center>1</center>
- *             <td width="13%"><center>0</center>
- *             <td colspan="6"><center>bits 5-0</center>
- *           </tr>
- *         </table>
- *       </td>
+ *       <th colspan="9"><span style="font-weight:normal">
+ *         The null character {@code '\u005Cu0000'} and characters
+ *         in the range {@code '\u005Cu0080'} to {@code '\u005Cu07FF'} are
+ *         represented by a pair of bytes:</span></th>
  *     </tr>
- *   </table>
- *  </blockquote>
- *
- * <br>
- * <code>char</code> values in the range <code>'&#92;u0800'</code> to
- * <code>'&#92;uFFFF'</code> are represented by three bytes:
- *
- * <blockquote>
- *   <table border="1" cellspacing="0" cellpadding="8" width="50%"
- *          summary="Bit values and bytes">
  *     <tr>
  *       <td></td>
- *       <th id="bit">Bit Values</th>
+ *       <th colspan="8" id="bit_b">Bit Values</th>
  *     </tr>
  *     <tr>
- *       <th id="byte1">Byte 1</th>
- *       <td>
- *         <table border="1" cellspacing="0" width="100%">
- *           <tr>
- *             <td width="12%"><center>1</center>
- *             <td width="13%"><center>1</center>
- *             <td width="12%"><center>1</center>
- *             <td width="13%"><center>0</center>
- *             <td colspan="4"><center>bits 15-12</center>
- *           </tr>
- *         </table>
- *       </td>
+ *       <th id="byte1_b">Byte 1</th>
+ *       <td><center>1</center>
+ *       <td><center>1</center>
+ *       <td><center>0</center>
+ *       <td colspan="5"><center>bits 10-6</center>
  *     </tr>
  *     <tr>
- *       <th id="byte2">Byte 2</th>
- *       <td>
- *         <table border="1" cellspacing="0" width="100%">
- *           <tr>
- *             <td width="12%"><center>1</center>
- *             <td width="13%"><center>0</center>
- *             <td colspan="6"><center>bits 11-6</center>
- *           </tr>
- *         </table>
- *       </td>
+ *       <th id="byte2_a">Byte 2</th>
+ *       <td><center>1</center>
+ *       <td><center>0</center>
+ *       <td colspan="6"><center>bits 5-0</center>
+ *     </tr>
+ *     <tr>
+ *       <th colspan="9"><span style="font-weight:normal">
+ *         {@code char} values in the range {@code '\u005Cu0800'}
+ *         to {@code '\u005CuFFFF'} are represented by three bytes:</span></th>
+ *     </tr>
+ *     <tr>
+ *       <td></td>
+ *       <th colspan="8"id="bit_c">Bit Values</th>
+ *     </tr>
+ *     <tr>
+ *       <th id="byte1_c">Byte 1</th>
+ *       <td><center>1</center>
+ *       <td><center>1</center>
+ *       <td><center>1</center>
+ *       <td><center>0</center>
+ *       <td colspan="4"><center>bits 15-12</center>
+ *     </tr>
+ *     <tr>
+ *       <th id="byte2_b">Byte 2</th>
+ *       <td><center>1</center>
+ *       <td><center>0</center>
+ *       <td colspan="6"><center>bits 11-6</center>
  *     </tr>
  *     <tr>
  *       <th id="byte3">Byte 3</th>
- *       <td>
- *         <table border="1" cellspacing="0" width="100%">
- *           <tr>
- *             <td width="12%"><center>1</center>
- *             <td width="13%"><center>0</center>
- *             <td colspan="6"><center>bits 5-0</center>
- *           </tr>
- *         </table>
- *       </td>
+ *       <td><center>1</center>
+ *       <td><center>0</center>
+ *       <td colspan="6"><center>bits 5-0</center>
  *     </tr>
  *   </table>
- *  </blockquote>
- *
+ * </blockquote>
  * <p>
  * The differences between this format and the
  * standard UTF-8 format are the following:
  * <ul>
- * <li>The null byte <code>'&#92;u0000'</code> is encoded in 2-byte format
+ * <li>The null byte {@code '\u005Cu0000'} is encoded in 2-byte format
  *     rather than 1-byte, so that the encoded strings never have
  *     embedded nulls.
  * <li>Only the 1-byte, 2-byte, and 3-byte formats are used.
@@ -195,36 +150,36 @@
     /**
      * Reads some bytes from an input
      * stream and stores them into the buffer
-     * array <code>b</code>. The number of bytes
+     * array {@code b}. The number of bytes
      * read is equal
-     * to the length of <code>b</code>.
+     * to the length of {@code b}.
      * <p>
      * This method blocks until one of the
-     * following conditions occurs:<p>
+     * following conditions occurs:
      * <ul>
-     * <li><code>b.length</code>
+     * <li>{@code b.length}
      * bytes of input data are available, in which
      * case a normal return is made.
      *
      * <li>End of
-     * file is detected, in which case an <code>EOFException</code>
+     * file is detected, in which case an {@code EOFException}
      * is thrown.
      *
      * <li>An I/O error occurs, in
-     * which case an <code>IOException</code> other
-     * than <code>EOFException</code> is thrown.
+     * which case an {@code IOException} other
+     * than {@code EOFException} is thrown.
      * </ul>
      * <p>
-     * If <code>b</code> is <code>null</code>,
-     * a <code>NullPointerException</code> is thrown.
-     * If <code>b.length</code> is zero, then
+     * If {@code b} is {@code null},
+     * a {@code NullPointerException} is thrown.
+     * If {@code b.length} is zero, then
      * no bytes are read. Otherwise, the first
-     * byte read is stored into element <code>b[0]</code>,
-     * the next one into <code>b[1]</code>, and
+     * byte read is stored into element {@code b[0]},
+     * the next one into {@code b[1]}, and
      * so on.
      * If an exception is thrown from
      * this method, then it may be that some but
-     * not all bytes of <code>b</code> have been
+     * not all bytes of {@code b} have been
      * updated with data from the input stream.
      *
      * @param     b   the buffer into which the data is read.
@@ -236,40 +191,40 @@
 
     /**
      *
-     * Reads <code>len</code>
+     * Reads {@code len}
      * bytes from
      * an input stream.
      * <p>
      * This method
      * blocks until one of the following conditions
-     * occurs:<p>
+     * occurs:
      * <ul>
-     * <li><code>len</code> bytes
+     * <li>{@code len} bytes
      * of input data are available, in which case
      * a normal return is made.
      *
      * <li>End of file
-     * is detected, in which case an <code>EOFException</code>
+     * is detected, in which case an {@code EOFException}
      * is thrown.
      *
      * <li>An I/O error occurs, in
-     * which case an <code>IOException</code> other
-     * than <code>EOFException</code> is thrown.
+     * which case an {@code IOException} other
+     * than {@code EOFException} is thrown.
      * </ul>
      * <p>
-     * If <code>b</code> is <code>null</code>,
-     * a <code>NullPointerException</code> is thrown.
-     * If <code>off</code> is negative, or <code>len</code>
-     * is negative, or <code>off+len</code> is
-     * greater than the length of the array <code>b</code>,
-     * then an <code>IndexOutOfBoundsException</code>
+     * If {@code b} is {@code null},
+     * a {@code NullPointerException} is thrown.
+     * If {@code off} is negative, or {@code len}
+     * is negative, or {@code off+len} is
+     * greater than the length of the array {@code b},
+     * then an {@code IndexOutOfBoundsException}
      * is thrown.
-     * If <code>len</code> is zero,
+     * If {@code len} is zero,
      * then no bytes are read. Otherwise, the first
-     * byte read is stored into element <code>b[off]</code>,
-     * the next one into <code>b[off+1]</code>,
+     * byte read is stored into element {@code b[off]},
+     * the next one into {@code b[off+1]},
      * and so on. The number of bytes read is,
-     * at most, equal to <code>len</code>.
+     * at most, equal to {@code len}.
      *
      * @param     b   the buffer into which the data is read.
      * @param off  an int specifying the offset into the data.
@@ -282,7 +237,7 @@
 
     /**
      * Makes an attempt to skip over
-     * <code>n</code> bytes
+     * {@code n} bytes
      * of data from the input
      * stream, discarding the skipped bytes. However,
      * it may skip
@@ -290,10 +245,10 @@
      * bytes, possibly zero. This may result from
      * any of a
      * number of conditions; reaching
-     * end of file before <code>n</code> bytes
+     * end of file before {@code n} bytes
      * have been skipped is
      * only one possibility.
-     * This method never throws an <code>EOFException</code>.
+     * This method never throws an {@code EOFException}.
      * The actual
      * number of bytes skipped is returned.
      *
@@ -305,13 +260,13 @@
 
     /**
      * Reads one input byte and returns
-     * <code>true</code> if that byte is nonzero,
-     * <code>false</code> if that byte is zero.
+     * {@code true} if that byte is nonzero,
+     * {@code false} if that byte is zero.
      * This method is suitable for reading
-     * the byte written by the <code>writeBoolean</code>
-     * method of interface <code>DataOutput</code>.
+     * the byte written by the {@code writeBoolean}
+     * method of interface {@code DataOutput}.
      *
-     * @return     the <code>boolean</code> value read.
+     * @return     the {@code boolean} value read.
      * @exception  EOFException  if this stream reaches the end before reading
      *               all the bytes.
      * @exception  IOException   if an I/O error occurs.
@@ -321,11 +276,11 @@
     /**
      * Reads and returns one input byte.
      * The byte is treated as a signed value in
-     * the range <code>-128</code> through <code>127</code>,
+     * the range {@code -128} through {@code 127},
      * inclusive.
      * This method is suitable for
-     * reading the byte written by the <code>writeByte</code>
-     * method of interface <code>DataOutput</code>.
+     * reading the byte written by the {@code writeByte}
+     * method of interface {@code DataOutput}.
      *
      * @return     the 8-bit value read.
      * @exception  EOFException  if this stream reaches the end before reading
@@ -336,16 +291,16 @@
 
     /**
      * Reads one input byte, zero-extends
-     * it to type <code>int</code>, and returns
+     * it to type {@code int}, and returns
      * the result, which is therefore in the range
-     * <code>0</code>
-     * through <code>255</code>.
+     * {@code 0}
+     * through {@code 255}.
      * This method is suitable for reading
-     * the byte written by the <code>writeByte</code>
-     * method of interface <code>DataOutput</code>
-     * if the argument to <code>writeByte</code>
+     * the byte written by the {@code writeByte}
+     * method of interface {@code DataOutput}
+     * if the argument to {@code writeByte}
      * was intended to be a value in the range
-     * <code>0</code> through <code>255</code>.
+     * {@code 0} through {@code 255}.
      *
      * @return     the unsigned 8-bit value read.
      * @exception  EOFException  if this stream reaches the end before reading
@@ -356,17 +311,17 @@
 
     /**
      * Reads two input bytes and returns
-     * a <code>short</code> value. Let <code>a</code>
-     * be the first byte read and <code>b</code>
+     * a {@code short} value. Let {@code a}
+     * be the first byte read and {@code b}
      * be the second byte. The value
      * returned
      * is:
-     * <p><pre><code>(short)((a &lt;&lt; 8) | (b &amp; 0xff))
-     * </code></pre>
+     * <pre>{@code (short)((a << 8) | (b & 0xff))
+     * }</pre>
      * This method
      * is suitable for reading the bytes written
-     * by the <code>writeShort</code> method of
-     * interface <code>DataOutput</code>.
+     * by the {@code writeShort} method of
+     * interface {@code DataOutput}.
      *
      * @return     the 16-bit value read.
      * @exception  EOFException  if this stream reaches the end before reading
@@ -377,19 +332,19 @@
 
     /**
      * Reads two input bytes and returns
-     * an <code>int</code> value in the range <code>0</code>
-     * through <code>65535</code>. Let <code>a</code>
+     * an {@code int} value in the range {@code 0}
+     * through {@code 65535}. Let {@code a}
      * be the first byte read and
-     * <code>b</code>
+     * {@code b}
      * be the second byte. The value returned is:
-     * <p><pre><code>(((a &amp; 0xff) &lt;&lt; 8) | (b &amp; 0xff))
-     * </code></pre>
+     * <pre>{@code (((a & 0xff) << 8) | (b & 0xff))
+     * }</pre>
      * This method is suitable for reading the bytes
-     * written by the <code>writeShort</code> method
-     * of interface <code>DataOutput</code>  if
-     * the argument to <code>writeShort</code>
+     * written by the {@code writeShort} method
+     * of interface {@code DataOutput}  if
+     * the argument to {@code writeShort}
      * was intended to be a value in the range
-     * <code>0</code> through <code>65535</code>.
+     * {@code 0} through {@code 65535}.
      *
      * @return     the unsigned 16-bit value read.
      * @exception  EOFException  if this stream reaches the end before reading
@@ -399,19 +354,19 @@
     int readUnsignedShort() throws IOException;
 
     /**
-     * Reads two input bytes and returns a <code>char</code> value.
-     * Let <code>a</code>
-     * be the first byte read and <code>b</code>
+     * Reads two input bytes and returns a {@code char} value.
+     * Let {@code a}
+     * be the first byte read and {@code b}
      * be the second byte. The value
      * returned is:
-     * <p><pre><code>(char)((a &lt;&lt; 8) | (b &amp; 0xff))
-     * </code></pre>
+     * <pre>{@code (char)((a << 8) | (b & 0xff))
+     * }</pre>
      * This method
      * is suitable for reading bytes written by
-     * the <code>writeChar</code> method of interface
-     * <code>DataOutput</code>.
+     * the {@code writeChar} method of interface
+     * {@code DataOutput}.
      *
-     * @return     the <code>char</code> value read.
+     * @return     the {@code char} value read.
      * @exception  EOFException  if this stream reaches the end before reading
      *               all the bytes.
      * @exception  IOException   if an I/O error occurs.
@@ -420,18 +375,17 @@
 
     /**
      * Reads four input bytes and returns an
-     * <code>int</code> value. Let <code>a-d</code>
+     * {@code int} value. Let {@code a-d}
      * be the first through fourth bytes read. The value returned is:
-     * <p><pre>
-     * <code>
-     * (((a &amp; 0xff) &lt;&lt; 24) | ((b &amp; 0xff) &lt;&lt; 16) |
-     * &#32;((c &amp; 0xff) &lt;&lt; 8) | (d &amp; 0xff))
-     * </code></pre>
+     * <pre>{@code
+     * (((a & 0xff) << 24) | ((b & 0xff) << 16) |
+     *  ((c & 0xff) <<  8) | (d & 0xff))
+     * }</pre>
      * This method is suitable
-     * for reading bytes written by the <code>writeInt</code>
-     * method of interface <code>DataOutput</code>.
+     * for reading bytes written by the {@code writeInt}
+     * method of interface {@code DataOutput}.
      *
-     * @return     the <code>int</code> value read.
+     * @return     the {@code int} value read.
      * @exception  EOFException  if this stream reaches the end before reading
      *               all the bytes.
      * @exception  IOException   if an I/O error occurs.
@@ -440,25 +394,25 @@
 
     /**
      * Reads eight input bytes and returns
-     * a <code>long</code> value. Let <code>a-h</code>
+     * a {@code long} value. Let {@code a-h}
      * be the first through eighth bytes read.
      * The value returned is:
-     * <p><pre> <code>
-     * (((long)(a &amp; 0xff) &lt;&lt; 56) |
-     *  ((long)(b &amp; 0xff) &lt;&lt; 48) |
-     *  ((long)(c &amp; 0xff) &lt;&lt; 40) |
-     *  ((long)(d &amp; 0xff) &lt;&lt; 32) |
-     *  ((long)(e &amp; 0xff) &lt;&lt; 24) |
-     *  ((long)(f &amp; 0xff) &lt;&lt; 16) |
-     *  ((long)(g &amp; 0xff) &lt;&lt;  8) |
-     *  ((long)(h &amp; 0xff)))
-     * </code></pre>
+     * <pre>{@code
+     * (((long)(a & 0xff) << 56) |
+     *  ((long)(b & 0xff) << 48) |
+     *  ((long)(c & 0xff) << 40) |
+     *  ((long)(d & 0xff) << 32) |
+     *  ((long)(e & 0xff) << 24) |
+     *  ((long)(f & 0xff) << 16) |
+     *  ((long)(g & 0xff) <<  8) |
+     *  ((long)(h & 0xff)))
+     * }</pre>
      * <p>
      * This method is suitable
-     * for reading bytes written by the <code>writeLong</code>
-     * method of interface <code>DataOutput</code>.
+     * for reading bytes written by the {@code writeLong}
+     * method of interface {@code DataOutput}.
      *
-     * @return     the <code>long</code> value read.
+     * @return     the {@code long} value read.
      * @exception  EOFException  if this stream reaches the end before reading
      *               all the bytes.
      * @exception  IOException   if an I/O error occurs.
@@ -467,18 +421,18 @@
 
     /**
      * Reads four input bytes and returns
-     * a <code>float</code> value. It does this
-     * by first constructing an <code>int</code>
+     * a {@code float} value. It does this
+     * by first constructing an {@code int}
      * value in exactly the manner
-     * of the <code>readInt</code>
-     * method, then converting this <code>int</code>
-     * value to a <code>float</code> in
-     * exactly the manner of the method <code>Float.intBitsToFloat</code>.
+     * of the {@code readInt}
+     * method, then converting this {@code int}
+     * value to a {@code float} in
+     * exactly the manner of the method {@code Float.intBitsToFloat}.
      * This method is suitable for reading
-     * bytes written by the <code>writeFloat</code>
-     * method of interface <code>DataOutput</code>.
+     * bytes written by the {@code writeFloat}
+     * method of interface {@code DataOutput}.
      *
-     * @return     the <code>float</code> value read.
+     * @return     the {@code float} value read.
      * @exception  EOFException  if this stream reaches the end before reading
      *               all the bytes.
      * @exception  IOException   if an I/O error occurs.
@@ -487,18 +441,18 @@
 
     /**
      * Reads eight input bytes and returns
-     * a <code>double</code> value. It does this
-     * by first constructing a <code>long</code>
+     * a {@code double} value. It does this
+     * by first constructing a {@code long}
      * value in exactly the manner
-     * of the <code>readlong</code>
-     * method, then converting this <code>long</code>
-     * value to a <code>double</code> in exactly
-     * the manner of the method <code>Double.longBitsToDouble</code>.
+     * of the {@code readLong}
+     * method, then converting this {@code long}
+     * value to a {@code double} in exactly
+     * the manner of the method {@code Double.longBitsToDouble}.
      * This method is suitable for reading
-     * bytes written by the <code>writeDouble</code>
-     * method of interface <code>DataOutput</code>.
+     * bytes written by the {@code writeDouble}
+     * method of interface {@code DataOutput}.
      *
-     * @return     the <code>double</code> value read.
+     * @return     the {@code double} value read.
      * @exception  EOFException  if this stream reaches the end before reading
      *               all the bytes.
      * @exception  IOException   if an I/O error occurs.
@@ -512,35 +466,35 @@
      * until it encounters a line terminator or
      * end of
      * file; the characters read are then
-     * returned as a <code>String</code>. Note
+     * returned as a {@code String}. Note
      * that because this
      * method processes bytes,
      * it does not support input of the full Unicode
      * character set.
      * <p>
      * If end of file is encountered
-     * before even one byte can be read, then <code>null</code>
+     * before even one byte can be read, then {@code null}
      * is returned. Otherwise, each byte that is
-     * read is converted to type <code>char</code>
-     * by zero-extension. If the character <code>'\n'</code>
+     * read is converted to type {@code char}
+     * by zero-extension. If the character {@code '\n'}
      * is encountered, it is discarded and reading
-     * ceases. If the character <code>'\r'</code>
+     * ceases. If the character {@code '\r'}
      * is encountered, it is discarded and, if
      * the following byte converts &#32;to the
-     * character <code>'\n'</code>, then that is
+     * character {@code '\n'}, then that is
      * discarded also; reading then ceases. If
      * end of file is encountered before either
-     * of the characters <code>'\n'</code> and
-     * <code>'\r'</code> is encountered, reading
-     * ceases. Once reading has ceased, a <code>String</code>
+     * of the characters {@code '\n'} and
+     * {@code '\r'} is encountered, reading
+     * ceases. Once reading has ceased, a {@code String}
      * is returned that contains all the characters
      * read and not discarded, taken in order.
      * Note that every character in this string
-     * will have a value less than <code>&#92;u0100</code>,
-     * that is, <code>(char)256</code>.
+     * will have a value less than {@code \u005Cu0100},
+     * that is, {@code (char)256}.
      *
      * @return the next line of text from the input stream,
-     *         or <CODE>null</CODE> if the end of file is
+     *         or {@code null} if the end of file is
      *         encountered before a byte can be read.
      * @exception  IOException  if an I/O error occurs.
      */
@@ -550,15 +504,15 @@
      * Reads in a string that has been encoded using a
      * <a href="#modified-utf-8">modified UTF-8</a>
      * format.
-     * The general contract of <code>readUTF</code>
+     * The general contract of {@code readUTF}
      * is that it reads a representation of a Unicode
      * character string encoded in modified
      * UTF-8 format; this string of characters
-     * is then returned as a <code>String</code>.
+     * is then returned as a {@code String}.
      * <p>
      * First, two bytes are read and used to
      * construct an unsigned 16-bit integer in
-     * exactly the manner of the <code>readUnsignedShort</code>
+     * exactly the manner of the {@code readUnsignedShort}
      * method . This integer value is called the
      * <i>UTF length</i> and specifies the number
      * of additional bytes to be read. These bytes
@@ -570,58 +524,58 @@
      * next group.
      * <p>
      * If the first byte of a group
-     * matches the bit pattern <code>0xxxxxxx</code>
-     * (where <code>x</code> means "may be <code>0</code>
-     * or <code>1</code>"), then the group consists
+     * matches the bit pattern {@code 0xxxxxxx}
+     * (where {@code x} means "may be {@code 0}
+     * or {@code 1}"), then the group consists
      * of just that byte. The byte is zero-extended
      * to form a character.
      * <p>
      * If the first byte
-     * of a group matches the bit pattern <code>110xxxxx</code>,
-     * then the group consists of that byte <code>a</code>
-     * and a second byte <code>b</code>. If there
-     * is no byte <code>b</code> (because byte
-     * <code>a</code> was the last of the bytes
-     * to be read), or if byte <code>b</code> does
-     * not match the bit pattern <code>10xxxxxx</code>,
-     * then a <code>UTFDataFormatException</code>
+     * of a group matches the bit pattern {@code 110xxxxx},
+     * then the group consists of that byte {@code a}
+     * and a second byte {@code b}. If there
+     * is no byte {@code b} (because byte
+     * {@code a} was the last of the bytes
+     * to be read), or if byte {@code b} does
+     * not match the bit pattern {@code 10xxxxxx},
+     * then a {@code UTFDataFormatException}
      * is thrown. Otherwise, the group is converted
-     * to the character:<p>
-     * <pre><code>(char)(((a&amp; 0x1F) &lt;&lt; 6) | (b &amp; 0x3F))
-     * </code></pre>
+     * to the character:
+     * <pre>{@code (char)(((a & 0x1F) << 6) | (b & 0x3F))
+     * }</pre>
      * If the first byte of a group
-     * matches the bit pattern <code>1110xxxx</code>,
-     * then the group consists of that byte <code>a</code>
-     * and two more bytes <code>b</code> and <code>c</code>.
-     * If there is no byte <code>c</code> (because
-     * byte <code>a</code> was one of the last
+     * matches the bit pattern {@code 1110xxxx},
+     * then the group consists of that byte {@code a}
+     * and two more bytes {@code b} and {@code c}.
+     * If there is no byte {@code c} (because
+     * byte {@code a} was one of the last
      * two of the bytes to be read), or either
-     * byte <code>b</code> or byte <code>c</code>
-     * does not match the bit pattern <code>10xxxxxx</code>,
-     * then a <code>UTFDataFormatException</code>
+     * byte {@code b} or byte {@code c}
+     * does not match the bit pattern {@code 10xxxxxx},
+     * then a {@code UTFDataFormatException}
      * is thrown. Otherwise, the group is converted
-     * to the character:<p>
-     * <pre><code>
-     * (char)(((a &amp; 0x0F) &lt;&lt; 12) | ((b &amp; 0x3F) &lt;&lt; 6) | (c &amp; 0x3F))
-     * </code></pre>
+     * to the character:
+     * <pre>{@code
+     * (char)(((a & 0x0F) << 12) | ((b & 0x3F) << 6) | (c & 0x3F))
+     * }</pre>
      * If the first byte of a group matches the
-     * pattern <code>1111xxxx</code> or the pattern
-     * <code>10xxxxxx</code>, then a <code>UTFDataFormatException</code>
+     * pattern {@code 1111xxxx} or the pattern
+     * {@code 10xxxxxx}, then a {@code UTFDataFormatException}
      * is thrown.
      * <p>
      * If end of file is encountered
      * at any time during this entire process,
-     * then an <code>EOFException</code> is thrown.
+     * then an {@code EOFException} is thrown.
      * <p>
      * After every group has been converted to
      * a character by this process, the characters
      * are gathered, in the same order in which
      * their corresponding groups were read from
-     * the input stream, to form a <code>String</code>,
+     * the input stream, to form a {@code String},
      * which is returned.
      * <p>
-     * The <code>writeUTF</code>
-     * method of interface <code>DataOutput</code>
+     * The {@code writeUTF}
+     * method of interface {@code DataOutput}
      * may be used to write data that is suitable
      * for reading by this method.
      * @return     a Unicode string.
diff --git a/ojluni/src/main/java/java/io/RandomAccessFile.java b/ojluni/src/main/java/java/io/RandomAccessFile.java
index 6008d0f..fc645cf 100644
--- a/ojluni/src/main/java/java/io/RandomAccessFile.java
+++ b/ojluni/src/main/java/java/io/RandomAccessFile.java
@@ -28,7 +28,6 @@
 
 import java.nio.channels.FileChannel;
 import sun.nio.ch.FileChannelImpl;
-import sun.misc.IoTrace;
 import android.system.ErrnoException;
 import dalvik.system.CloseGuard;
 import libcore.io.IoBridge;
@@ -48,16 +47,16 @@
  * the file pointer past the bytes written. Output operations that write
  * past the current end of the implied array cause the array to be
  * extended. The file pointer can be read by the
- * <code>getFilePointer</code> method and set by the <code>seek</code>
+ * {@code getFilePointer} method and set by the {@code seek}
  * method.
  * <p>
  * It is generally true of all the reading routines in this class that
  * if end-of-file is reached before the desired number of bytes has been
- * read, an <code>EOFException</code> (which is a kind of
- * <code>IOException</code>) is thrown. If any byte cannot be read for
- * any reason other than end-of-file, an <code>IOException</code> other
- * than <code>EOFException</code> is thrown. In particular, an
- * <code>IOException</code> may be thrown if the stream has been closed.
+ * read, an {@code EOFException} (which is a kind of
+ * {@code IOException}) is thrown. If any byte cannot be read for
+ * any reason other than end-of-file, an {@code IOException} other
+ * than {@code EOFException} is thrown. In particular, an
+ * {@code IOException} may be thrown if the stream has been closed.
  *
  * @author  unascribed
  * @since   JDK1.0
@@ -74,7 +73,10 @@
     private FileChannel channel = null;
     private boolean rw;
 
-    /* The path of the referenced file */
+    /**
+     * The path of the referenced file
+     * (null if the stream is created with a file descriptor)
+     */
     private final String path;
 
     private Object closeLock = new Object();
@@ -92,12 +94,12 @@
      * href="#mode"><tt>RandomAccessFile(File,String)</tt></a> constructor.
      *
      * <p>
-     * If there is a security manager, its <code>checkRead</code> method
-     * is called with the <code>name</code> argument
+     * If there is a security manager, its {@code checkRead} method
+     * is called with the {@code name} argument
      * as its argument to see if read access to the file is allowed.
      * If the mode allows writing, the security manager's
-     * <code>checkWrite</code> method
-     * is also called with the <code>name</code> argument
+     * {@code checkWrite} method
+     * is also called with the {@code name} argument
      * as its argument to see if write access to the file is allowed.
      *
      * @param      name   the system-dependent filename
@@ -113,9 +115,9 @@
      *            that name cannot be created, or if some other error occurs
      *            while opening or creating the file
      * @exception  SecurityException         if a security manager exists and its
-     *               <code>checkRead</code> method denies read access to the file
+     *               {@code checkRead} method denies read access to the file
      *               or the mode is "rw" and the security manager's
-     *               <code>checkWrite</code> method denies write access to the file
+     *               {@code checkWrite} method denies write access to the file
      * @see        java.lang.SecurityException
      * @see        java.lang.SecurityManager#checkRead(java.lang.String)
      * @see        java.lang.SecurityManager#checkWrite(java.lang.String)
@@ -133,12 +135,12 @@
      * write to, the file specified by the {@link File} argument.  A new {@link
      * FileDescriptor} object is created to represent this file connection.
      *
-     * <a name="mode"><p> The <tt>mode</tt> argument specifies the access mode
+     * <p>The <a name="mode"><tt>mode</tt></a> argument specifies the access mode
      * in which the file is to be opened.  The permitted values and their
      * meanings are:
      *
-     * <blockquote><table summary="Access mode permitted values and meanings">
-     * <tr><th><p align="left">Value</p></th><th><p align="left">Meaning</p></th></tr>
+     * <table summary="Access mode permitted values and meanings">
+     * <tr><th align="left">Value</th><th align="left">Meaning</th></tr>
      * <tr><td valign="top"><tt>"r"</tt></td>
      *     <td> Open for reading only.  Invoking any of the <tt>write</tt>
      *     methods of the resulting object will cause an {@link
@@ -154,7 +156,7 @@
      *     <td> Open for reading and writing, as with <tt>"rw"</tt>, and also
      *     require that every update to the file's content be written
      *     synchronously to the underlying storage device. </td></tr>
-     * </table></blockquote>
+     * </table>
      *
      * The <tt>"rws"</tt> and <tt>"rwd"</tt> modes work much like the {@link
      * java.nio.channels.FileChannel#force(boolean) force(boolean)} method of
@@ -168,16 +170,16 @@
      * event of a system crash.  If the file does not reside on a local device
      * then no such guarantee is made.
      *
-     * <p> The <tt>"rwd"</tt> mode can be used to reduce the number of I/O
+     * <p>The <tt>"rwd"</tt> mode can be used to reduce the number of I/O
      * operations performed.  Using <tt>"rwd"</tt> only requires updates to the
      * file's content to be written to storage; using <tt>"rws"</tt> requires
      * updates to both the file's content and its metadata to be written, which
      * generally requires at least one more low-level I/O operation.
      *
-     * <p> If there is a security manager, its <code>checkRead</code> method is
-     * called with the pathname of the <code>file</code> argument as its
+     * <p>If there is a security manager, its {@code checkRead} method is
+     * called with the pathname of the {@code file} argument as its
      * argument to see if read access to the file is allowed.  If the mode
-     * allows writing, the security manager's <code>checkWrite</code> method is
+     * allows writing, the security manager's {@code checkWrite} method is
      * also called with the path argument to see if write access to the file is
      * allowed.
      *
@@ -195,9 +197,9 @@
      *            that name cannot be created, or if some other error occurs
      *            while opening or creating the file
      * @exception  SecurityException         if a security manager exists and its
-     *               <code>checkRead</code> method denies read access to the file
+     *               {@code checkRead} method denies read access to the file
      *               or the mode is "rw" and the security manager's
-     *               <code>checkWrite</code> method denies write access to the file
+     *               {@code checkWrite} method denies write access to the file
      * @see        java.lang.SecurityManager#checkRead(java.lang.String)
      * @see        java.lang.SecurityManager#checkWrite(java.lang.String)
      * @see        java.nio.channels.FileChannel#force(boolean)
@@ -257,14 +259,16 @@
 
     /**
      * Returns the opaque file descriptor object associated with this
-     * stream. </p>
+     * stream.
      *
      * @return     the file descriptor object associated with this stream.
      * @exception  IOException  if an I/O error occurs.
      * @see        java.io.FileDescriptor
      */
     public final FileDescriptor getFD() throws IOException {
-        if (fd != null) return fd;
+        if (fd != null) {
+            return fd;
+        }
         throw new IOException();
     }
 
@@ -273,7 +277,7 @@
      * object associated with this file.
      *
      * <p> The {@link java.nio.channels.FileChannel#position()
-     * </code>position<code>} of the returned channel will always be equal to
+     * position} of the returned channel will always be equal to
      * this object's file-pointer offset as returned by the {@link
      * #getFilePointer getFilePointer} method.  Changing this object's
      * file-pointer offset, whether explicitly or by reading or writing bytes,
@@ -297,15 +301,15 @@
 
     /**
      * Reads a byte of data from this file. The byte is returned as an
-     * integer in the range 0 to 255 (<code>0x00-0x0ff</code>). This
+     * integer in the range 0 to 255 ({@code 0x00-0x0ff}). This
      * method blocks if no input is yet available.
      * <p>
-     * Although <code>RandomAccessFile</code> is not a subclass of
-     * <code>InputStream</code>, this method behaves in exactly the same
+     * Although {@code RandomAccessFile} is not a subclass of
+     * {@code InputStream}, this method behaves in exactly the same
      * way as the {@link InputStream#read()} method of
-     * <code>InputStream</code>.
+     * {@code InputStream}.
      *
-     * @return     the next byte of data, or <code>-1</code> if the end of the
+     * @return     the next byte of data, or {@code -1} if the end of the
      *             file has been reached.
      * @exception  IOException  if an I/O error occurs. Not thrown if
      *                          end-of-file has been reached.
@@ -326,59 +330,59 @@
     }
 
     /**
-     * Reads up to <code>len</code> bytes of data from this file into an
+     * Reads up to {@code len} bytes of data from this file into an
      * array of bytes. This method blocks until at least one byte of input
      * is available.
      * <p>
-     * Although <code>RandomAccessFile</code> is not a subclass of
-     * <code>InputStream</code>, this method behaves in exactly the
+     * Although {@code RandomAccessFile} is not a subclass of
+     * {@code InputStream}, this method behaves in exactly the
      * same way as the {@link InputStream#read(byte[], int, int)} method of
-     * <code>InputStream</code>.
+     * {@code InputStream}.
      *
      * @param      b     the buffer into which the data is read.
-     * @param      off   the start offset in array <code>b</code>
+     * @param      off   the start offset in array {@code b}
      *                   at which the data is written.
      * @param      len   the maximum number of bytes read.
      * @return     the total number of bytes read into the buffer, or
-     *             <code>-1</code> if there is no more data because the end of
+     *             {@code -1} if there is no more data because the end of
      *             the file has been reached.
      * @exception  IOException If the first byte cannot be read for any reason
      * other than end of file, or if the random access file has been closed, or if
      * some other I/O error occurs.
-     * @exception  NullPointerException If <code>b</code> is <code>null</code>.
-     * @exception  IndexOutOfBoundsException If <code>off</code> is negative,
-     * <code>len</code> is negative, or <code>len</code> is greater than
-     * <code>b.length - off</code>
+     * @exception  NullPointerException If {@code b} is {@code null}.
+     * @exception  IndexOutOfBoundsException If {@code off} is negative,
+     * {@code len} is negative, or {@code len} is greater than
+     * {@code b.length - off}
      */
     public int read(byte b[], int off, int len) throws IOException {
         return readBytes(b, off, len);
     }
 
     /**
-     * Reads up to <code>b.length</code> bytes of data from this file
+     * Reads up to {@code b.length} bytes of data from this file
      * into an array of bytes. This method blocks until at least one byte
      * of input is available.
      * <p>
-     * Although <code>RandomAccessFile</code> is not a subclass of
-     * <code>InputStream</code>, this method behaves in exactly the
+     * Although {@code RandomAccessFile} is not a subclass of
+     * {@code InputStream}, this method behaves in exactly the
      * same way as the {@link InputStream#read(byte[])} method of
-     * <code>InputStream</code>.
+     * {@code InputStream}.
      *
      * @param      b   the buffer into which the data is read.
      * @return     the total number of bytes read into the buffer, or
-     *             <code>-1</code> if there is no more data because the end of
+     *             {@code -1} if there is no more data because the end of
      *             this file has been reached.
      * @exception  IOException If the first byte cannot be read for any reason
      * other than end of file, or if the random access file has been closed, or if
      * some other I/O error occurs.
-     * @exception  NullPointerException If <code>b</code> is <code>null</code>.
+     * @exception  NullPointerException If {@code b} is {@code null}.
      */
     public int read(byte b[]) throws IOException {
         return readBytes(b, 0, b.length);
     }
 
     /**
-     * Reads <code>b.length</code> bytes from this file into the byte
+     * Reads {@code b.length} bytes from this file into the byte
      * array, starting at the current file pointer. This method reads
      * repeatedly from the file until the requested number of bytes are
      * read. This method blocks until the requested number of bytes are
@@ -394,7 +398,7 @@
     }
 
     /**
-     * Reads exactly <code>len</code> bytes from this file into the byte
+     * Reads exactly {@code len} bytes from this file into the byte
      * array, starting at the current file pointer. This method reads
      * repeatedly from the file until the requested number of bytes are
      * read. This method blocks until the requested number of bytes are
@@ -418,15 +422,15 @@
     }
 
     /**
-     * Attempts to skip over <code>n</code> bytes of input discarding the
+     * Attempts to skip over {@code n} bytes of input discarding the
      * skipped bytes.
      * <p>
      *
      * This method may skip over some smaller number of bytes, possibly zero.
      * This may result from any of a number of conditions; reaching end of
-     * file before <code>n</code> bytes have been skipped is only one
-     * possibility. This method never throws an <code>EOFException</code>.
-     * The actual number of bytes skipped is returned.  If <code>n</code>
+     * file before {@code n} bytes have been skipped is only one
+     * possibility. This method never throws an {@code EOFException}.
+     * The actual number of bytes skipped is returned.  If {@code n}
      * is negative, no bytes are skipped.
      *
      * @param      n   the number of bytes to be skipped.
@@ -459,7 +463,7 @@
      * Writes the specified byte to this file. The write starts at
      * the current file pointer.
      *
-     * @param      b   the <code>byte</code> to be written.
+     * @param      b   the {@code byte} to be written.
      * @exception  IOException  if an I/O error occurs.
      */
     public void write(int b) throws IOException {
@@ -483,7 +487,7 @@
     }
 
     /**
-     * Writes <code>b.length</code> bytes from the specified byte array
+     * Writes {@code b.length} bytes from the specified byte array
      * to this file, starting at the current file pointer.
      *
      * @param      b   the data.
@@ -494,8 +498,8 @@
     }
 
     /**
-     * Writes <code>len</code> bytes from the specified byte array
-     * starting at offset <code>off</code> to this file.
+     * Writes {@code len} bytes from the specified byte array
+     * starting at offset {@code off} to this file.
      *
      * @param      b     the data.
      * @param      off   the start offset in the data.
@@ -534,8 +538,8 @@
      * @param      offset   the offset position, measured in bytes from the
      *                   beginning of the file, at which to set the file
      *                   pointer.
-     * @exception  IOException  if <code>pos</code> is less than
-     *                          <code>0</code> or if an I/O error occurs.
+     * @exception  IOException  if {@code pos} is less than
+     *                          {@code 0} or if an I/O error occurs.
      */
     public void seek(long offset) throws IOException {
         if (offset < 0) {
@@ -566,14 +570,14 @@
      * Sets the length of this file.
      *
      * <p> If the present length of the file as returned by the
-     * <code>length</code> method is greater than the <code>newLength</code>
+     * {@code length} method is greater than the {@code newLength}
      * argument then the file will be truncated.  In this case, if the file
-     * offset as returned by the <code>getFilePointer</code> method is greater
-     * than <code>newLength</code> then after this method returns the offset
-     * will be equal to <code>newLength</code>.
+     * offset as returned by the {@code getFilePointer} method is greater
+     * than {@code newLength} then after this method returns the offset
+     * will be equal to {@code newLength}.
      *
      * <p> If the present length of the file as returned by the
-     * <code>length</code> method is smaller than the <code>newLength</code>
+     * {@code length} method is smaller than the {@code newLength}
      * argument then the file will be extended.  In this case, the contents of
      * the extended portion of the file are not defined.
      *
@@ -637,14 +641,14 @@
     //
 
     /**
-     * Reads a <code>boolean</code> from this file. This method reads a
+     * Reads a {@code boolean} from this file. This method reads a
      * single byte from the file, starting at the current file pointer.
-     * A value of <code>0</code> represents
-     * <code>false</code>. Any other value represents <code>true</code>.
+     * A value of {@code 0} represents
+     * {@code false}. Any other value represents {@code true}.
      * This method blocks until the byte is read, the end of the stream
      * is detected, or an exception is thrown.
      *
-     * @return     the <code>boolean</code> value read.
+     * @return     the {@code boolean} value read.
      * @exception  EOFException  if this file has reached the end.
      * @exception  IOException   if an I/O error occurs.
      */
@@ -658,7 +662,7 @@
     /**
      * Reads a signed eight-bit value from this file. This method reads a
      * byte from the file, starting from the current file pointer.
-     * If the byte read is <code>b</code>, where
+     * If the byte read is {@code b}, where
      * <code>0&nbsp;&lt;=&nbsp;b&nbsp;&lt;=&nbsp;255</code>,
      * then the result is:
      * <blockquote><pre>
@@ -669,7 +673,7 @@
      * is detected, or an exception is thrown.
      *
      * @return     the next byte of this file as a signed eight-bit
-     *             <code>byte</code>.
+     *             {@code byte}.
      * @exception  EOFException  if this file has reached the end.
      * @exception  IOException   if an I/O error occurs.
      */
@@ -704,8 +708,8 @@
      * Reads a signed 16-bit number from this file. The method reads two
      * bytes from this file, starting at the current file pointer.
      * If the two bytes read, in order, are
-     * <code>b1</code> and <code>b2</code>, where each of the two values is
-     * between <code>0</code> and <code>255</code>, inclusive, then the
+     * {@code b1} and {@code b2}, where each of the two values is
+     * between {@code 0} and {@code 255}, inclusive, then the
      * result is equal to:
      * <blockquote><pre>
      *     (short)((b1 &lt;&lt; 8) | b2)
@@ -732,7 +736,7 @@
      * Reads an unsigned 16-bit number from this file. This method reads
      * two bytes from the file, starting at the current file pointer.
      * If the bytes read, in order, are
-     * <code>b1</code> and <code>b2</code>, where
+     * {@code b1} and {@code b2}, where
      * <code>0&nbsp;&lt;=&nbsp;b1, b2&nbsp;&lt;=&nbsp;255</code>,
      * then the result is equal to:
      * <blockquote><pre>
@@ -760,7 +764,7 @@
      * Reads a character from this file. This method reads two
      * bytes from the file, starting at the current file pointer.
      * If the bytes read, in order, are
-     * <code>b1</code> and <code>b2</code>, where
+     * {@code b1} and {@code b2}, where
      * <code>0&nbsp;&lt;=&nbsp;b1,&nbsp;b2&nbsp;&lt;=&nbsp;255</code>,
      * then the result is equal to:
      * <blockquote><pre>
@@ -771,7 +775,7 @@
      * stream is detected, or an exception is thrown.
      *
      * @return     the next two bytes of this file, interpreted as a
-     *                  <code>char</code>.
+     *                  {@code char}.
      * @exception  EOFException  if this file reaches the end before reading
      *               two bytes.
      * @exception  IOException   if an I/O error occurs.
@@ -787,8 +791,8 @@
     /**
      * Reads a signed 32-bit integer from this file. This method reads 4
      * bytes from the file, starting at the current file pointer.
-     * If the bytes read, in order, are <code>b1</code>,
-     * <code>b2</code>, <code>b3</code>, and <code>b4</code>, where
+     * If the bytes read, in order, are {@code b1},
+     * {@code b2}, {@code b3}, and {@code b4}, where
      * <code>0&nbsp;&lt;=&nbsp;b1, b2, b3, b4&nbsp;&lt;=&nbsp;255</code>,
      * then the result is equal to:
      * <blockquote><pre>
@@ -799,7 +803,7 @@
      * stream is detected, or an exception is thrown.
      *
      * @return     the next four bytes of this file, interpreted as an
-     *             <code>int</code>.
+     *             {@code int}.
      * @exception  EOFException  if this file reaches the end before reading
      *               four bytes.
      * @exception  IOException   if an I/O error occurs.
@@ -818,15 +822,15 @@
      * Reads a signed 64-bit integer from this file. This method reads eight
      * bytes from the file, starting at the current file pointer.
      * If the bytes read, in order, are
-     * <code>b1</code>, <code>b2</code>, <code>b3</code>,
-     * <code>b4</code>, <code>b5</code>, <code>b6</code>,
-     * <code>b7</code>, and <code>b8,</code> where:
+     * {@code b1}, {@code b2}, {@code b3},
+     * {@code b4}, {@code b5}, {@code b6},
+     * {@code b7}, and {@code b8,} where:
      * <blockquote><pre>
      *     0 &lt;= b1, b2, b3, b4, b5, b6, b7, b8 &lt;=255,
      * </pre></blockquote>
      * <p>
      * then the result is equal to:
-     * <p><blockquote><pre>
+     * <blockquote><pre>
      *     ((long)b1 &lt;&lt; 56) + ((long)b2 &lt;&lt; 48)
      *     + ((long)b3 &lt;&lt; 40) + ((long)b4 &lt;&lt; 32)
      *     + ((long)b5 &lt;&lt; 24) + ((long)b6 &lt;&lt; 16)
@@ -837,7 +841,7 @@
      * stream is detected, or an exception is thrown.
      *
      * @return     the next eight bytes of this file, interpreted as a
-     *             <code>long</code>.
+     *             {@code long}.
      * @exception  EOFException  if this file reaches the end before reading
      *               eight bytes.
      * @exception  IOException   if an I/O error occurs.
@@ -847,18 +851,18 @@
     }
 
     /**
-     * Reads a <code>float</code> from this file. This method reads an
-     * <code>int</code> value, starting at the current file pointer,
-     * as if by the <code>readInt</code> method
-     * and then converts that <code>int</code> to a <code>float</code>
-     * using the <code>intBitsToFloat</code> method in class
-     * <code>Float</code>.
+     * Reads a {@code float} from this file. This method reads an
+     * {@code int} value, starting at the current file pointer,
+     * as if by the {@code readInt} method
+     * and then converts that {@code int} to a {@code float}
+     * using the {@code intBitsToFloat} method in class
+     * {@code Float}.
      * <p>
      * This method blocks until the four bytes are read, the end of the
      * stream is detected, or an exception is thrown.
      *
      * @return     the next four bytes of this file, interpreted as a
-     *             <code>float</code>.
+     *             {@code float}.
      * @exception  EOFException  if this file reaches the end before reading
      *             four bytes.
      * @exception  IOException   if an I/O error occurs.
@@ -870,18 +874,18 @@
     }
 
     /**
-     * Reads a <code>double</code> from this file. This method reads a
-     * <code>long</code> value, starting at the current file pointer,
-     * as if by the <code>readLong</code> method
-     * and then converts that <code>long</code> to a <code>double</code>
-     * using the <code>longBitsToDouble</code> method in
-     * class <code>Double</code>.
+     * Reads a {@code double} from this file. This method reads a
+     * {@code long} value, starting at the current file pointer,
+     * as if by the {@code readLong} method
+     * and then converts that {@code long} to a {@code double}
+     * using the {@code longBitsToDouble} method in
+     * class {@code Double}.
      * <p>
      * This method blocks until the eight bytes are read, the end of the
      * stream is detected, or an exception is thrown.
      *
      * @return     the next eight bytes of this file, interpreted as a
-     *             <code>double</code>.
+     *             {@code double}.
      * @exception  EOFException  if this file reaches the end before reading
      *             eight bytes.
      * @exception  IOException   if an I/O error occurs.
@@ -902,7 +906,7 @@
      * therefore, support the full Unicode character set.
      *
      * <p> A line of text is terminated by a carriage-return character
-     * (<code>'&#92;r'</code>), a newline character (<code>'&#92;n'</code>), a
+     * ({@code '\u005Cr'}), a newline character ({@code '\u005Cn'}), a
      * carriage-return character immediately followed by a newline character,
      * or the end of the file.  Line-terminating characters are discarded and
      * are not included as part of the string returned.
@@ -954,7 +958,7 @@
      * <p>
      * The first two bytes are read, starting from the current file
      * pointer, as if by
-     * <code>readUnsignedShort</code>. This value gives the number of
+     * {@code readUnsignedShort}. This value gives the number of
      * following bytes that are in the encoded string, not
      * the length of the resulting string. The following bytes are then
      * interpreted as bytes encoding characters in the modified UTF-8 format
@@ -976,13 +980,13 @@
     }
 
     /**
-     * Writes a <code>boolean</code> to the file as a one-byte value. The
-     * value <code>true</code> is written out as the value
-     * <code>(byte)1</code>; the value <code>false</code> is written out
-     * as the value <code>(byte)0</code>. The write starts at
+     * Writes a {@code boolean} to the file as a one-byte value. The
+     * value {@code true} is written out as the value
+     * {@code (byte)1}; the value {@code false} is written out
+     * as the value {@code (byte)0}. The write starts at
      * the current position of the file pointer.
      *
-     * @param      v   a <code>boolean</code> value to be written.
+     * @param      v   a {@code boolean} value to be written.
      * @exception  IOException  if an I/O error occurs.
      */
     public final void writeBoolean(boolean v) throws IOException {
@@ -991,10 +995,10 @@
     }
 
     /**
-     * Writes a <code>byte</code> to the file as a one-byte value. The
+     * Writes a {@code byte} to the file as a one-byte value. The
      * write starts at the current position of the file pointer.
      *
-     * @param      v   a <code>byte</code> value to be written.
+     * @param      v   a {@code byte} value to be written.
      * @exception  IOException  if an I/O error occurs.
      */
     public final void writeByte(int v) throws IOException {
@@ -1003,10 +1007,10 @@
     }
 
     /**
-     * Writes a <code>short</code> to the file as two bytes, high byte first.
+     * Writes a {@code short} to the file as two bytes, high byte first.
      * The write starts at the current position of the file pointer.
      *
-     * @param      v   a <code>short</code> to be written.
+     * @param      v   a {@code short} to be written.
      * @exception  IOException  if an I/O error occurs.
      */
     public final void writeShort(int v) throws IOException {
@@ -1016,11 +1020,11 @@
     }
 
     /**
-     * Writes a <code>char</code> to the file as a two-byte value, high
+     * Writes a {@code char} to the file as a two-byte value, high
      * byte first. The write starts at the current position of the
      * file pointer.
      *
-     * @param      v   a <code>char</code> value to be written.
+     * @param      v   a {@code char} value to be written.
      * @exception  IOException  if an I/O error occurs.
      */
     public final void writeChar(int v) throws IOException {
@@ -1030,10 +1034,10 @@
     }
 
     /**
-     * Writes an <code>int</code> to the file as four bytes, high byte first.
+     * Writes an {@code int} to the file as four bytes, high byte first.
      * The write starts at the current position of the file pointer.
      *
-     * @param      v   an <code>int</code> to be written.
+     * @param      v   an {@code int} to be written.
      * @exception  IOException  if an I/O error occurs.
      */
     public final void writeInt(int v) throws IOException {
@@ -1045,10 +1049,10 @@
     }
 
     /**
-     * Writes a <code>long</code> to the file as eight bytes, high byte first.
+     * Writes a {@code long} to the file as eight bytes, high byte first.
      * The write starts at the current position of the file pointer.
      *
-     * @param      v   a <code>long</code> to be written.
+     * @param      v   a {@code long} to be written.
      * @exception  IOException  if an I/O error occurs.
      */
     public final void writeLong(long v) throws IOException {
@@ -1064,13 +1068,13 @@
     }
 
     /**
-     * Converts the float argument to an <code>int</code> using the
-     * <code>floatToIntBits</code> method in class <code>Float</code>,
-     * and then writes that <code>int</code> value to the file as a
+     * Converts the float argument to an {@code int} using the
+     * {@code floatToIntBits} method in class {@code Float},
+     * and then writes that {@code int} value to the file as a
      * four-byte quantity, high byte first. The write starts at the
      * current position of the file pointer.
      *
-     * @param      v   a <code>float</code> value to be written.
+     * @param      v   a {@code float} value to be written.
      * @exception  IOException  if an I/O error occurs.
      * @see        java.lang.Float#floatToIntBits(float)
      */
@@ -1079,13 +1083,13 @@
     }
 
     /**
-     * Converts the double argument to a <code>long</code> using the
-     * <code>doubleToLongBits</code> method in class <code>Double</code>,
-     * and then writes that <code>long</code> value to the file as an
+     * Converts the double argument to a {@code long} using the
+     * {@code doubleToLongBits} method in class {@code Double},
+     * and then writes that {@code long} value to the file as an
      * eight-byte quantity, high byte first. The write starts at the current
      * position of the file pointer.
      *
-     * @param      v   a <code>double</code> value to be written.
+     * @param      v   a {@code double} value to be written.
      * @exception  IOException  if an I/O error occurs.
      * @see        java.lang.Double#doubleToLongBits(double)
      */
@@ -1102,6 +1106,7 @@
      * @param      s   a string of bytes to be written.
      * @exception  IOException  if an I/O error occurs.
      */
+    @SuppressWarnings("deprecation")
     public final void writeBytes(String s) throws IOException {
         int len = s.length();
         byte[] b = new byte[len];
@@ -1112,10 +1117,10 @@
     /**
      * Writes a string to the file as a sequence of characters. Each
      * character is written to the data output stream as if by the
-     * <code>writeChar</code> method. The write starts at the current
+     * {@code writeChar} method. The write starts at the current
      * position of the file pointer.
      *
-     * @param      s   a <code>String</code> value to be written.
+     * @param      s   a {@code String} value to be written.
      * @exception  IOException  if an I/O error occurs.
      * @see        java.io.RandomAccessFile#writeChar(int)
      */
@@ -1139,7 +1144,7 @@
      * <p>
      * First, two bytes are written to the file, starting at the
      * current file pointer, as if by the
-     * <code>writeShort</code> method giving the number of bytes to
+     * {@code writeShort} method giving the number of bytes to
      * follow. This value is the number of bytes actually written out,
      * not the length of the string. Following the length, each character
      * of the string is output, in sequence, using the modified UTF-8 encoding
diff --git a/ojluni/src/main/java/java/net/AbstractPlainSocketImpl.java b/ojluni/src/main/java/java/net/AbstractPlainSocketImpl.java
index daa7b92..6f9f7dc 100644
--- a/ojluni/src/main/java/java/net/AbstractPlainSocketImpl.java
+++ b/ojluni/src/main/java/java/net/AbstractPlainSocketImpl.java
@@ -303,11 +303,16 @@
             ret = socketGetOption(opt, null);
             return new Integer(ret);
         case IP_TOS:
-            ret = socketGetOption(opt, null);
-            if (ret == -1) { // ipv6 tos
-                return new Integer(trafficClass);
-            } else {
-                return new Integer(ret);
+            try {
+                ret = socketGetOption(opt, null);
+                if (ret == -1) { // ipv6 tos
+                    return trafficClass;
+                } else {
+                    return ret;
+                }
+            } catch (SocketException se) {
+                // TODO - should make better effort to read TOS or TCLASS
+                return trafficClass; // ipv6 tos
             }
         case SO_KEEPALIVE:
             ret = socketGetOption(opt, null);
diff --git a/ojluni/src/main/java/java/net/DatagramSocket.java b/ojluni/src/main/java/java/net/DatagramSocket.java
index a6f09fa..6f2c95c 100755
--- a/ojluni/src/main/java/java/net/DatagramSocket.java
+++ b/ojluni/src/main/java/java/net/DatagramSocket.java
@@ -1219,7 +1219,14 @@
 
         if (isClosed())
             throw new SocketException("Socket is closed");
-        getImpl().setOption(SocketOptions.IP_TOS, new Integer(tc));
+        try {
+            getImpl().setOption(SocketOptions.IP_TOS, tc);
+        } catch (SocketException se) {
+            // not supported if socket already connected
+            // Solaris returns error in such cases
+            if(!isConnected())
+                throw se;
+        }
     }
 
     /**
diff --git a/ojluni/src/main/java/java/net/PlainDatagramSocketImpl.java b/ojluni/src/main/java/java/net/PlainDatagramSocketImpl.java
index ae1e3a5..ea45500 100644
--- a/ojluni/src/main/java/java/net/PlainDatagramSocketImpl.java
+++ b/ojluni/src/main/java/java/net/PlainDatagramSocketImpl.java
@@ -69,6 +69,15 @@
         return (T)flow;
     }
 
+    protected void socketSetOption(int opt, Object val) throws SocketException {
+        try {
+            socketSetOption0(opt, val);
+        } catch (SocketException se) {
+            if (!connected)
+                throw se;
+        }
+    }
+
     protected synchronized native void bind0(int lport, InetAddress laddr)
         throws SocketException;
 
@@ -99,7 +108,7 @@
 
     protected native void datagramSocketClose();
 
-    protected native void socketSetOption(int opt, Object val)
+    protected native void socketSetOption0(int opt, Object val)
         throws SocketException;
 
     protected native Object socketGetOption(int opt) throws SocketException;
diff --git a/ojluni/src/main/java/java/net/PlainSocketImpl.java b/ojluni/src/main/java/java/net/PlainSocketImpl.java
index 1409c7b..e2cf44e 100644
--- a/ojluni/src/main/java/java/net/PlainSocketImpl.java
+++ b/ojluni/src/main/java/java/net/PlainSocketImpl.java
@@ -82,6 +82,15 @@
         return (T)flow;
     }
 
+    protected void socketSetOption(int opt, boolean b, Object val) throws SocketException {
+        try {
+            socketSetOption0(opt, b, val);
+        } catch (SocketException se) {
+            if (socket == null || !socket.isConnected())
+                throw se;
+        }
+    }
+
     native void socketCreate(boolean isServer) throws IOException;
 
     native void socketConnect(InetAddress address, int port, int timeout)
@@ -100,7 +109,7 @@
 
     native void socketShutdown(int howto) throws IOException;
 
-    native void socketSetOption(int cmd, boolean on, Object value)
+    native void socketSetOption0(int cmd, boolean on, Object value)
         throws SocketException;
 
     native int socketGetOption(int opt, Object iaContainerObj) throws SocketException;
diff --git a/ojluni/src/main/java/java/net/Socket.java b/ojluni/src/main/java/java/net/Socket.java
index 54f599f..28cd8c4 100644
--- a/ojluni/src/main/java/java/net/Socket.java
+++ b/ojluni/src/main/java/java/net/Socket.java
@@ -1405,7 +1405,14 @@
 
         if (isClosed())
             throw new SocketException("Socket is closed");
-        getImpl().setOption(SocketOptions.IP_TOS, new Integer(tc));
+        try {
+            getImpl().setOption(SocketOptions.IP_TOS, tc);
+        } catch (SocketException se) {
+            // not supported if socket already connected
+            // Solaris returns error in such cases
+            if(!isConnected())
+                throw se;
+        }
     }
 
     /**
diff --git a/ojluni/src/main/java/java/security/DomainLoadStoreParameter.java b/ojluni/src/main/java/java/security/DomainLoadStoreParameter.java
new file mode 100644
index 0000000..bc96975
--- /dev/null
+++ b/ojluni/src/main/java/java/security/DomainLoadStoreParameter.java
@@ -0,0 +1,171 @@
+/*
+ * Copyright (c) 2013, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package java.security;
+
+import java.net.URI;
+import java.util.*;
+import static java.security.KeyStore.*;
+
+/**
+ * Configuration data that specifies the keystores in a keystore domain.
+ * A keystore domain is a collection of keystores that are presented as a
+ * single logical keystore. The configuration data is used during
+ * {@code KeyStore}
+ * {@link KeyStore#load(KeyStore.LoadStoreParameter) load} and
+ * {@link KeyStore#store(KeyStore.LoadStoreParameter) store} operations.
+ * <p>
+ * The following syntax is supported for configuration data:
+ * <pre>{@code
+ *     domain <domainName> [<property> ...] {
+ *         keystore <keystoreName> [<property> ...] ;
+ *         ...
+ *     };
+ *     ...
+ * }</pre>
+ * where {@code domainName} and {@code keystoreName} are identifiers
+ * and {@code property} is a key/value pairing. The key and value are
+ * separated by an 'equals' symbol and the value is enclosed in double
+ * quotes. A property value may be either a printable string or a binary
+ * string of colon-separated pairs of hexadecimal digits. Multi-valued
+ * properties are represented as a comma-separated list of values,
+ * enclosed in square brackets.
+ * See {@link Arrays#toString(java.lang.Object[])}.
+ * <p>
+ * To ensure that keystore entries are uniquely identified, each
+ * entry's alias is prefixed by its {@code keystoreName} followed
+ * by the entry name separator and each {@code keystoreName} must be
+ * unique within its domain. Entry name prefixes are omitted when
+ * storing a keystore.
+ * <p>
+ * Properties are context-sensitive: properties that apply to
+ * all the keystores in a domain are located in the domain clause,
+ * and properties that apply only to a specific keystore are located
+ * in that keystore's clause.
+ * Unless otherwise specified, a property in a keystore clause overrides
+ * a property of the same name in the domain clause. All property names
+ * are case-insensitive. The following properties are supported:
+ * <dl>
+ * <dt> {@code keystoreType="<type>"} </dt>
+ *     <dd> The keystore type. </dd>
+ * <dt> {@code keystoreURI="<url>"} </dt>
+ *     <dd> The keystore location. </dd>
+ * <dt> {@code keystoreProviderName="<name>"} </dt>
+ *     <dd> The name of the keystore's JCE provider. </dd>
+ * <dt> {@code keystorePasswordEnv="<environment-variable>"} </dt>
+ *     <dd> The environment variable that stores a keystore password.
+ *          Alternatively, passwords may be supplied to the constructor
+ *          method in a {@code Map<String, ProtectionParameter>}. </dd>
+ * <dt> {@code entryNameSeparator="<separator>"} </dt>
+ *     <dd> The separator between a keystore name prefix and an entry name.
+ *          When specified, it applies to all the entries in a domain.
+ *          Its default value is a space. </dd>
+ * </dl>
+ * <p>
+ * For example, configuration data for a simple keystore domain
+ * comprising three keystores is shown below:
+ * <pre>
+ *
+ * domain app1 {
+ *     keystore app1-truststore
+ *         keystoreURI="file:///app1/etc/truststore.jks";
+ *
+ *     keystore system-truststore
+ *         keystoreURI="${java.home}/lib/security/cacerts";
+ *
+ *     keystore app1-keystore
+ *         keystoreType="PKCS12"
+ *         keystoreURI="file:///app1/etc/keystore.p12";
+ * };
+ *
+ * </pre>
+ * @since 1.8
+ */
+public final class DomainLoadStoreParameter implements LoadStoreParameter {
+
+    private final URI configuration;
+    private final Map<String,ProtectionParameter> protectionParams;
+
+    /**
+     * Constructs a DomainLoadStoreParameter for a keystore domain with
+     * the parameters used to protect keystore data.
+     *
+     * @param configuration identifier for the domain configuration data.
+     *     The name of the target domain should be specified in the
+     *     {@code java.net.URI} fragment component when it is necessary
+     *     to distinguish between several domain configurations at the
+     *     same location.
+     *
+     * @param protectionParams the map from keystore name to the parameter
+     *     used to protect keystore data.
+     *     A {@code java.util.Collections.EMPTY_MAP} should be used
+     *     when protection parameters are not required or when they have
+     *     been specified by properties in the domain configuration data.
+     *     It is cloned to prevent subsequent modification.
+     *
+     * @exception NullPointerException if {@code configuration} or
+     *     {@code protectionParams} is {@code null}
+     */
+    public DomainLoadStoreParameter(URI configuration,
+        Map<String,ProtectionParameter> protectionParams) {
+        if (configuration == null || protectionParams == null) {
+            throw new NullPointerException("invalid null input");
+        }
+        this.configuration = configuration;
+        this.protectionParams =
+            Collections.unmodifiableMap(new HashMap<>(protectionParams));
+    }
+
+    /**
+     * Gets the identifier for the domain configuration data.
+     *
+     * @return the identifier for the configuration data
+     */
+    public URI getConfiguration() {
+        return configuration;
+    }
+
+    /**
+     * Gets the keystore protection parameters for keystores in this
+     * domain.
+     *
+     * @return an unmodifiable map of keystore names to protection
+     *     parameters
+     */
+    public Map<String,ProtectionParameter> getProtectionParams() {
+        return protectionParams;
+    }
+
+    /**
+     * Gets the keystore protection parameters for this domain.
+     * Keystore domains do not support a protection parameter.
+     *
+     * @return always returns {@code null}
+     */
+    @Override
+    public KeyStore.ProtectionParameter getProtectionParameter() {
+        return null;
+    }
+}
diff --git a/ojluni/src/main/java/java/security/PKCS12Attribute.java b/ojluni/src/main/java/java/security/PKCS12Attribute.java
new file mode 100644
index 0000000..e389862
--- /dev/null
+++ b/ojluni/src/main/java/java/security/PKCS12Attribute.java
@@ -0,0 +1,285 @@
+/*
+ * Copyright (c) 2013, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package java.security;
+
+import java.io.IOException;
+import java.math.BigInteger;
+import java.util.Arrays;
+import java.util.regex.Pattern;
+import sun.security.util.*;
+
+/**
+ * An attribute associated with a PKCS12 keystore entry.
+ * The attribute name is an ASN.1 Object Identifier and the attribute
+ * value is a set of ASN.1 types.
+ *
+ * @since 1.8
+ */
+public final class PKCS12Attribute implements KeyStore.Entry.Attribute {
+
+    private static final Pattern COLON_SEPARATED_HEX_PAIRS =
+        Pattern.compile("^[0-9a-fA-F]{2}(:[0-9a-fA-F]{2})+$");
+    private String name;
+    private String value;
+    private byte[] encoded;
+    private int hashValue = -1;
+
+    /**
+     * Constructs a PKCS12 attribute from its name and value.
+     * The name is an ASN.1 Object Identifier represented as a list of
+     * dot-separated integers.
+     * A string value is represented as the string itself.
+     * A binary value is represented as a string of colon-separated
+     * pairs of hexadecimal digits.
+     * Multi-valued attributes are represented as a comma-separated
+     * list of values, enclosed in square brackets. See
+     * {@link Arrays#toString(java.lang.Object[])}.
+     * <p>
+     * A string value will be DER-encoded as an ASN.1 UTF8String and a
+     * binary value will be DER-encoded as an ASN.1 Octet String.
+     *
+     * @param name the attribute's identifier
+     * @param value the attribute's value
+     *
+     * @exception NullPointerException if {@code name} or {@code value}
+     *     is {@code null}
+     * @exception IllegalArgumentException if {@code name} or
+     *     {@code value} is incorrectly formatted
+     */
+    public PKCS12Attribute(String name, String value) {
+        if (name == null || value == null) {
+            throw new NullPointerException();
+        }
+        // Validate name
+        ObjectIdentifier type;
+        try {
+            type = new ObjectIdentifier(name);
+        } catch (IOException e) {
+            throw new IllegalArgumentException("Incorrect format: name", e);
+        }
+        this.name = name;
+
+        // Validate value
+        int length = value.length();
+        String[] values;
+        if (value.charAt(0) == '[' && value.charAt(length - 1) == ']') {
+            values = value.substring(1, length - 1).split(", ");
+        } else {
+            values = new String[]{ value };
+        }
+        this.value = value;
+
+        try {
+            this.encoded = encode(type, values);
+        } catch (IOException e) {
+            throw new IllegalArgumentException("Incorrect format: value", e);
+        }
+    }
+
+    /**
+     * Constructs a PKCS12 attribute from its ASN.1 DER encoding.
+     * The DER encoding is specified by the following ASN.1 definition:
+     * <pre>
+     *
+     * Attribute ::= SEQUENCE {
+     *     type   AttributeType,
+     *     values SET OF AttributeValue
+     * }
+     * AttributeType ::= OBJECT IDENTIFIER
+     * AttributeValue ::= ANY defined by type
+     *
+     * </pre>
+     *
+     * @param encoded the attribute's ASN.1 DER encoding. It is cloned
+     *     to prevent subsequent modificaion.
+     *
+     * @exception NullPointerException if {@code encoded} is
+     *     {@code null}
+     * @exception IllegalArgumentException if {@code encoded} is
+     *     incorrectly formatted
+     */
+    public PKCS12Attribute(byte[] encoded) {
+        if (encoded == null) {
+            throw new NullPointerException();
+        }
+        this.encoded = encoded.clone();
+
+        try {
+            parse(encoded);
+        } catch (IOException e) {
+            throw new IllegalArgumentException("Incorrect format: encoded", e);
+        }
+    }
+
+    /**
+     * Returns the attribute's ASN.1 Object Identifier represented as a
+     * list of dot-separated integers.
+     *
+     * @return the attribute's identifier
+     */
+    @Override
+    public String getName() {
+        return name;
+    }
+
+    /**
+     * Returns the attribute's ASN.1 DER-encoded value as a string.
+     * An ASN.1 DER-encoded value is returned in one of the following
+     * {@code String} formats:
+     * <ul>
+     * <li> the DER encoding of a basic ASN.1 type that has a natural
+     *      string representation is returned as the string itself.
+     *      Such types are currently limited to BOOLEAN, INTEGER,
+     *      OBJECT IDENTIFIER, UTCTime, GeneralizedTime and the
+     *      following six ASN.1 string types: UTF8String,
+     *      PrintableString, T61String, IA5String, BMPString and
+     *      GeneralString.
+     * <li> the DER encoding of any other ASN.1 type is not decoded but
+     *      returned as a binary string of colon-separated pairs of
+     *      hexadecimal digits.
+     * </ul>
+     * Multi-valued attributes are represented as a comma-separated
+     * list of values, enclosed in square brackets. See
+     * {@link Arrays#toString(java.lang.Object[])}.
+     *
+     * @return the attribute value's string encoding
+     */
+    @Override
+    public String getValue() {
+        return value;
+    }
+
+    /**
+     * Returns the attribute's ASN.1 DER encoding.
+     *
+     * @return a clone of the attribute's DER encoding
+     */
+    public byte[] getEncoded() {
+        return encoded.clone();
+    }
+
+    /**
+     * Compares this {@code PKCS12Attribute} and a specified object for
+     * equality.
+     *
+     * @param obj the comparison object
+     *
+     * @return true if {@code obj} is a {@code PKCS12Attribute} and
+     * their DER encodings are equal.
+     */
+    @Override
+    public boolean equals(Object obj) {
+        if (this == obj) {
+            return true;
+        }
+        if (!(obj instanceof PKCS12Attribute)) {
+            return false;
+        }
+        return Arrays.equals(encoded, ((PKCS12Attribute) obj).getEncoded());
+    }
+
+    /**
+     * Returns the hashcode for this {@code PKCS12Attribute}.
+     * The hash code is computed from its DER encoding.
+     *
+     * @return the hash code
+     */
+    @Override
+    public int hashCode() {
+        if (hashValue == -1) {
+            Arrays.hashCode(encoded);
+        }
+        return hashValue;
+    }
+
+    /**
+     * Returns a string representation of this {@code PKCS12Attribute}.
+     *
+     * @return a name/value pair separated by an 'equals' symbol
+     */
+    @Override
+    public String toString() {
+        return (name + "=" + value);
+    }
+
+    private byte[] encode(ObjectIdentifier type, String[] values)
+            throws IOException {
+        DerOutputStream attribute = new DerOutputStream();
+        attribute.putOID(type);
+        DerOutputStream attrContent = new DerOutputStream();
+        for (String value : values) {
+            if (COLON_SEPARATED_HEX_PAIRS.matcher(value).matches()) {
+                byte[] bytes =
+                    new BigInteger(value.replace(":", ""), 16).toByteArray();
+                if (bytes[0] == 0) {
+                    bytes = Arrays.copyOfRange(bytes, 1, bytes.length);
+                }
+                attrContent.putOctetString(bytes);
+            } else {
+                attrContent.putUTF8String(value);
+            }
+        }
+        attribute.write(DerValue.tag_Set, attrContent);
+        DerOutputStream attributeValue = new DerOutputStream();
+        attributeValue.write(DerValue.tag_Sequence, attribute);
+
+        return attributeValue.toByteArray();
+    }
+
+    private void parse(byte[] encoded) throws IOException {
+        DerInputStream attributeValue = new DerInputStream(encoded);
+        DerValue[] attrSeq = attributeValue.getSequence(2);
+        ObjectIdentifier type = attrSeq[0].getOID();
+        DerInputStream attrContent =
+            new DerInputStream(attrSeq[1].toByteArray());
+        DerValue[] attrValueSet = attrContent.getSet(1);
+        String[] values = new String[attrValueSet.length];
+        String printableString;
+        for (int i = 0; i < attrValueSet.length; i++) {
+            if (attrValueSet[i].tag == DerValue.tag_OctetString) {
+                values[i] = Debug.toString(attrValueSet[i].getOctetString());
+            } else if ((printableString = attrValueSet[i].getAsString())
+                != null) {
+                values[i] = printableString;
+            } else if (attrValueSet[i].tag == DerValue.tag_ObjectId) {
+                values[i] = attrValueSet[i].getOID().toString();
+            } else if (attrValueSet[i].tag == DerValue.tag_GeneralizedTime) {
+                values[i] = attrValueSet[i].getGeneralizedTime().toString();
+            } else if (attrValueSet[i].tag == DerValue.tag_UtcTime) {
+                values[i] = attrValueSet[i].getUTCTime().toString();
+            } else if (attrValueSet[i].tag == DerValue.tag_Integer) {
+                values[i] = attrValueSet[i].getBigInteger().toString();
+            } else if (attrValueSet[i].tag == DerValue.tag_Boolean) {
+                values[i] = String.valueOf(attrValueSet[i].getBoolean());
+            } else {
+                values[i] = Debug.toString(attrValueSet[i].getDataBytes());
+            }
+        }
+
+        this.name = type.toString();
+        this.value = values.length == 1 ? values[0] : Arrays.toString(values);
+    }
+}
diff --git a/ojluni/src/main/java/java/security/PrivilegedActionException.java b/ojluni/src/main/java/java/security/PrivilegedActionException.java
index af89fb5..83d855a 100644
--- a/ojluni/src/main/java/java/security/PrivilegedActionException.java
+++ b/ojluni/src/main/java/java/security/PrivilegedActionException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1998, 2001, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1998, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -27,11 +27,81 @@
 
 /**
  * Legacy security code; do not use.
+ *
+ * This exception is thrown by
+ * {@code doPrivileged(PrivilegedExceptionAction)} and
+ * {@code doPrivileged(PrivilegedExceptionAction,
+ * AccessControlContext context)} to indicate
+ * that the action being performed threw a checked exception.  The exception
+ * thrown by the action can be obtained by calling the
+ * {@code getException} method.  In effect, an
+ * {@code PrivilegedActionException} is a "wrapper"
+ * for an exception thrown by a privileged action.
+ *
+ * <p>As of release 1.4, this exception has been retrofitted to conform to
+ * the general purpose exception-chaining mechanism.  The "exception thrown
+ * by the privileged computation" that is provided at construction time and
+ * accessed via the {@link #getException()} method is now known as the
+ * <i>cause</i>, and may be accessed via the {@link Throwable#getCause()}
+ * method, as well as the aforementioned "legacy method."
+ *
+ * @see PrivilegedExceptionAction
+ * @see AccessController#doPrivileged(PrivilegedExceptionAction)
+ * @see AccessController#doPrivileged(PrivilegedExceptionAction,AccessControlContext)
  */
-
 public class PrivilegedActionException extends Exception {
+    // use serialVersionUID from JDK 1.2.2 for interoperability
+    private static final long serialVersionUID = 4724086851538908602L;
 
-    public PrivilegedActionException(Exception exception) { super(exception); }
+    /**
+     * @serial
+     */
+    private Exception exception;
 
-    public Exception getException() { return null; }
+    /**
+     * Constructs a new PrivilegedActionException &quot;wrapping&quot;
+     * the specific Exception.
+     *
+     * @param exception The exception thrown
+     */
+    public PrivilegedActionException(Exception exception) {
+        super((Throwable)null);  // Disallow initCause
+        this.exception = exception;
+    }
+
+    /**
+     * Returns the exception thrown by the privileged computation that
+     * resulted in this {@code PrivilegedActionException}.
+     *
+     * <p>This method predates the general-purpose exception chaining facility.
+     * The {@link Throwable#getCause()} method is now the preferred means of
+     * obtaining this information.
+     *
+     * @return the exception thrown by the privileged computation that
+     *         resulted in this {@code PrivilegedActionException}.
+     * @see PrivilegedExceptionAction
+     * @see AccessController#doPrivileged(PrivilegedExceptionAction)
+     * @see AccessController#doPrivileged(PrivilegedExceptionAction,
+     *                                            AccessControlContext)
+     */
+    public Exception getException() {
+        return exception;
+    }
+
+    /**
+     * Returns the cause of this exception (the exception thrown by
+     * the privileged computation that resulted in this
+     * {@code PrivilegedActionException}).
+     *
+     * @return  the cause of this exception.
+     * @since   1.4
+     */
+    public Throwable getCause() {
+        return exception;
+    }
+
+    public String toString() {
+        String s = getClass().getName();
+        return (exception != null) ? (s + ": " + exception.toString()) : s;
+    }
 }
diff --git a/ojluni/src/main/java/java/security/Provider.java b/ojluni/src/main/java/java/security/Provider.java
index 81ae9f3..a932893 100644
--- a/ojluni/src/main/java/java/security/Provider.java
+++ b/ojluni/src/main/java/java/security/Provider.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2014 The Android Open Source Project
- * Copyright (c) 1996, 2011, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2014, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -35,8 +35,9 @@
 import java.lang.ref.*;
 import java.lang.reflect.*;
 import java.security.Security;
-import java.security.cert.CertStoreParameters;
 import java.util.function.BiConsumer;
+import java.util.function.BiFunction;
+import java.util.function.Function;
 
 /**
  * This class represents a "provider" for the
@@ -69,20 +70,21 @@
  * security token. A {@link ProviderException} should be used to indicate
  * such errors.
  *
- * <p>The service type <code>Provider</code> is reserved for use by the
+ * <p>The service type {@code Provider} is reserved for use by the
  * security framework. Services of this type cannot be added, removed,
  * or modified by applications.
  * The following attributes are automatically placed in each Provider object:
  * <table cellspacing=4>
+ * <caption><b>Attributes Automatically Placed in a Provider Object</b></caption>
  * <tr><th>Name</th><th>Value</th>
- * <tr><td><code>Provider.id name</code></td>
-  *    <td><code>String.valueOf(provider.getName())</code></td>
- * <tr><td><code>Provider.id version</code></td>
- *     <td><code>String.valueOf(provider.getVersion())</code></td>
- * <tr><td><code>Provider.id info</code></td>
-       <td><code>String.valueOf(provider.getInfo())</code></td>
- * <tr><td><code>Provider.id className</code></td>
- *     <td><code>provider.getClass().getName()</code></td>
+ * <tr><td>{@code Provider.id name}</td>
+  *    <td>{@code String.valueOf(provider.getName())}</td>
+ * <tr><td>{@code Provider.id version}</td>
+ *     <td>{@code String.valueOf(provider.getVersion())}</td>
+ * <tr><td>{@code Provider.id info}</td>
+       <td>{@code String.valueOf(provider.getInfo())}</td>
+ * <tr><td>{@code Provider.id className}</td>
+ *     <td>{@code provider.getClass().getName()}</td>
  * </table>
  *
  * @author Benjamin Renaud
@@ -193,23 +195,19 @@
      * Clears this provider so that it no longer contains the properties
      * used to look up facilities implemented by the provider.
      *
-     * <p>First, if there is a security manager, its
-     * <code>checkSecurityAccess</code> method is called with the string
-     * <code>"clearProviderProperties."+name</code> (where <code>name</code>
-     * is the provider name) to see if it's ok to clear this provider.
-     * If the default implementation of <code>checkSecurityAccess</code>
-     * is used (that is, that method is not overriden), then this results in
-     * a call to the security manager's <code>checkPermission</code> method
-     * with a <code>SecurityPermission("clearProviderProperties."+name)</code>
-     * permission.
+     * <p>If a security manager is enabled, its {@code checkSecurityAccess}
+     * method is called with the string {@code "clearProviderProperties."+name}
+     * (where {@code name} is the provider name) to see if it's ok to clear
+     * this provider.
      *
      * @throws  SecurityException
-     *          if a security manager exists and its <code>{@link
-     *          java.lang.SecurityManager#checkSecurityAccess}</code> method
+     *          if a security manager exists and its {@link
+     *          java.lang.SecurityManager#checkSecurityAccess} method
      *          denies access to clear this provider
      *
      * @since 1.2
      */
+    @Override
     public synchronized void clear() {
         check("clearProviderProperties."+name);
         if (debug != null) {
@@ -226,6 +224,7 @@
      *               input stream.
      * @see java.util.Properties#load
      */
+    @Override
     public synchronized void load(InputStream inStream) throws IOException {
         check("putProviderProperty."+name);
         if (debug != null) {
@@ -243,6 +242,7 @@
      *
      * @since 1.2
      */
+    @Override
     public synchronized void putAll(Map<?,?> t) {
         check("putProviderProperty."+name);
         if (debug != null) {
@@ -258,6 +258,7 @@
      * @see   java.util.Map.Entry
      * @since 1.2
      */
+    @Override
     public synchronized Set<Map.Entry<Object,Object>> entrySet() {
         checkInitialized();
         if (entrySet == null) {
@@ -284,6 +285,7 @@
      *
      * @since 1.2
      */
+    @Override
     public Set<Object> keySet() {
         checkInitialized();
         return Collections.unmodifiableSet(super.keySet());
@@ -295,39 +297,29 @@
      *
      * @since 1.2
      */
+    @Override
     public Collection<Object> values() {
         checkInitialized();
         return Collections.unmodifiableCollection(super.values());
     }
 
     /**
-     * Sets the <code>key</code> property to have the specified
-     * <code>value</code>.
+     * Sets the {@code key} property to have the specified
+     * {@code value}.
      *
-     * <p>First, if there is a security manager, its
-     * <code>checkSecurityAccess</code> method is called with the string
-     * <code>"putProviderProperty."+name</code>, where <code>name</code> is the
-     * provider name, to see if it's ok to set this provider's property values.
-     * If the default implementation of <code>checkSecurityAccess</code>
-     * is used (that is, that method is not overriden), then this results in
-     * a call to the security manager's <code>checkPermission</code> method
-     * with a <code>SecurityPermission("putProviderProperty."+name)</code>
-     * permission.
-     *
-     * @param key the property key.
-     *
-     * @param value the property value.
-     *
-     * @return the previous value of the specified property
-     * (<code>key</code>), or null if it did not have one.
+     * <p>If a security manager is enabled, its {@code checkSecurityAccess}
+     * method is called with the string {@code "putProviderProperty."+name},
+     * where {@code name} is the provider name, to see if it's ok to set this
+     * provider's property values.
      *
      * @throws  SecurityException
-     *          if a security manager exists and its <code>{@link
-     *          java.lang.SecurityManager#checkSecurityAccess}</code> method
+     *          if a security manager exists and its {@link
+     *          java.lang.SecurityManager#checkSecurityAccess} method
      *          denies access to set property values.
      *
      * @since 1.2
      */
+    @Override
     public synchronized Object put(Object key, Object value) {
         check("putProviderProperty."+name);
         if (debug != null) {
@@ -338,32 +330,49 @@
     }
 
     /**
-     * Removes the <code>key</code> property (and its corresponding
-     * <code>value</code>).
+     * If the specified key is not already associated with a value (or is mapped
+     * to {@code null}) associates it with the given value and returns
+     * {@code null}, else returns the current value.
      *
-     * <p>First, if there is a security manager, its
-     * <code>checkSecurityAccess</code> method is called with the string
-     * <code>"removeProviderProperty."+name</code>, where <code>name</code> is
-     * the provider name, to see if it's ok to remove this provider's
-     * properties. If the default implementation of
-     * <code>checkSecurityAccess</code> is used (that is, that method is not
-     * overriden), then this results in a call to the security manager's
-     * <code>checkPermission</code> method with a
-     * <code>SecurityPermission("removeProviderProperty."+name)</code>
-     * permission.
-     *
-     * @param key the key for the property to be removed.
-     *
-     * @return the value to which the key had been mapped,
-     * or null if the key did not have a mapping.
+     * <p>If a security manager is enabled, its {@code checkSecurityAccess}
+     * method is called with the string {@code "putProviderProperty."+name},
+     * where {@code name} is the provider name, to see if it's ok to set this
+     * provider's property values.
      *
      * @throws  SecurityException
-     *          if a security manager exists and its <code>{@link
-     *          java.lang.SecurityManager#checkSecurityAccess}</code> method
+     *          if a security manager exists and its {@link
+     *          java.lang.SecurityManager#checkSecurityAccess} method
+     *          denies access to set property values.
+     *
+     * @since 1.8
+     */
+    @Override
+    public synchronized Object putIfAbsent(Object key, Object value) {
+        check("putProviderProperty."+name);
+        if (debug != null) {
+            debug.println("Set " + name + " provider property [" +
+                          key + "/" + value +"]");
+        }
+        return implPutIfAbsent(key, value);
+    }
+
+    /**
+     * Removes the {@code key} property (and its corresponding
+     * {@code value}).
+     *
+     * <p>If a security manager is enabled, its {@code checkSecurityAccess}
+     * method is called with the string {@code "removeProviderProperty."+name},
+     * where {@code name} is the provider name, to see if it's ok to remove this
+     * provider's properties.
+     *
+     * @throws  SecurityException
+     *          if a security manager exists and its {@link
+     *          java.lang.SecurityManager#checkSecurityAccess} method
      *          denies access to remove this provider's properties.
      *
      * @since 1.2
      */
+    @Override
     public synchronized Object remove(Object key) {
         check("removeProviderProperty."+name);
         if (debug != null) {
@@ -372,11 +381,247 @@
         return implRemove(key);
     }
 
+    /**
+     * Removes the entry for the specified key only if it is currently
+     * mapped to the specified value.
+     *
+     * <p>If a security manager is enabled, its {@code checkSecurityAccess}
+     * method is called with the string {@code "removeProviderProperty."+name},
+     * where {@code name} is the provider name, to see if it's ok to remove this
+     * provider's properties.
+     *
+     * @throws  SecurityException
+     *          if a security manager exists and its {@link
+     *          java.lang.SecurityManager#checkSecurityAccess} method
+     *          denies access to remove this provider's properties.
+     *
+     * @since 1.8
+     */
+    @Override
+    public synchronized boolean remove(Object key, Object value) {
+        check("removeProviderProperty."+name);
+        if (debug != null) {
+            debug.println("Remove " + name + " provider property " + key);
+        }
+        return implRemove(key, value);
+    }
+
+    /**
+     * Replaces the entry for the specified key only if currently
+     * mapped to the specified value.
+     *
+     * <p>If a security manager is enabled, its {@code checkSecurityAccess}
+     * method is called with the string {@code "putProviderProperty."+name},
+     * where {@code name} is the provider name, to see if it's ok to set this
+     * provider's property values.
+     *
+     * @throws  SecurityException
+     *          if a security manager exists and its {@link
+     *          java.lang.SecurityManager#checkSecurityAccess} method
+     *          denies access to set property values.
+     *
+     * @since 1.8
+     */
+    @Override
+    public synchronized boolean replace(Object key, Object oldValue,
+            Object newValue) {
+        check("putProviderProperty." + name);
+
+        if (debug != null) {
+            debug.println("Replace " + name + " provider property " + key);
+        }
+        return implReplace(key, oldValue, newValue);
+    }
+
+    /**
+     * Replaces the entry for the specified key only if it is
+     * currently mapped to some value.
+     *
+     * <p>If a security manager is enabled, its {@code checkSecurityAccess}
+     * method is called with the string {@code "putProviderProperty."+name},
+     * where {@code name} is the provider name, to see if it's ok to set this
+     * provider's property values.
+     *
+     * @throws  SecurityException
+     *          if a security manager exists and its {@link
+     *          java.lang.SecurityManager#checkSecurityAccess} method
+     *          denies access to set property values.
+     *
+     * @since 1.8
+     */
+    @Override
+    public synchronized Object replace(Object key, Object value) {
+        check("putProviderProperty." + name);
+
+        if (debug != null) {
+            debug.println("Replace " + name + " provider property " + key);
+        }
+        return implReplace(key, value);
+    }
+
+    /**
+     * Replaces each entry's value with the result of invoking the given
+     * function on that entry, in the order entries are returned by an entry
+     * set iterator, until all entries have been processed or the function
+     * throws an exception.
+     *
+     * <p>If a security manager is enabled, its {@code checkSecurityAccess}
+     * method is called with the string {@code "putProviderProperty."+name},
+     * where {@code name} is the provider name, to see if it's ok to set this
+     * provider's property values.
+     *
+     * @throws  SecurityException
+     *          if a security manager exists and its {@link
+     *          java.lang.SecurityManager#checkSecurityAccess} method
+     *          denies access to set property values.
+     *
+     * @since 1.8
+     */
+    @Override
+    public synchronized void replaceAll(BiFunction<? super Object, ? super Object, ? extends Object> function) {
+        check("putProviderProperty." + name);
+
+        if (debug != null) {
+            debug.println("ReplaceAll " + name + " provider property ");
+        }
+        implReplaceAll(function);
+    }
+
+    /**
+     * Attempts to compute a mapping for the specified key and its
+     * current mapped value (or {@code null} if there is no current
+     * mapping).
+     *
+     * <p>If a security manager is enabled, its {@code checkSecurityAccess}
+     * method is called with the strings {@code "putProviderProperty."+name}
+     * and {@code "removeProviderProperty."+name}, where {@code name} is the
+     * provider name, to see if it's ok to set this provider's property values
+     * and remove this provider's properties.
+     *
+     * @throws  SecurityException
+     *          if a security manager exists and its {@link
+     *          java.lang.SecurityManager#checkSecurityAccess} method
+     *          denies access to set property values or remove properties.
+     *
+     * @since 1.8
+     */
+    @Override
+    public synchronized Object compute(Object key,
+        BiFunction<? super Object, ? super Object, ? extends Object> remappingFunction) {
+        check("putProviderProperty." + name);
+        check("removeProviderProperty" + name);
+
+        if (debug != null) {
+            debug.println("Compute " + name + " provider property " + key);
+        }
+        return implCompute(key, remappingFunction);
+    }
+
+    /**
+     * If the specified key is not already associated with a value (or
+     * is mapped to {@code null}), attempts to compute its value using
+     * the given mapping function and enters it into this map unless
+     * {@code null}.
+     *
+     * <p>If a security manager is enabled, its {@code checkSecurityAccess}
+     * method is called with the strings {@code "putProviderProperty."+name}
+     * and {@code "removeProviderProperty."+name}, where {@code name} is the
+     * provider name, to see if it's ok to set this provider's property values
+     * and remove this provider's properties.
+     *
+     * @throws  SecurityException
+     *          if a security manager exists and its {@link
+     *          java.lang.SecurityManager#checkSecurityAccess} method
+     *          denies access to set property values and remove properties.
+     *
+     * @since 1.8
+     */
+    @Override
+    public synchronized Object computeIfAbsent(Object key, Function<? super Object, ? extends Object> mappingFunction) {
+        check("putProviderProperty." + name);
+        check("removeProviderProperty" + name);
+
+        if (debug != null) {
+            debug.println("ComputeIfAbsent " + name + " provider property " +
+                    key);
+        }
+        return implComputeIfAbsent(key, mappingFunction);
+    }
+
+    /**
+     * If the value for the specified key is present and non-null, attempts to
+     * compute a new mapping given the key and its current mapped value.
+     *
+     * <p>If a security manager is enabled, its {@code checkSecurityAccess}
+     * method is called with the strings {@code "putProviderProperty."+name}
+     * and {@code "removeProviderProperty."+name}, where {@code name} is the
+     * provider name, to see if it's ok to set this provider's property values
+     * and remove this provider's properties.
+     *
+     * @throws  SecurityException
+     *          if a security manager exists and its {@link
+     *          java.lang.SecurityManager#checkSecurityAccess} method
+     *          denies access to set property values or remove properties.
+     *
+     * @since 1.8
+     */
+    @Override
+    public synchronized Object computeIfPresent(Object key, BiFunction<? super Object, ? super Object, ? extends Object> remappingFunction) {
+        check("putProviderProperty." + name);
+        check("removeProviderProperty" + name);
+
+        if (debug != null) {
+            debug.println("ComputeIfPresent " + name + " provider property " +
+                    key);
+        }
+        return implComputeIfPresent(key, remappingFunction);
+    }
+
+    /**
+     * If the specified key is not already associated with a value or is
+     * associated with null, associates it with the given value. Otherwise,
+     * replaces the value with the results of the given remapping function,
+     * or removes if the result is null. This method may be of use when
+     * combining multiple mapped values for a key.
+     *
+     * <p>If a security manager is enabled, its {@code checkSecurityAccess}
+     * method is called with the strings {@code "putProviderProperty."+name}
+     * and {@code "removeProviderProperty."+name}, where {@code name} is the
+     * provider name, to see if it's ok to set this provider's property values
+     * and remove this provider's properties.
+     *
+     * @throws  SecurityException
+     *          if a security manager exists and its {@link
+     *          java.lang.SecurityManager#checkSecurityAccess} method
+     *          denies access to set property values or remove properties.
+     *
+     * @since 1.8
+     */
+    @Override
+    public synchronized Object merge(Object key, Object value,  BiFunction<? super Object, ? super Object, ? extends Object>  remappingFunction) {
+        check("putProviderProperty." + name);
+        check("removeProviderProperty" + name);
+
+        if (debug != null) {
+            debug.println("Merge " + name + " provider property " + key);
+        }
+        return implMerge(key, value, remappingFunction);
+    }
+
     // let javadoc show doc from superclass
+    @Override
     public Object get(Object key) {
         checkInitialized();
         return super.get(key);
     }
+    /**
+     * @since 1.8
+     */
+    @Override
+    public synchronized Object getOrDefault(Object key, Object defaultValue) {
+        checkInitialized();
+        return super.getOrDefault(key, defaultValue);
+    }
 
     /**
      * @since 1.8
@@ -388,12 +633,14 @@
     }
 
     // let javadoc show doc from superclass
+    @Override
     public Enumeration<Object> keys() {
         checkInitialized();
         return super.keys();
     }
 
     // let javadoc show doc from superclass
+    @Override
     public Enumeration<Object> elements() {
         checkInitialized();
         return super.elements();
@@ -485,8 +732,8 @@
      * Internal method to be called AFTER the security check has been
      * performed.
      */
-    private void implPutAll(Map t) {
-        for (Map.Entry e : ((Map<?,?>)t).entrySet()) {
+    private void implPutAll(Map<?,?> t) {
+        for (Map.Entry<?,?> e : t.entrySet()) {
             implPut(e.getKey(), e.getValue());
         }
         if (registered) {
@@ -504,6 +751,99 @@
         return super.remove(key);
     }
 
+    private boolean implRemove(Object key, Object value) {
+        if (key instanceof String && value instanceof String) {
+            if (!checkLegacy(key)) {
+                return false;
+            }
+            legacyStrings.remove((String)key, value);
+        }
+        return super.remove(key, value);
+    }
+
+    private boolean implReplace(Object key, Object oldValue, Object newValue) {
+        if ((key instanceof String) && (oldValue instanceof String) &&
+                (newValue instanceof String)) {
+            if (!checkLegacy(key)) {
+                return false;
+            }
+            legacyStrings.replace((String)key, (String)oldValue,
+                    (String)newValue);
+        }
+        return super.replace(key, oldValue, newValue);
+    }
+
+    private Object implReplace(Object key, Object value) {
+        if ((key instanceof String) && (value instanceof String)) {
+            if (!checkLegacy(key)) {
+                return null;
+            }
+            legacyStrings.replace((String)key, (String)value);
+        }
+        return super.replace(key, value);
+    }
+
+    private void implReplaceAll(BiFunction<? super Object, ? super Object, ? extends Object> function) {
+        legacyChanged = true;
+        if (legacyStrings == null) {
+            legacyStrings = new LinkedHashMap<String,String>();
+        } else {
+            legacyStrings.replaceAll((BiFunction<? super String, ? super String, ? extends String>) function);
+        }
+        super.replaceAll(function);
+    }
+
+
+    private Object implMerge(Object key, Object value, BiFunction<? super Object, ? super Object, ? extends Object> remappingFunction) {
+        if ((key instanceof String) && (value instanceof String)) {
+            if (!checkLegacy(key)) {
+                return null;
+            }
+            legacyStrings.merge((String)key, (String)value,
+                    (BiFunction<? super String, ? super String, ? extends String>) remappingFunction);
+        }
+        return super.merge(key, value, remappingFunction);
+    }
+
+    private Object implCompute(Object key, BiFunction<? super Object, ? super Object, ? extends Object> remappingFunction) {
+        if (key instanceof String) {
+            if (!checkLegacy(key)) {
+                return null;
+            }
+            // BEGIN ANDROID-CHANGED: was
+            // legacyStrings.computeIfAbsent((String) key,
+            //         (Function<? super String, ? extends String>) remappingFunction);
+            // which cannot ever succeed as the cast from BiFunction to Function always fails
+            legacyStrings.compute((String) key,
+                    (BiFunction<? super String, ? super String, ? extends String>)
+                            remappingFunction);
+            // END ANDROID-CHANGED
+        }
+        return super.compute(key, remappingFunction);
+    }
+
+    private Object implComputeIfAbsent(Object key, Function<? super Object, ? extends Object> mappingFunction) {
+        if (key instanceof String) {
+            if (!checkLegacy(key)) {
+                return null;
+            }
+            legacyStrings.computeIfAbsent((String) key,
+                    (Function<? super String, ? extends String>) mappingFunction);
+        }
+        return super.computeIfAbsent(key, mappingFunction);
+    }
+
+    private Object implComputeIfPresent(Object key, BiFunction<? super Object, ? super Object, ? extends Object> remappingFunction) {
+        if (key instanceof String) {
+            if (!checkLegacy(key)) {
+                return null;
+            }
+            legacyStrings.computeIfPresent((String) key,
+                    (BiFunction<? super String, ? super String, ? extends String>) remappingFunction);
+        }
+        return super.computeIfPresent(key, remappingFunction);
+    }
+
     private Object implPut(Object key, Object value) {
         if ((key instanceof String) && (value instanceof String)) {
             if (!checkLegacy(key)) {
@@ -514,6 +854,16 @@
         return super.put(key, value);
     }
 
+    private Object implPutIfAbsent(Object key, Object value) {
+        if ((key instanceof String) && (value instanceof String)) {
+            if (!checkLegacy(key)) {
+                return null;
+            }
+            legacyStrings.putIfAbsent((String)key, (String)value);
+        }
+        return super.putIfAbsent(key, value);
+    }
+
     private void implClear() {
         if (legacyStrings != null) {
             legacyStrings.clear();
@@ -590,9 +940,9 @@
      * occur if the legacy properties are inconsistent or incomplete.
      */
     private void removeInvalidServices(Map<ServiceKey,Service> map) {
-        for (Iterator t = map.entrySet().iterator(); t.hasNext(); ) {
-            Map.Entry entry = (Map.Entry)t.next();
-            Service s = (Service)entry.getValue();
+        for (Iterator<Map.Entry<ServiceKey, Service>> t =
+                map.entrySet().iterator(); t.hasNext(); ) {
+            Service s = t.next().getValue();
             if (s.isValid() == false) {
                 t.remove();
             }
@@ -693,9 +1043,9 @@
      * the service added via {@link #putService putService()} is returned.
      *
      * @param type the type of {@link Service service} requested
-     * (for example, <code>MessageDigest</code>)
+     * (for example, {@code MessageDigest})
      * @param algorithm the case insensitive algorithm name (or alternate
-     * alias) of the service requested (for example, <code>SHA-1</code>)
+     * alias) of the service requested (for example, {@code SHA-1})
      *
      * @return the service describing this Provider's matching service
      * or null if no such service exists
@@ -770,20 +1120,20 @@
      * Java Cryptography Architecture API Specification &amp; Reference </a>.
      *
      * <p>Also, if there is a security manager, its
-     * <code>checkSecurityAccess</code> method is called with the string
-     * <code>"putProviderProperty."+name</code>, where <code>name</code> is
+     * {@code checkSecurityAccess} method is called with the string
+     * {@code "putProviderProperty."+name}, where {@code name} is
      * the provider name, to see if it's ok to set this provider's property
-     * values. If the default implementation of <code>checkSecurityAccess</code>
+     * values. If the default implementation of {@code checkSecurityAccess}
      * is used (that is, that method is not overriden), then this results in
-     * a call to the security manager's <code>checkPermission</code> method with
-     * a <code>SecurityPermission("putProviderProperty."+name)</code>
+     * a call to the security manager's {@code checkPermission} method with
+     * a {@code SecurityPermission("putProviderProperty."+name)}
      * permission.
      *
      * @param s the Service to add
      *
      * @throws SecurityException
-     *      if a security manager exists and its <code>{@link
-     *      java.lang.SecurityManager#checkSecurityAccess}</code> method denies
+     *      if a security manager exists and its {@link
+     *      java.lang.SecurityManager#checkSecurityAccess} method denies
      *      access to set property values.
      * @throws NullPointerException if s is null
      *
@@ -867,21 +1217,21 @@
      * from this provider's Hashtable.
      *
      * <p>Also, if there is a security manager, its
-     * <code>checkSecurityAccess</code> method is called with the string
-     * <code>"removeProviderProperty."+name</code>, where <code>name</code> is
+     * {@code checkSecurityAccess} method is called with the string
+     * {@code "removeProviderProperty."+name}, where {@code name} is
      * the provider name, to see if it's ok to remove this provider's
      * properties. If the default implementation of
-     * <code>checkSecurityAccess</code> is used (that is, that method is not
+     * {@code checkSecurityAccess} is used (that is, that method is not
      * overriden), then this results in a call to the security manager's
-     * <code>checkPermission</code> method with a
-     * <code>SecurityPermission("removeProviderProperty."+name)</code>
+     * {@code checkPermission} method with a
+     * {@code SecurityPermission("removeProviderProperty."+name)}
      * permission.
      *
      * @param s the Service to be removed
      *
      * @throws  SecurityException
-     *          if a security manager exists and its <code>{@link
-     *          java.lang.SecurityManager#checkSecurityAccess}</code> method denies
+     *          if a security manager exists and its {@link
+     *          java.lang.SecurityManager#checkSecurityAccess} method denies
      *          access to remove this provider's properties.
      * @throws NullPointerException if s is null
      *
@@ -952,15 +1302,15 @@
         final String name;
         final boolean supportsParameter;
         final String constructorParameterClassName;
-        private volatile Class constructorParameterClass;
+        private volatile Class<?> constructorParameterClass;
 
         EngineDescription(String name, boolean sp, String paramName) {
             this.name = name;
             this.supportsParameter = sp;
             this.constructorParameterClassName = paramName;
         }
-        Class getConstructorParameterClass() throws ClassNotFoundException {
-            Class clazz = constructorParameterClass;
+        Class<?> getConstructorParameterClass() throws ClassNotFoundException {
+            Class<?> clazz = constructorParameterClass;
             if (clazz == null) {
                 clazz = Class.forName(constructorParameterClassName);
                 constructorParameterClass = clazz;
@@ -1042,7 +1392,7 @@
      * <p>This class defines the methods {@link #supportsParameter
      * supportsParameter()} and {@link #newInstance newInstance()}
      * which are used by the Java security framework when it searches for
-     * suitable services and instantes them. The valid arguments to those
+     * suitable services and instantiates them. The valid arguments to those
      * methods depend on the type of service. For the service types defined
      * within Java SE, see the
      * <a href="{@docRoot}openjdk-redirect.html?v=8&path=/technotes/guides/security/crypto/CryptoSpec.html">
@@ -1063,7 +1413,7 @@
         private Map<UString,String> attributes;
 
         // Reference to the cached implementation Class object
-        private volatile Reference<Class> classRef;
+        private volatile Reference<Class<?>> classRef;
 
         // flag indicating whether this service has its attributes for
         // supportedKeyFormats or supportedKeyClasses set
@@ -1080,7 +1430,7 @@
         // whether this service has been registered with the Provider
         private boolean registered;
 
-        private static final Class[] CLASS0 = new Class[0];
+        private static final Class<?>[] CLASS0 = new Class<?>[0];
 
         // this constructor and these methods are used for parsing
         // the legacy string properties.
@@ -1151,7 +1501,7 @@
         }
 
         /**
-         * Get the type of this service. For example, <code>MessageDigest</code>.
+         * Get the type of this service. For example, {@code MessageDigest}.
          *
          * @return the type of this service
          */
@@ -1161,7 +1511,7 @@
 
         /**
          * Return the name of the algorithm of this service. For example,
-         * <code>SHA-1</code>.
+         * {@code SHA-1}.
          *
          * @return the algorithm of this service
          */
@@ -1233,7 +1583,7 @@
          *
          * @throws InvalidParameterException if the value of
          * constructorParameter is invalid for this type of service.
-         * @throws NoSuchAlgorithmException if instantation failed for
+         * @throws NoSuchAlgorithmException if instantiation failed for
          * any other reason.
          */
         public Object newInstance(Object constructorParameter)
@@ -1260,12 +1610,14 @@
                             ("constructorParameter not used with " + type
                             + " engines");
                     }
-                    Class clazz = getImplClass();
-                    return clazz.newInstance();
+                    Class<?> clazz = getImplClass();
+                    Class<?>[] empty = {};
+                    Constructor<?> con = clazz.getConstructor(empty);
+                    return con.newInstance();
                 } else {
-                    Class paramClass = cap.getConstructorParameterClass();
+                    Class<?> paramClass = cap.getConstructorParameterClass();
                     if (constructorParameter != null) {
-                        Class argClass = constructorParameter.getClass();
+                        Class<?> argClass = constructorParameter.getClass();
                         if (paramClass.isAssignableFrom(argClass) == false) {
                             throw new InvalidParameterException
                             ("constructorParameter must be instanceof "
@@ -1273,8 +1625,8 @@
                             + " for engine type " + type);
                         }
                     }
-                    Class clazz = getImplClass();
-                    Constructor cons = clazz.getConstructor(paramClass);
+                    Class<?> clazz = getImplClass();
+                    Constructor<?> cons = clazz.getConstructor(paramClass);
                     return cons.newInstance(constructorParameter);
                 }
             } catch (NoSuchAlgorithmException e) {
@@ -1293,10 +1645,10 @@
         }
 
         // return the implementation Class object for this service
-        private Class getImplClass() throws NoSuchAlgorithmException {
+        private Class<?> getImplClass() throws NoSuchAlgorithmException {
             try {
-                Reference<Class> ref = classRef;
-                Class clazz = (ref == null) ? null : ref.get();
+                Reference<Class<?>> ref = classRef;
+                Class<?> clazz = (ref == null) ? null : ref.get();
                 if (clazz == null) {
                     ClassLoader cl = provider.getClass().getClassLoader();
                     if (cl == null) {
@@ -1304,13 +1656,18 @@
                     } else {
                         clazz = cl.loadClass(className);
                     }
-                    classRef = new WeakReference<Class>(clazz);
+                    if (!Modifier.isPublic(clazz.getModifiers())) {
+                        throw new NoSuchAlgorithmException
+                            ("class configured for " + type + " (provider: " +
+                            provider.getName() + ") is not public.");
+                    }
+                    classRef = new WeakReference<Class<?>>(clazz);
                 }
                 return clazz;
             } catch (ClassNotFoundException e) {
                 throw new NoSuchAlgorithmException
-                    ("class configured for " + type + "(provider: " +
-                    provider.getName() + ")" + "cannot be found.", e);
+                    ("class configured for " + type + " (provider: " +
+                    provider.getName() + ") cannot be found.", e);
             }
         }
 
@@ -1321,28 +1678,33 @@
          */
         private Object newInstanceGeneric(Object constructorParameter)
                 throws Exception {
-            Class clazz = getImplClass();
+            Class<?> clazz = getImplClass();
             if (constructorParameter == null) {
-                Object o = clazz.newInstance();
-                return o;
+                // create instance with public no-arg constructor if it exists
+                try {
+                    Class<?>[] empty = {};
+                    Constructor<?> con = clazz.getConstructor(empty);
+                    return con.newInstance();
+                } catch (NoSuchMethodException e) {
+                    throw new NoSuchAlgorithmException("No public no-arg "
+                        + "constructor found in class " + className);
+                }
             }
-            Class argClass = constructorParameter.getClass();
+            Class<?> argClass = constructorParameter.getClass();
             Constructor[] cons = clazz.getConstructors();
             // find first public constructor that can take the
             // argument as parameter
-            for (int i = 0; i < cons.length; i++) {
-                Constructor con = cons[i];
-                Class[] paramTypes = con.getParameterTypes();
+            for (Constructor<?> con : cons) {
+                Class<?>[] paramTypes = con.getParameterTypes();
                 if (paramTypes.length != 1) {
                     continue;
                 }
                 if (paramTypes[0].isAssignableFrom(argClass) == false) {
                     continue;
                 }
-                Object o = con.newInstance(new Object[] {constructorParameter});
-                return o;
+                return con.newInstance(constructorParameter);
             }
-            throw new NoSuchAlgorithmException("No constructor matching "
+            throw new NoSuchAlgorithmException("No public constructor matching "
                 + argClass.getName() + " found in class " + className);
         }
 
@@ -1420,10 +1782,10 @@
                     s = getAttribute("SupportedKeyClasses");
                     if (s != null) {
                         String[] classNames = s.split("\\|");
-                        List<Class> classList =
+                        List<Class<?>> classList =
                             new ArrayList<>(classNames.length);
                         for (String className : classNames) {
-                            Class clazz = getKeyClass(className);
+                            Class<?> clazz = getKeyClass(className);
                             if (clazz != null) {
                                 classList.add(clazz);
                             }
@@ -1440,7 +1802,7 @@
         }
 
         // get the key class object of the specified name
-        private Class getKeyClass(String name) {
+        private Class<?> getKeyClass(String name) {
             try {
                 return Class.forName(name);
             } catch (ClassNotFoundException e) {
@@ -1477,8 +1839,8 @@
             if (supportedClasses == null) {
                 return false;
             }
-            Class keyClass = key.getClass();
-            for (Class clazz : supportedClasses) {
+            Class<?> keyClass = key.getClass();
+            for (Class<?> clazz : supportedClasses) {
                 if (clazz.isAssignableFrom(keyClass)) {
                     return true;
                 }
diff --git a/ojluni/src/main/java/java/security/SecureRandom.java b/ojluni/src/main/java/java/security/SecureRandom.java
index 6bf43f1..43bc3a3 100644
--- a/ojluni/src/main/java/java/security/SecureRandom.java
+++ b/ojluni/src/main/java/java/security/SecureRandom.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 2011, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -26,6 +26,7 @@
 package java.security;
 
 import java.util.*;
+import java.util.regex.*;
 
 import java.security.Provider.Service;
 import java.util.function.Function;
@@ -33,6 +34,9 @@
 import dalvik.system.VMRuntime;
 import sun.security.jca.*;
 import sun.security.jca.GetInstance.Instance;
+/** BEGIN ANDROID-REMOVED: this debugging mechanism is not supported in Android.
+import sun.security.util.Debug;
+*/
 
 /**
  * This class provides a cryptographically strong random number
@@ -51,7 +55,7 @@
  * <i>RFC 1750: Randomness Recommendations for Security</i></a>.
  *
  * <p>A caller obtains a SecureRandom instance via the
- * no-argument constructor or one of the <code>getInstance</code> methods:
+ * no-argument constructor or one of the {@code getInstance} methods:
  *
  * <pre>
  *      SecureRandom random = new SecureRandom();
@@ -72,16 +76,16 @@
  *      random.nextBytes(bytes);
  * </pre>
  *
- * <p> Callers may also invoke the <code>generateSeed</code> method
+ * <p> Callers may also invoke the {@code generateSeed} method
  * to generate a given number of seed bytes (to seed other random number
  * generators, for example):
  * <pre>
  *      byte seed[] = random.generateSeed(20);
  * </pre>
  *
- * Note: Depending on the implementation, the <code>generateSeed</code> and
- * <code>nextBytes</code> methods may block as entropy is being gathered,
- * for example, if they need to read from /dev/random on various unix-like
+ * Note: Depending on the implementation, the {@code generateSeed} and
+ * {@code nextBytes} methods may block as entropy is being gathered,
+ * for example, if they need to read from /dev/random on various Unix-like
  * operating systems.
  *
  * The SHA1PRNG algorithm from the Crypto provider has been deprecated as it was insecure, and also
@@ -98,6 +102,13 @@
 
 public class SecureRandom extends java.util.Random {
 
+    /** BEGIN ANDROID-REMOVED: this debugging mechanism is not supported in Android.
+    private static final Debug pdebug =
+                        Debug.getInstance("provider", "Provider");
+    private static final boolean skipDebug =
+        Debug.isOn("engine=") && !Debug.isOn("securerandom");
+    END ANDROID-REMOVED */
+
     /**
      * The provider.
      *
@@ -146,16 +157,16 @@
      * for information about standard RNG algorithm names.
      *
      * <p> The returned SecureRandom object has not been seeded.  To seed the
-     * returned object, call the <code>setSeed</code> method.
-     * If <code>setSeed</code> is not called, the first call to
-     * <code>nextBytes</code> will force the SecureRandom object to seed itself.
-     * This self-seeding will not occur if <code>setSeed</code> was
+     * returned object, call the {@code setSeed} method.
+     * If {@code setSeed} is not called, the first call to
+     * {@code nextBytes} will force the SecureRandom object to seed itself.
+     * This self-seeding will not occur if {@code setSeed} was
      * previously called.
      */
     public SecureRandom() {
         /*
          * This call to our superclass constructor will result in a call
-         * to our own <code>setSeed</code> method, which will return
+         * to our own {@code setSeed} method, which will return
          * immediately when it is passed zero.
          */
         super(0);
@@ -235,6 +246,13 @@
         this.secureRandomSpi = secureRandomSpi;
         this.provider = provider;
         this.algorithm = algorithm;
+
+        /** BEGIN ANDROID-REMOVED: this debugging mechanism is not supported in Android.
+        if (!skipDebug && pdebug != null) {
+            pdebug.println("SecureRandom." + algorithm +
+                " algorithm from: " + this.provider.getName());
+        }
+        END ANDROID-REMOVED */
     }
 
     /**
@@ -251,10 +269,10 @@
      * the {@link Security#getProviders() Security.getProviders()} method.
      *
      * <p> The returned SecureRandom object has not been seeded.  To seed the
-     * returned object, call the <code>setSeed</code> method.
-     * If <code>setSeed</code> is not called, the first call to
-     * <code>nextBytes</code> will force the SecureRandom object to seed itself.
-     * This self-seeding will not occur if <code>setSeed</code> was
+     * returned object, call the {@code setSeed} method.
+     * If {@code setSeed} is not called, the first call to
+     * {@code nextBytes} will force the SecureRandom object to seed itself.
+     * This self-seeding will not occur if {@code setSeed} was
      * previously called.
      *
      * @param algorithm the name of the RNG algorithm.
@@ -327,10 +345,10 @@
      * the {@link Security#getProviders() Security.getProviders()} method.
      *
      * <p> The returned SecureRandom object has not been seeded.  To seed the
-     * returned object, call the <code>setSeed</code> method.
-     * If <code>setSeed</code> is not called, the first call to
-     * <code>nextBytes</code> will force the SecureRandom object to seed itself.
-     * This self-seeding will not occur if <code>setSeed</code> was
+     * returned object, call the {@code setSeed} method.
+     * If {@code setSeed} is not called, the first call to
+     * {@code nextBytes} will force the SecureRandom object to seed itself.
+     * This self-seeding will not occur if {@code setSeed} was
      * previously called.
      *
      * @param algorithm the name of the RNG algorithm.
@@ -416,10 +434,10 @@
      * does not have to be registered in the provider list.
      *
      * <p> The returned SecureRandom object has not been seeded.  To seed the
-     * returned object, call the <code>setSeed</code> method.
-     * If <code>setSeed</code> is not called, the first call to
-     * <code>nextBytes</code> will force the SecureRandom object to seed itself.
-     * This self-seeding will not occur if <code>setSeed</code> was
+     * returned object, call the {@code setSeed} method.
+     * If {@code setSeed} is not called, the first call to
+     * {@code nextBytes} will force the SecureRandom object to seed itself.
+     * This self-seeding will not occur if {@code setSeed} was
      * previously called.
      *
      * @param algorithm the name of the RNG algorithm.
@@ -470,7 +488,7 @@
      * Returns the name of the algorithm implemented by this SecureRandom
      * object.
      *
-     * @return the name of the algorithm or <code>unknown</code>
+     * @return the name of the algorithm or {@code unknown}
      *          if the algorithm name cannot be determined.
      * @since 1.5
      */
@@ -493,17 +511,18 @@
 
     /**
      * Reseeds this random object, using the eight bytes contained
-     * in the given <code>long seed</code>. The given seed supplements,
+     * in the given {@code long seed}. The given seed supplements,
      * rather than replaces, the existing seed. Thus, repeated calls
      * are guaranteed never to reduce randomness.
      *
      * <p>This method is defined for compatibility with
-     * <code>java.util.Random</code>.
+     * {@code java.util.Random}.
      *
      * @param seed the seed.
      *
      * @see #getSeed
      */
+    @Override
     public void setSeed(long seed) {
         /*
          * Ignore call from super constructor (as well as any other calls
@@ -519,14 +538,14 @@
     /**
      * Generates a user-specified number of random bytes.
      *
-     * <p> If a call to <code>setSeed</code> had not occurred previously,
+     * <p> If a call to {@code setSeed} had not occurred previously,
      * the first call to this method forces this SecureRandom object
      * to seed itself.  This self-seeding will not occur if
-     * <code>setSeed</code> was previously called.
+     * {@code setSeed} was previously called.
      *
      * @param bytes the array to be filled in with random bytes.
      */
-
+    @Override
     synchronized public void nextBytes(byte[] bytes) {
         secureRandomSpi.engineNextBytes(bytes);
     }
@@ -534,25 +553,27 @@
     /**
      * Generates an integer containing the user-specified number of
      * pseudo-random bits (right justified, with leading zeros).  This
-     * method overrides a <code>java.util.Random</code> method, and serves
+     * method overrides a {@code java.util.Random} method, and serves
      * to provide a source of random bits to all of the methods inherited
-     * from that class (for example, <code>nextInt</code>,
-     * <code>nextLong</code>, and <code>nextFloat</code>).
+     * from that class (for example, {@code nextInt},
+     * {@code nextLong}, and {@code nextFloat}).
      *
      * @param numBits number of pseudo-random bits to be generated, where
-     * 0 <= <code>numBits</code> <= 32.
+     * {@code 0 <= numBits <= 32}.
      *
-     * @return an <code>int</code> containing the user-specified number
+     * @return an {@code int} containing the user-specified number
      * of pseudo-random bits (right justified, with leading zeros).
      */
+    @Override
     final protected int next(int numBits) {
         int numBytes = (numBits+7)/8;
         byte b[] = new byte[numBytes];
         int next = 0;
 
         nextBytes(b);
-        for (int i = 0; i < numBytes; i++)
+        for (int i = 0; i < numBytes; i++) {
             next = (next << 8) + (b[i] & 0xFF);
+        }
 
         return next >>> (numBytes*8 - numBits);
     }
@@ -564,8 +585,8 @@
      *
      * <p>This method is only included for backwards compatibility.
      * The caller is encouraged to use one of the alternative
-     * <code>getInstance</code> methods to obtain a SecureRandom object, and
-     * then call the <code>generateSeed</code> method to obtain seed bytes
+     * {@code getInstance} methods to obtain a SecureRandom object, and
+     * then call the {@code generateSeed} method to obtain seed bytes
      * from that object.
      *
      * @param numBytes the number of seed bytes to generate.
@@ -575,8 +596,9 @@
      * @see #setSeed
      */
     public static byte[] getSeed(int numBytes) {
-        if (seedGenerator == null)
+        if (seedGenerator == null) {
             seedGenerator = new SecureRandom();
+        }
         return seedGenerator.generateSeed(numBytes);
     }
 
@@ -625,6 +647,95 @@
         return null;
     }
 
+    /*
+     * Lazily initialize since Pattern.compile() is heavy.
+     * Effective Java (2nd Edition), Item 71.
+     */
+    private static final class StrongPatternHolder {
+        /*
+         * Entries are alg:prov separated by ,
+         * Allow for prepended/appended whitespace between entries.
+         *
+         * Capture groups:
+         *     1 - alg
+         *     2 - :prov (optional)
+         *     3 - prov (optional)
+         *     4 - ,nextEntry (optional)
+         *     5 - nextEntry (optional)
+         */
+        private static Pattern pattern =
+            Pattern.compile(
+                "\\s*([\\S&&[^:,]]*)(\\:([\\S&&[^,]]*))?\\s*(\\,(.*))?");
+    }
+
+    /**
+     * Returns a {@code SecureRandom} object.
+     *
+     * In Android this is equivalent to get a SHA1PRNG from OpenSSLProvider.
+     *
+     * Some situations require strong random values, such as when
+     * creating high-value/long-lived secrets like RSA public/private
+     * keys.  To help guide applications in selecting a suitable strong
+     * {@code SecureRandom} implementation, Java distributions
+     * include a list of known strong {@code SecureRandom}
+     * implementations in the {@code securerandom.strongAlgorithms}
+     * Security property.
+     * <p>
+     * Every implementation of the Java platform is required to
+     * support at least one strong {@code SecureRandom} implementation.
+     *
+     * @return a strong {@code SecureRandom} implementation
+     *
+     * @throws NoSuchAlgorithmException if no algorithm is available
+     *
+     * @see Security#getProperty(String)
+     *
+     * @since 1.8
+     */
+    public static SecureRandom getInstanceStrong()
+            throws NoSuchAlgorithmException {
+        String property = AccessController.doPrivileged(
+            new PrivilegedAction<String>() {
+                @Override
+                public String run() {
+                    return Security.getProperty(
+                        "securerandom.strongAlgorithms");
+                }
+            });
+
+        if ((property == null) || (property.length() == 0)) {
+            throw new NoSuchAlgorithmException(
+                "Null/empty securerandom.strongAlgorithms Security Property");
+        }
+
+        String remainder = property;
+        while (remainder != null) {
+            Matcher m;
+            if ((m = StrongPatternHolder.pattern.matcher(
+                    remainder)).matches()) {
+
+                String alg = m.group(1);
+                String prov = m.group(3);
+
+                try {
+                    if (prov == null) {
+                        return SecureRandom.getInstance(alg);
+                    } else {
+                        return SecureRandom.getInstance(alg, prov);
+                    }
+                } catch (NoSuchAlgorithmException |
+                        NoSuchProviderException e) {
+                }
+                remainder = m.group(5);
+            } else {
+                remainder = null;
+            }
+        }
+
+        throw new NoSuchAlgorithmException(
+            "No strong SecureRandom impls available: " + property);
+    }
+
     // Declare serialVersionUID to be compatible with JDK1.1
     static final long serialVersionUID = 4940670005562187L;
 
diff --git a/ojluni/src/main/java/java/security/cert/X509CRL.java b/ojluni/src/main/java/java/security/cert/X509CRL.java
index 0998f36..9792369 100644
--- a/ojluni/src/main/java/java/security/cert/X509CRL.java
+++ b/ojluni/src/main/java/java/security/cert/X509CRL.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -30,6 +30,7 @@
 import java.security.InvalidKeyException;
 import java.security.SignatureException;
 import java.security.Principal;
+import java.security.Provider;
 import java.security.PublicKey;
 import javax.security.auth.x500.X500Principal;
 
@@ -71,7 +72,7 @@
  * <a href="http://www.ietf.org/rfc/rfc3280.txt">RFC 3280: Internet X.509
  * Public Key Infrastructure Certificate and CRL Profile</a>.
  * <p>
- * The ASN.1 definition of <code>tbsCertList</code> is:
+ * The ASN.1 definition of {@code tbsCertList} is:
  * <pre>
  * TBSCertList  ::=  SEQUENCE  {
  *     version                 Version OPTIONAL,
@@ -93,18 +94,12 @@
  * <p>
  * CRLs are instantiated using a certificate factory. The following is an
  * example of how to instantiate an X.509 CRL:
- * <pre><code>
- * InputStream inStream = null;
- * try {
- *     inStream = new FileInputStream("fileName-of-crl");
+ * <pre>{@code
+ * try (InputStream inStream = new FileInputStream("fileName-of-crl")) {
  *     CertificateFactory cf = CertificateFactory.getInstance("X.509");
  *     X509CRL crl = (X509CRL)cf.generateCRL(inStream);
- * } finally {
- *     if (inStream != null) {
- *         inStream.close();
- *     }
  * }
- * </code></pre>
+ * }</pre>
  *
  * @author Hemma Prafullchandra
  *
@@ -127,8 +122,8 @@
 
     /**
      * Compares this CRL for equality with the given
-     * object. If the <code>other</code> object is an
-     * <code>instanceof</code> <code>X509CRL</code>, then
+     * object. If the {@code other} object is an
+     * {@code instanceof} {@code X509CRL}, then
      * its encoded form is retrieved and compared with the
      * encoded form of this CRL.
      *
@@ -222,11 +217,49 @@
         SignatureException;
 
     /**
-     * Gets the <code>version</code> (version number) value from the CRL.
+     * Verifies that this CRL was signed using the
+     * private key that corresponds to the given public key.
+     * This method uses the signature verification engine
+     * supplied by the given provider. Note that the specified Provider object
+     * does not have to be registered in the provider list.
+     *
+     * This method was added to version 1.8 of the Java Platform Standard
+     * Edition. In order to maintain backwards compatibility with existing
+     * service providers, this method is not {@code abstract}
+     * and it provides a default implementation.
+     *
+     * @param key the PublicKey used to carry out the verification.
+     * @param sigProvider the signature provider.
+     *
+     * @exception NoSuchAlgorithmException on unsupported signature
+     * algorithms.
+     * @exception InvalidKeyException on incorrect key.
+     * @exception SignatureException on signature errors.
+     * @exception CRLException on encoding errors.
+     * @since 1.8
+     */
+    public void verify(PublicKey key, Provider sigProvider)
+        throws CRLException, NoSuchAlgorithmException,
+        InvalidKeyException, SignatureException {
+        // BEGIN ANDROID-CHANGED
+        // TODO(31294527): was X509CRLImpl.verify(this, key, sigProvider);
+        // As the javadoc says, this "default implementation" was introduced as to avoid breaking
+        // providers that generate concrete subclasses of this class.
+        // The method X509Impl in the original definition calls this method, thus entering an
+        // infinite loop. This strange behaviour was checked to be not specific to libcore by
+        // running a test with vogar --mode=jvm .
+        throw new UnsupportedOperationException(
+                "X509CRL instance doesn't not support X509CRL#verify(PublicKey, Provider)");
+        // END ANDROID-CHANGED
+    }
+
+    /**
+     * Gets the {@code version} (version number) value from the CRL.
      * The ASN.1 definition for this is:
      * <pre>
      * version    Version OPTIONAL,
-     *             -- if present, must be v2<p>
+     *             -- if present, must be v2
+     *
      * Version  ::=  INTEGER  {  v1(0), v2(1), v3(2)  }
      *             -- v3 does not apply to CRLs but appears for consistency
      *             -- with definition of Version for certs
@@ -238,12 +271,12 @@
 
     /**
      * <strong>Denigrated</strong>, replaced by {@linkplain
-     * #getIssuerX500Principal()}. This method returns the <code>issuer</code>
+     * #getIssuerX500Principal()}. This method returns the {@code issuer}
      * as an implementation specific Principal object, which should not be
      * relied upon by portable code.
      *
      * <p>
-     * Gets the <code>issuer</code> (issuer distinguished name) value from
+     * Gets the {@code issuer} (issuer distinguished name) value from
      * the CRL. The issuer name identifies the entity that signed (and
      * issued) the CRL.
      *
@@ -264,14 +297,14 @@
      * AttributeType ::= OBJECT IDENTIFIER
      * AttributeValue ::= ANY
      * </pre>
-     * The <code>Name</code> describes a hierarchical name composed of
+     * The {@code Name} describes a hierarchical name composed of
      * attributes,
      * such as country name, and corresponding values, such as US.
-     * The type of the <code>AttributeValue</code> component is determined by
-     * the <code>AttributeType</code>; in general it will be a
-     * <code>directoryString</code>. A <code>directoryString</code> is usually
-     * one of <code>PrintableString</code>,
-     * <code>TeletexString</code> or <code>UniversalString</code>.
+     * The type of the {@code AttributeValue} component is determined by
+     * the {@code AttributeType}; in general it will be a
+     * {@code directoryString}. A {@code directoryString} is usually
+     * one of {@code PrintableString},
+     * {@code TeletexString} or {@code UniversalString}.
      *
      * @return a Principal whose name is the issuer distinguished name.
      */
@@ -279,11 +312,11 @@
 
     /**
      * Returns the issuer (issuer distinguished name) value from the
-     * CRL as an <code>X500Principal</code>.
+     * CRL as an {@code X500Principal}.
      * <p>
      * It is recommended that subclasses override this method.
      *
-     * @return an <code>X500Principal</code> representing the issuer
+     * @return an {@code X500Principal} representing the issuer
      *          distinguished name
      * @since 1.4
      */
@@ -295,7 +328,7 @@
     }
 
     /**
-     * Gets the <code>thisUpdate</code> date from the CRL.
+     * Gets the {@code thisUpdate} date from the CRL.
      * The ASN.1 definition for this is:
      * <pre>
      * thisUpdate   ChoiceOfTime
@@ -304,14 +337,14 @@
      *     generalTime    GeneralizedTime }
      * </pre>
      *
-     * @return the <code>thisUpdate</code> date from the CRL.
+     * @return the {@code thisUpdate} date from the CRL.
      */
     public abstract Date getThisUpdate();
 
     /**
-     * Gets the <code>nextUpdate</code> date from the CRL.
+     * Gets the {@code nextUpdate} date from the CRL.
      *
-     * @return the <code>nextUpdate</code> date from the CRL, or null if
+     * @return the {@code nextUpdate} date from the CRL, or null if
      * not present.
      */
     public abstract Date getNextUpdate();
@@ -365,7 +398,7 @@
 
     /**
      * Gets the DER-encoded CRL information, the
-     * <code>tbsCertList</code> from this CRL.
+     * {@code tbsCertList} from this CRL.
      * This can be used to verify the signature independently.
      *
      * @return the DER-encoded CRL information.
@@ -374,7 +407,7 @@
     public abstract byte[] getTBSCertList() throws CRLException;
 
     /**
-     * Gets the <code>signature</code> value (the raw signature bits) from
+     * Gets the {@code signature} value (the raw signature bits) from
      * the CRL.
      * The ASN.1 definition for this is:
      * <pre>
@@ -390,7 +423,8 @@
      * signature algorithm. An example is the string "SHA256withRSA".
      * The ASN.1 definition for this is:
      * <pre>
-     * signatureAlgorithm   AlgorithmIdentifier<p>
+     * signatureAlgorithm   AlgorithmIdentifier
+     *
      * AlgorithmIdentifier  ::=  SEQUENCE  {
      *     algorithm               OBJECT IDENTIFIER,
      *     parameters              ANY DEFINED BY algorithm OPTIONAL  }
@@ -399,7 +433,7 @@
      *                             -- algorithm object identifier value
      * </pre>
      *
-     * <p>The algorithm name is determined from the <code>algorithm</code>
+     * <p>The algorithm name is determined from the {@code algorithm}
      * OID string.
      *
      * @return the signature algorithm name.
diff --git a/ojluni/src/main/java/java/util/Base64.java b/ojluni/src/main/java/java/util/Base64.java
new file mode 100644
index 0000000..172acbe
--- /dev/null
+++ b/ojluni/src/main/java/java/util/Base64.java
@@ -0,0 +1,998 @@
+/*
+ * Copyright (c) 2012, 2013, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package java.util;
+
+import java.io.FilterOutputStream;
+import java.io.InputStream;
+import java.io.IOException;
+import java.io.OutputStream;
+import java.nio.ByteBuffer;
+import java.nio.charset.StandardCharsets;
+
+/**
+ * This class consists exclusively of static methods for obtaining
+ * encoders and decoders for the Base64 encoding scheme. The
+ * implementation of this class supports the following types of Base64
+ * as specified in
+ * <a href="http://www.ietf.org/rfc/rfc4648.txt">RFC 4648</a> and
+ * <a href="http://www.ietf.org/rfc/rfc2045.txt">RFC 2045</a>.
+ *
+ * <ul>
+ * <li><a name="basic"><b>Basic</b></a>
+ * <p> Uses "The Base64 Alphabet" as specified in Table 1 of
+ *     RFC 4648 and RFC 2045 for encoding and decoding operation.
+ *     The encoder does not add any line feed (line separator)
+ *     character. The decoder rejects data that contains characters
+ *     outside the base64 alphabet.</p></li>
+ *
+ * <li><a name="url"><b>URL and Filename safe</b></a>
+ * <p> Uses the "URL and Filename safe Base64 Alphabet" as specified
+ *     in Table 2 of RFC 4648 for encoding and decoding. The
+ *     encoder does not add any line feed (line separator) character.
+ *     The decoder rejects data that contains characters outside the
+ *     base64 alphabet.</p></li>
+ *
+ * <li><a name="mime"><b>MIME</b></a>
+ * <p> Uses the "The Base64 Alphabet" as specified in Table 1 of
+ *     RFC 2045 for encoding and decoding operation. The encoded output
+ *     must be represented in lines of no more than 76 characters each
+ *     and uses a carriage return {@code '\r'} followed immediately by
+ *     a linefeed {@code '\n'} as the line separator. No line separator
+ *     is added to the end of the encoded output. All line separators
+ *     or other characters not found in the base64 alphabet table are
+ *     ignored in decoding operation.</p></li>
+ * </ul>
+ *
+ * <p> Unless otherwise noted, passing a {@code null} argument to a
+ * method of this class will cause a {@link java.lang.NullPointerException
+ * NullPointerException} to be thrown.
+ *
+ * @author  Xueming Shen
+ * @since   1.8
+ */
+
+public class Base64 {
+
+    private Base64() {}
+
+    /**
+     * Returns a {@link Encoder} that encodes using the
+     * <a href="#basic">Basic</a> type base64 encoding scheme.
+     *
+     * @return  A Base64 encoder.
+     */
+    public static Encoder getEncoder() {
+         return Encoder.RFC4648;
+    }
+
+    /**
+     * Returns a {@link Encoder} that encodes using the
+     * <a href="#url">URL and Filename safe</a> type base64
+     * encoding scheme.
+     *
+     * @return  A Base64 encoder.
+     */
+    public static Encoder getUrlEncoder() {
+         return Encoder.RFC4648_URLSAFE;
+    }
+
+    /**
+     * Returns a {@link Encoder} that encodes using the
+     * <a href="#mime">MIME</a> type base64 encoding scheme.
+     *
+     * @return  A Base64 encoder.
+     */
+    public static Encoder getMimeEncoder() {
+        return Encoder.RFC2045;
+    }
+
+    /**
+     * Returns a {@link Encoder} that encodes using the
+     * <a href="#mime">MIME</a> type base64 encoding scheme
+     * with specified line length and line separators.
+     *
+     * @param   lineLength
+     *          the length of each output line (rounded down to nearest multiple
+     *          of 4). If {@code lineLength <= 0} the output will not be separated
+     *          in lines
+     * @param   lineSeparator
+     *          the line separator for each output line
+     *
+     * @return  A Base64 encoder.
+     *
+     * @throws  IllegalArgumentException if {@code lineSeparator} includes any
+     *          character of "The Base64 Alphabet" as specified in Table 1 of
+     *          RFC 2045.
+     */
+    public static Encoder getMimeEncoder(int lineLength, byte[] lineSeparator) {
+         Objects.requireNonNull(lineSeparator);
+         int[] base64 = Decoder.fromBase64;
+         for (byte b : lineSeparator) {
+             if (base64[b & 0xff] != -1)
+                 throw new IllegalArgumentException(
+                     "Illegal base64 line separator character 0x" + Integer.toString(b, 16));
+         }
+         if (lineLength <= 0) {
+             return Encoder.RFC4648;
+         }
+         return new Encoder(false, lineSeparator, lineLength >> 2 << 2, true);
+    }
+
+    /**
+     * Returns a {@link Decoder} that decodes using the
+     * <a href="#basic">Basic</a> type base64 encoding scheme.
+     *
+     * @return  A Base64 decoder.
+     */
+    public static Decoder getDecoder() {
+         return Decoder.RFC4648;
+    }
+
+    /**
+     * Returns a {@link Decoder} that decodes using the
+     * <a href="#url">URL and Filename safe</a> type base64
+     * encoding scheme.
+     *
+     * @return  A Base64 decoder.
+     */
+    public static Decoder getUrlDecoder() {
+         return Decoder.RFC4648_URLSAFE;
+    }
+
+    /**
+     * Returns a {@link Decoder} that decodes using the
+     * <a href="#mime">MIME</a> type base64 decoding scheme.
+     *
+     * @return  A Base64 decoder.
+     */
+    public static Decoder getMimeDecoder() {
+         return Decoder.RFC2045;
+    }
+
+    /**
+     * This class implements an encoder for encoding byte data using
+     * the Base64 encoding scheme as specified in RFC 4648 and RFC 2045.
+     *
+     * <p> Instances of {@link Encoder} class are safe for use by
+     * multiple concurrent threads.
+     *
+     * <p> Unless otherwise noted, passing a {@code null} argument to
+     * a method of this class will cause a
+     * {@link java.lang.NullPointerException NullPointerException} to
+     * be thrown.
+     *
+     * @see     Decoder
+     * @since   1.8
+     */
+    public static class Encoder {
+
+        private final byte[] newline;
+        private final int linemax;
+        private final boolean isURL;
+        private final boolean doPadding;
+
+        private Encoder(boolean isURL, byte[] newline, int linemax, boolean doPadding) {
+            this.isURL = isURL;
+            this.newline = newline;
+            this.linemax = linemax;
+            this.doPadding = doPadding;
+        }
+
+        /**
+         * This array is a lookup table that translates 6-bit positive integer
+         * index values into their "Base64 Alphabet" equivalents as specified
+         * in "Table 1: The Base64 Alphabet" of RFC 2045 (and RFC 4648).
+         */
+        private static final char[] toBase64 = {
+            'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M',
+            'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z',
+            'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm',
+            'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z',
+            '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '+', '/'
+        };
+
+        /**
+         * It's the lookup table for "URL and Filename safe Base64" as specified
+         * in Table 2 of the RFC 4648, with the '+' and '/' changed to '-' and
+         * '_'. This table is used when BASE64_URL is specified.
+         */
+        private static final char[] toBase64URL = {
+            'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M',
+            'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z',
+            'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm',
+            'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z',
+            '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '-', '_'
+        };
+
+        private static final int MIMELINEMAX = 76;
+        private static final byte[] CRLF = new byte[] {'\r', '\n'};
+
+        static final Encoder RFC4648 = new Encoder(false, null, -1, true);
+        static final Encoder RFC4648_URLSAFE = new Encoder(true, null, -1, true);
+        static final Encoder RFC2045 = new Encoder(false, CRLF, MIMELINEMAX, true);
+
+        private final int outLength(int srclen) {
+            int len = 0;
+            if (doPadding) {
+                len = 4 * ((srclen + 2) / 3);
+            } else {
+                int n = srclen % 3;
+                len = 4 * (srclen / 3) + (n == 0 ? 0 : n + 1);
+            }
+            if (linemax > 0)                                  // line separators
+                len += (len - 1) / linemax * newline.length;
+            return len;
+        }
+
+        /**
+         * Encodes all bytes from the specified byte array into a newly-allocated
+         * byte array using the {@link Base64} encoding scheme. The returned byte
+         * array is of the length of the resulting bytes.
+         *
+         * @param   src
+         *          the byte array to encode
+         * @return  A newly-allocated byte array containing the resulting
+         *          encoded bytes.
+         */
+        public byte[] encode(byte[] src) {
+            int len = outLength(src.length);          // dst array size
+            byte[] dst = new byte[len];
+            int ret = encode0(src, 0, src.length, dst);
+            if (ret != dst.length)
+                 return Arrays.copyOf(dst, ret);
+            return dst;
+        }
+
+        /**
+         * Encodes all bytes from the specified byte array using the
+         * {@link Base64} encoding scheme, writing the resulting bytes to the
+         * given output byte array, starting at offset 0.
+         *
+         * <p> It is the responsibility of the invoker of this method to make
+         * sure the output byte array {@code dst} has enough space for encoding
+         * all bytes from the input byte array. No bytes will be written to the
+         * output byte array if the output byte array is not big enough.
+         *
+         * @param   src
+         *          the byte array to encode
+         * @param   dst
+         *          the output byte array
+         * @return  The number of bytes written to the output byte array
+         *
+         * @throws  IllegalArgumentException if {@code dst} does not have enough
+         *          space for encoding all input bytes.
+         */
+        public int encode(byte[] src, byte[] dst) {
+            int len = outLength(src.length);         // dst array size
+            if (dst.length < len)
+                throw new IllegalArgumentException(
+                    "Output byte array is too small for encoding all input bytes");
+            return encode0(src, 0, src.length, dst);
+        }
+
+        /**
+         * Encodes the specified byte array into a String using the {@link Base64}
+         * encoding scheme.
+         *
+         * <p> This method first encodes all input bytes into a base64 encoded
+         * byte array and then constructs a new String by using the encoded byte
+         * array and the {@link java.nio.charset.StandardCharsets#ISO_8859_1
+         * ISO-8859-1} charset.
+         *
+         * <p> In other words, an invocation of this method has exactly the same
+         * effect as invoking
+         * {@code new String(encode(src), StandardCharsets.ISO_8859_1)}.
+         *
+         * @param   src
+         *          the byte array to encode
+         * @return  A String containing the resulting Base64 encoded characters
+         */
+        @SuppressWarnings("deprecation")
+        public String encodeToString(byte[] src) {
+            byte[] encoded = encode(src);
+            return new String(encoded, 0, 0, encoded.length);
+        }
+
+        /**
+         * Encodes all remaining bytes from the specified byte buffer into
+         * a newly-allocated ByteBuffer using the {@link Base64} encoding
+         * scheme.
+         *
+         * Upon return, the source buffer's position will be updated to
+         * its limit; its limit will not have been changed. The returned
+         * output buffer's position will be zero and its limit will be the
+         * number of resulting encoded bytes.
+         *
+         * @param   buffer
+         *          the source ByteBuffer to encode
+         * @return  A newly-allocated byte buffer containing the encoded bytes.
+         */
+        public ByteBuffer encode(ByteBuffer buffer) {
+            int len = outLength(buffer.remaining());
+            byte[] dst = new byte[len];
+            int ret = 0;
+            if (buffer.hasArray()) {
+                ret = encode0(buffer.array(),
+                              buffer.arrayOffset() + buffer.position(),
+                              buffer.arrayOffset() + buffer.limit(),
+                              dst);
+                buffer.position(buffer.limit());
+            } else {
+                byte[] src = new byte[buffer.remaining()];
+                buffer.get(src);
+                ret = encode0(src, 0, src.length, dst);
+            }
+            if (ret != dst.length)
+                 dst = Arrays.copyOf(dst, ret);
+            return ByteBuffer.wrap(dst);
+        }
+
+        /**
+         * Wraps an output stream for encoding byte data using the {@link Base64}
+         * encoding scheme.
+         *
+         * <p> It is recommended to promptly close the returned output stream after
+         * use, during which it will flush all possible leftover bytes to the underlying
+         * output stream. Closing the returned output stream will close the underlying
+         * output stream.
+         *
+         * @param   os
+         *          the output stream.
+         * @return  the output stream for encoding the byte data into the
+         *          specified Base64 encoded format
+         */
+        public OutputStream wrap(OutputStream os) {
+            Objects.requireNonNull(os);
+            return new EncOutputStream(os, isURL ? toBase64URL : toBase64,
+                                       newline, linemax, doPadding);
+        }
+
+        /**
+         * Returns an encoder instance that encodes equivalently to this one,
+         * but without adding any padding character at the end of the encoded
+         * byte data.
+         *
+         * <p> The encoding scheme of this encoder instance is unaffected by
+         * this invocation. The returned encoder instance should be used for
+         * non-padding encoding operation.
+         *
+         * @return an equivalent encoder that encodes without adding any
+         *         padding character at the end
+         */
+        public Encoder withoutPadding() {
+            if (!doPadding)
+                return this;
+            return new Encoder(isURL, newline, linemax, false);
+        }
+
+        private int encode0(byte[] src, int off, int end, byte[] dst) {
+            char[] base64 = isURL ? toBase64URL : toBase64;
+            int sp = off;
+            int slen = (end - off) / 3 * 3;
+            int sl = off + slen;
+            if (linemax > 0 && slen  > linemax / 4 * 3)
+                slen = linemax / 4 * 3;
+            int dp = 0;
+            while (sp < sl) {
+                int sl0 = Math.min(sp + slen, sl);
+                for (int sp0 = sp, dp0 = dp ; sp0 < sl0; ) {
+                    int bits = (src[sp0++] & 0xff) << 16 |
+                               (src[sp0++] & 0xff) <<  8 |
+                               (src[sp0++] & 0xff);
+                    dst[dp0++] = (byte)base64[(bits >>> 18) & 0x3f];
+                    dst[dp0++] = (byte)base64[(bits >>> 12) & 0x3f];
+                    dst[dp0++] = (byte)base64[(bits >>> 6)  & 0x3f];
+                    dst[dp0++] = (byte)base64[bits & 0x3f];
+                }
+                int dlen = (sl0 - sp) / 3 * 4;
+                dp += dlen;
+                sp = sl0;
+                if (dlen == linemax && sp < end) {
+                    for (byte b : newline){
+                        dst[dp++] = b;
+                    }
+                }
+            }
+            if (sp < end) {               // 1 or 2 leftover bytes
+                int b0 = src[sp++] & 0xff;
+                dst[dp++] = (byte)base64[b0 >> 2];
+                if (sp == end) {
+                    dst[dp++] = (byte)base64[(b0 << 4) & 0x3f];
+                    if (doPadding) {
+                        dst[dp++] = '=';
+                        dst[dp++] = '=';
+                    }
+                } else {
+                    int b1 = src[sp++] & 0xff;
+                    dst[dp++] = (byte)base64[(b0 << 4) & 0x3f | (b1 >> 4)];
+                    dst[dp++] = (byte)base64[(b1 << 2) & 0x3f];
+                    if (doPadding) {
+                        dst[dp++] = '=';
+                    }
+                }
+            }
+            return dp;
+        }
+    }
+
+    /**
+     * This class implements a decoder for decoding byte data using the
+     * Base64 encoding scheme as specified in RFC 4648 and RFC 2045.
+     *
+     * <p> The Base64 padding character {@code '='} is accepted and
+     * interpreted as the end of the encoded byte data, but is not
+     * required. So if the final unit of the encoded byte data only has
+     * two or three Base64 characters (without the corresponding padding
+     * character(s) padded), they are decoded as if followed by padding
+     * character(s). If there is a padding character present in the
+     * final unit, the correct number of padding character(s) must be
+     * present, otherwise {@code IllegalArgumentException} (
+     * {@code IOException} when reading from a Base64 stream) is thrown
+     * during decoding.
+     *
+     * <p> Instances of {@link Decoder} class are safe for use by
+     * multiple concurrent threads.
+     *
+     * <p> Unless otherwise noted, passing a {@code null} argument to
+     * a method of this class will cause a
+     * {@link java.lang.NullPointerException NullPointerException} to
+     * be thrown.
+     *
+     * @see     Encoder
+     * @since   1.8
+     */
+    public static class Decoder {
+
+        private final boolean isURL;
+        private final boolean isMIME;
+
+        private Decoder(boolean isURL, boolean isMIME) {
+            this.isURL = isURL;
+            this.isMIME = isMIME;
+        }
+
+        /**
+         * Lookup table for decoding unicode characters drawn from the
+         * "Base64 Alphabet" (as specified in Table 1 of RFC 2045) into
+         * their 6-bit positive integer equivalents.  Characters that
+         * are not in the Base64 alphabet but fall within the bounds of
+         * the array are encoded to -1.
+         *
+         */
+        private static final int[] fromBase64 = new int[256];
+        static {
+            Arrays.fill(fromBase64, -1);
+            for (int i = 0; i < Encoder.toBase64.length; i++)
+                fromBase64[Encoder.toBase64[i]] = i;
+            fromBase64['='] = -2;
+        }
+
+        /**
+         * Lookup table for decoding "URL and Filename safe Base64 Alphabet"
+         * as specified in Table2 of the RFC 4648.
+         */
+        private static final int[] fromBase64URL = new int[256];
+
+        static {
+            Arrays.fill(fromBase64URL, -1);
+            for (int i = 0; i < Encoder.toBase64URL.length; i++)
+                fromBase64URL[Encoder.toBase64URL[i]] = i;
+            fromBase64URL['='] = -2;
+        }
+
+        static final Decoder RFC4648         = new Decoder(false, false);
+        static final Decoder RFC4648_URLSAFE = new Decoder(true, false);
+        static final Decoder RFC2045         = new Decoder(false, true);
+
+        /**
+         * Decodes all bytes from the input byte array using the {@link Base64}
+         * encoding scheme, writing the results into a newly-allocated output
+         * byte array. The returned byte array is of the length of the resulting
+         * bytes.
+         *
+         * @param   src
+         *          the byte array to decode
+         *
+         * @return  A newly-allocated byte array containing the decoded bytes.
+         *
+         * @throws  IllegalArgumentException
+         *          if {@code src} is not in valid Base64 scheme
+         */
+        public byte[] decode(byte[] src) {
+            byte[] dst = new byte[outLength(src, 0, src.length)];
+            int ret = decode0(src, 0, src.length, dst);
+            if (ret != dst.length) {
+                dst = Arrays.copyOf(dst, ret);
+            }
+            return dst;
+        }
+
+        /**
+         * Decodes a Base64 encoded String into a newly-allocated byte array
+         * using the {@link Base64} encoding scheme.
+         *
+         * <p> An invocation of this method has exactly the same effect as invoking
+         * {@code decode(src.getBytes(StandardCharsets.ISO_8859_1))}
+         *
+         * @param   src
+         *          the string to decode
+         *
+         * @return  A newly-allocated byte array containing the decoded bytes.
+         *
+         * @throws  IllegalArgumentException
+         *          if {@code src} is not in valid Base64 scheme
+         */
+        public byte[] decode(String src) {
+            return decode(src.getBytes(StandardCharsets.ISO_8859_1));
+        }
+
+        /**
+         * Decodes all bytes from the input byte array using the {@link Base64}
+         * encoding scheme, writing the results into the given output byte array,
+         * starting at offset 0.
+         *
+         * <p> It is the responsibility of the invoker of this method to make
+         * sure the output byte array {@code dst} has enough space for decoding
+         * all bytes from the input byte array. No bytes will be be written to
+         * the output byte array if the output byte array is not big enough.
+         *
+         * <p> If the input byte array is not in valid Base64 encoding scheme
+         * then some bytes may have been written to the output byte array before
+         * IllegalargumentException is thrown.
+         *
+         * @param   src
+         *          the byte array to decode
+         * @param   dst
+         *          the output byte array
+         *
+         * @return  The number of bytes written to the output byte array
+         *
+         * @throws  IllegalArgumentException
+         *          if {@code src} is not in valid Base64 scheme, or {@code dst}
+         *          does not have enough space for decoding all input bytes.
+         */
+        public int decode(byte[] src, byte[] dst) {
+            int len = outLength(src, 0, src.length);
+            if (dst.length < len)
+                throw new IllegalArgumentException(
+                    "Output byte array is too small for decoding all input bytes");
+            return decode0(src, 0, src.length, dst);
+        }
+
+        /**
+         * Decodes all bytes from the input byte buffer using the {@link Base64}
+         * encoding scheme, writing the results into a newly-allocated ByteBuffer.
+         *
+         * <p> Upon return, the source buffer's position will be updated to
+         * its limit; its limit will not have been changed. The returned
+         * output buffer's position will be zero and its limit will be the
+         * number of resulting decoded bytes
+         *
+         * <p> {@code IllegalArgumentException} is thrown if the input buffer
+         * is not in valid Base64 encoding scheme. The position of the input
+         * buffer will not be advanced in this case.
+         *
+         * @param   buffer
+         *          the ByteBuffer to decode
+         *
+         * @return  A newly-allocated byte buffer containing the decoded bytes
+         *
+         * @throws  IllegalArgumentException
+         *          if {@code src} is not in valid Base64 scheme.
+         */
+        public ByteBuffer decode(ByteBuffer buffer) {
+            int pos0 = buffer.position();
+            try {
+                byte[] src;
+                int sp, sl;
+                if (buffer.hasArray()) {
+                    src = buffer.array();
+                    sp = buffer.arrayOffset() + buffer.position();
+                    sl = buffer.arrayOffset() + buffer.limit();
+                    buffer.position(buffer.limit());
+                } else {
+                    src = new byte[buffer.remaining()];
+                    buffer.get(src);
+                    sp = 0;
+                    sl = src.length;
+                }
+                byte[] dst = new byte[outLength(src, sp, sl)];
+                return ByteBuffer.wrap(dst, 0, decode0(src, sp, sl, dst));
+            } catch (IllegalArgumentException iae) {
+                buffer.position(pos0);
+                throw iae;
+            }
+        }
+
+        /**
+         * Returns an input stream for decoding {@link Base64} encoded byte stream.
+         *
+         * <p> The {@code read}  methods of the returned {@code InputStream} will
+         * throw {@code IOException} when reading bytes that cannot be decoded.
+         *
+         * <p> Closing the returned input stream will close the underlying
+         * input stream.
+         *
+         * @param   is
+         *          the input stream
+         *
+         * @return  the input stream for decoding the specified Base64 encoded
+         *          byte stream
+         */
+        public InputStream wrap(InputStream is) {
+            Objects.requireNonNull(is);
+            return new DecInputStream(is, isURL ? fromBase64URL : fromBase64, isMIME);
+        }
+
+        private int outLength(byte[] src, int sp, int sl) {
+            int[] base64 = isURL ? fromBase64URL : fromBase64;
+            int paddings = 0;
+            int len = sl - sp;
+            if (len == 0)
+                return 0;
+            if (len < 2) {
+                if (isMIME && base64[0] == -1)
+                    return 0;
+                throw new IllegalArgumentException(
+                    "Input byte[] should at least have 2 bytes for base64 bytes");
+            }
+            if (isMIME) {
+                // scan all bytes to fill out all non-alphabet. a performance
+                // trade-off of pre-scan or Arrays.copyOf
+                int n = 0;
+                while (sp < sl) {
+                    int b = src[sp++] & 0xff;
+                    if (b == '=') {
+                        len -= (sl - sp + 1);
+                        break;
+                    }
+                    if ((b = base64[b]) == -1)
+                        n++;
+                }
+                len -= n;
+            } else {
+                if (src[sl - 1] == '=') {
+                    paddings++;
+                    if (src[sl - 2] == '=')
+                        paddings++;
+                }
+            }
+            if (paddings == 0 && (len & 0x3) !=  0)
+                paddings = 4 - (len & 0x3);
+            return 3 * ((len + 3) / 4) - paddings;
+        }
+
+        private int decode0(byte[] src, int sp, int sl, byte[] dst) {
+            int[] base64 = isURL ? fromBase64URL : fromBase64;
+            int dp = 0;
+            int bits = 0;
+            int shiftto = 18;       // pos of first byte of 4-byte atom
+            while (sp < sl) {
+                int b = src[sp++] & 0xff;
+                if ((b = base64[b]) < 0) {
+                    if (b == -2) {         // padding byte '='
+                        // =     shiftto==18 unnecessary padding
+                        // x=    shiftto==12 a dangling single x
+                        // x     to be handled together with non-padding case
+                        // xx=   shiftto==6&&sp==sl missing last =
+                        // xx=y  shiftto==6 last is not =
+                        if (shiftto == 6 && (sp == sl || src[sp++] != '=') ||
+                            shiftto == 18) {
+                            throw new IllegalArgumentException(
+                                "Input byte array has wrong 4-byte ending unit");
+                        }
+                        break;
+                    }
+                    if (isMIME)    // skip if for rfc2045
+                        continue;
+                    else
+                        throw new IllegalArgumentException(
+                            "Illegal base64 character " +
+                            Integer.toString(src[sp - 1], 16));
+                }
+                bits |= (b << shiftto);
+                shiftto -= 6;
+                if (shiftto < 0) {
+                    dst[dp++] = (byte)(bits >> 16);
+                    dst[dp++] = (byte)(bits >>  8);
+                    dst[dp++] = (byte)(bits);
+                    shiftto = 18;
+                    bits = 0;
+                }
+            }
+            // reached end of byte array or hit padding '=' characters.
+            if (shiftto == 6) {
+                dst[dp++] = (byte)(bits >> 16);
+            } else if (shiftto == 0) {
+                dst[dp++] = (byte)(bits >> 16);
+                dst[dp++] = (byte)(bits >>  8);
+            } else if (shiftto == 12) {
+                // dangling single "x", incorrectly encoded.
+                throw new IllegalArgumentException(
+                    "Last unit does not have enough valid bits");
+            }
+            // anything left is invalid, if is not MIME.
+            // if MIME, ignore all non-base64 character
+            while (sp < sl) {
+                if (isMIME && base64[src[sp++]] < 0)
+                    continue;
+                throw new IllegalArgumentException(
+                    "Input byte array has incorrect ending byte at " + sp);
+            }
+            return dp;
+        }
+    }
+
+    /*
+     * An output stream for encoding bytes into the Base64.
+     */
+    private static class EncOutputStream extends FilterOutputStream {
+
+        private int leftover = 0;
+        private int b0, b1, b2;
+        private boolean closed = false;
+
+        private final char[] base64;    // byte->base64 mapping
+        private final byte[] newline;   // line separator, if needed
+        private final int linemax;
+        private final boolean doPadding;// whether or not to pad
+        private int linepos = 0;
+
+        EncOutputStream(OutputStream os, char[] base64,
+                        byte[] newline, int linemax, boolean doPadding) {
+            super(os);
+            this.base64 = base64;
+            this.newline = newline;
+            this.linemax = linemax;
+            this.doPadding = doPadding;
+        }
+
+        @Override
+        public void write(int b) throws IOException {
+            byte[] buf = new byte[1];
+            buf[0] = (byte)(b & 0xff);
+            write(buf, 0, 1);
+        }
+
+        private void checkNewline() throws IOException {
+            if (linepos == linemax) {
+                out.write(newline);
+                linepos = 0;
+            }
+        }
+
+        @Override
+        public void write(byte[] b, int off, int len) throws IOException {
+            if (closed)
+                throw new IOException("Stream is closed");
+            if (off < 0 || len < 0 || off + len > b.length)
+                throw new ArrayIndexOutOfBoundsException();
+            if (len == 0)
+                return;
+            if (leftover != 0) {
+                if (leftover == 1) {
+                    b1 = b[off++] & 0xff;
+                    len--;
+                    if (len == 0) {
+                        leftover++;
+                        return;
+                    }
+                }
+                b2 = b[off++] & 0xff;
+                len--;
+                checkNewline();
+                out.write(base64[b0 >> 2]);
+                out.write(base64[(b0 << 4) & 0x3f | (b1 >> 4)]);
+                out.write(base64[(b1 << 2) & 0x3f | (b2 >> 6)]);
+                out.write(base64[b2 & 0x3f]);
+                linepos += 4;
+            }
+            int nBits24 = len / 3;
+            leftover = len - (nBits24 * 3);
+            while (nBits24-- > 0) {
+                checkNewline();
+                int bits = (b[off++] & 0xff) << 16 |
+                           (b[off++] & 0xff) <<  8 |
+                           (b[off++] & 0xff);
+                out.write(base64[(bits >>> 18) & 0x3f]);
+                out.write(base64[(bits >>> 12) & 0x3f]);
+                out.write(base64[(bits >>> 6)  & 0x3f]);
+                out.write(base64[bits & 0x3f]);
+                linepos += 4;
+           }
+            if (leftover == 1) {
+                b0 = b[off++] & 0xff;
+            } else if (leftover == 2) {
+                b0 = b[off++] & 0xff;
+                b1 = b[off++] & 0xff;
+            }
+        }
+
+        @Override
+        public void close() throws IOException {
+            if (!closed) {
+                closed = true;
+                if (leftover == 1) {
+                    checkNewline();
+                    out.write(base64[b0 >> 2]);
+                    out.write(base64[(b0 << 4) & 0x3f]);
+                    if (doPadding) {
+                        out.write('=');
+                        out.write('=');
+                    }
+                } else if (leftover == 2) {
+                    checkNewline();
+                    out.write(base64[b0 >> 2]);
+                    out.write(base64[(b0 << 4) & 0x3f | (b1 >> 4)]);
+                    out.write(base64[(b1 << 2) & 0x3f]);
+                    if (doPadding) {
+                       out.write('=');
+                    }
+                }
+                leftover = 0;
+                out.close();
+            }
+        }
+    }
+
+    /*
+     * An input stream for decoding Base64 bytes
+     */
+    private static class DecInputStream extends InputStream {
+
+        private final InputStream is;
+        private final boolean isMIME;
+        private final int[] base64;      // base64 -> byte mapping
+        private int bits = 0;            // 24-bit buffer for decoding
+        private int nextin = 18;         // next available "off" in "bits" for input;
+                                         // -> 18, 12, 6, 0
+        private int nextout = -8;        // next available "off" in "bits" for output;
+                                         // -> 8, 0, -8 (no byte for output)
+        private boolean eof = false;
+        private boolean closed = false;
+
+        DecInputStream(InputStream is, int[] base64, boolean isMIME) {
+            this.is = is;
+            this.base64 = base64;
+            this.isMIME = isMIME;
+        }
+
+        private byte[] sbBuf = new byte[1];
+
+        @Override
+        public int read() throws IOException {
+            return read(sbBuf, 0, 1) == -1 ? -1 : sbBuf[0] & 0xff;
+        }
+
+        @Override
+        public int read(byte[] b, int off, int len) throws IOException {
+            if (closed)
+                throw new IOException("Stream is closed");
+            if (eof && nextout < 0)    // eof and no leftover
+                return -1;
+            if (off < 0 || len < 0 || len > b.length - off)
+                throw new IndexOutOfBoundsException();
+            int oldOff = off;
+            if (nextout >= 0) {       // leftover output byte(s) in bits buf
+                do {
+                    if (len == 0)
+                        return off - oldOff;
+                    b[off++] = (byte)(bits >> nextout);
+                    len--;
+                    nextout -= 8;
+                } while (nextout >= 0);
+                bits = 0;
+            }
+            while (len > 0) {
+                int v = is.read();
+                if (v == -1) {
+                    eof = true;
+                    if (nextin != 18) {
+                        if (nextin == 12)
+                            throw new IOException("Base64 stream has one un-decoded dangling byte.");
+                        // treat ending xx/xxx without padding character legal.
+                        // same logic as v == '=' below
+                        b[off++] = (byte)(bits >> (16));
+                        len--;
+                        if (nextin == 0) {           // only one padding byte
+                            if (len == 0) {          // no enough output space
+                                bits >>= 8;          // shift to lowest byte
+                                nextout = 0;
+                            } else {
+                                b[off++] = (byte) (bits >>  8);
+                            }
+                        }
+                    }
+                    if (off == oldOff)
+                        return -1;
+                    else
+                        return off - oldOff;
+                }
+                if (v == '=') {                  // padding byte(s)
+                    // =     shiftto==18 unnecessary padding
+                    // x=    shiftto==12 dangling x, invalid unit
+                    // xx=   shiftto==6 && missing last '='
+                    // xx=y  or last is not '='
+                    if (nextin == 18 || nextin == 12 ||
+                        nextin == 6 && is.read() != '=') {
+                        throw new IOException("Illegal base64 ending sequence:" + nextin);
+                    }
+                    b[off++] = (byte)(bits >> (16));
+                    len--;
+                    if (nextin == 0) {           // only one padding byte
+                        if (len == 0) {          // no enough output space
+                            bits >>= 8;          // shift to lowest byte
+                            nextout = 0;
+                        } else {
+                            b[off++] = (byte) (bits >>  8);
+                        }
+                    }
+                    eof = true;
+                    break;
+                }
+                if ((v = base64[v]) == -1) {
+                    if (isMIME)                 // skip if for rfc2045
+                        continue;
+                    else
+                        throw new IOException("Illegal base64 character " +
+                            Integer.toString(v, 16));
+                }
+                bits |= (v << nextin);
+                if (nextin == 0) {
+                    nextin = 18;    // clear for next
+                    nextout = 16;
+                    while (nextout >= 0) {
+                        b[off++] = (byte)(bits >> nextout);
+                        len--;
+                        nextout -= 8;
+                        if (len == 0 && nextout >= 0) {  // don't clean "bits"
+                            return off - oldOff;
+                        }
+                    }
+                    bits = 0;
+                } else {
+                    nextin -= 6;
+                }
+            }
+            return off - oldOff;
+        }
+
+        @Override
+        public int available() throws IOException {
+            if (closed)
+                throw new IOException("Stream is closed");
+            return is.available();   // TBD:
+        }
+
+        @Override
+        public void close() throws IOException {
+            if (!closed) {
+                closed = true;
+                is.close();
+            }
+        }
+    }
+}
diff --git a/ojluni/src/main/java/java/util/BitSet.java b/ojluni/src/main/java/java/util/BitSet.java
index 3620cee..261a77c 100644
--- a/ojluni/src/main/java/java/util/BitSet.java
+++ b/ojluni/src/main/java/java/util/BitSet.java
@@ -189,6 +189,7 @@
      * @param longs a long array containing a little-endian representation
      *        of a sequence of bits to be used as the initial bits of the
      *        new bit set
+     * @return a {@code BitSet} containing all the bits in the long array
      * @since 1.7
      */
     public static BitSet valueOf(long[] longs) {
@@ -212,6 +213,8 @@
      * @param lb a long buffer containing a little-endian representation
      *        of a sequence of bits between its position and limit, to be
      *        used as the initial bits of the new bit set
+     * @return a {@code BitSet} containing all the bits in the buffer in the
+     *         specified range
      * @since 1.7
      */
     public static BitSet valueOf(LongBuffer lb) {
@@ -237,6 +240,7 @@
      * @param bytes a byte array containing a little-endian
      *        representation of a sequence of bits to be used as the
      *        initial bits of the new bit set
+     * @return a {@code BitSet} containing all the bits in the byte array
      * @since 1.7
      */
     public static BitSet valueOf(byte[] bytes) {
@@ -257,6 +261,8 @@
      * @param bb a byte buffer containing a little-endian representation
      *        of a sequence of bits between its position and limit, to be
      *        used as the initial bits of the new bit set
+     * @return a {@code BitSet} containing all the bits in the buffer in the
+     *         specified range
      * @since 1.7
      */
     public static BitSet valueOf(ByteBuffer bb) {
@@ -690,6 +696,9 @@
      *  <pre> {@code
      * for (int i = bs.nextSetBit(0); i >= 0; i = bs.nextSetBit(i+1)) {
      *     // operate on index i here
+     *     if (i == Integer.MAX_VALUE) {
+     *         break; // or (i+1) would overflow
+     *     }
      * }}</pre>
      *
      * @param  fromIndex the index to start checking from (inclusive)
@@ -1094,7 +1103,7 @@
             result.checkInvariants();
             return result;
         } catch (CloneNotSupportedException e) {
-            throw new InternalError();
+            throw new InternalError(e);
         }
     }
 
@@ -1158,10 +1167,10 @@
      * <p>Example:
      * <pre>
      * BitSet drPepper = new BitSet();</pre>
-     * Now {@code drPepper.toString()} returns "{@code {}}".<p>
+     * Now {@code drPepper.toString()} returns "{@code {}}".
      * <pre>
      * drPepper.set(2);</pre>
-     * Now {@code drPepper.toString()} returns "{@code {2}}".<p>
+     * Now {@code drPepper.toString()} returns "{@code {2}}".
      * <pre>
      * drPepper.set(4);
      * drPepper.set(10);</pre>
@@ -1180,10 +1189,12 @@
         int i = nextSetBit(0);
         if (i != -1) {
             b.append(i);
-            for (i = nextSetBit(i+1); i >= 0; i = nextSetBit(i+1)) {
+            while (true) {
+                if (++i < 0) break;
+                if ((i = nextSetBit(i)) < 0) break;
                 int endOfRun = nextClearBit(i);
                 do { b.append(", ").append(i); }
-                while (++i < endOfRun);
+                while (++i != endOfRun);
             }
         }
 
diff --git a/ojluni/src/main/java/java/util/Collection.java b/ojluni/src/main/java/java/util/Collection.java
index 7db86aa..e4c6b4c 100644
--- a/ojluni/src/main/java/java/util/Collection.java
+++ b/ojluni/src/main/java/java/util/Collection.java
@@ -104,10 +104,23 @@
  * the specified behavior of underlying {@link Object} methods wherever the
  * implementor deems it appropriate.
  *
+ * <p>Some collection operations which perform recursive traversal of the
+ * collection may fail with an exception for self-referential instances where
+ * the collection directly or indirectly contains itself. This includes the
+ * {@code clone()}, {@code equals()}, {@code hashCode()} and {@code toString()}
+ * methods. Implementations may optionally handle the self-referential scenario,
+ * however most current implementations do not do so.
+ *
  * <p>This interface is a member of the
  * <a href="{@docRoot}openjdk-redirect.html?v=8&path=/technotes/guides/collections/index.html">
  * Java Collections Framework</a>.
  *
+ * @implSpec
+ * The default method implementations (inherited or otherwise) do not apply any
+ * synchronization protocol.  If a {@code Collection} implementation has a
+ * specific synchronization protocol, then it must override default
+ * implementations to apply that protocol.
+ *
  * @param <E> the type of elements in this collection
  *
  * @author  Josh Bloch
@@ -226,6 +239,7 @@
      * Note that <tt>toArray(new Object[0])</tt> is identical in function to
      * <tt>toArray()</tt>.
      *
+     * @param <T> the runtime type of the array to contain the collection
      * @param a the array into which the elements of this collection are to be
      *        stored, if it is big enough; otherwise, a new array of the same
      *        runtime type is allocated for this purpose.
@@ -370,7 +384,6 @@
      */
     boolean removeAll(Collection<?> c);
 
-
     /**
      * Removes all of the elements of this collection that satisfy the given
      * predicate.  Errors or runtime exceptions thrown during iteration or by
diff --git a/ojluni/src/main/java/java/util/ConcurrentModificationException.java b/ojluni/src/main/java/java/util/ConcurrentModificationException.java
index d525653..7e65d2a 100644
--- a/ojluni/src/main/java/java/util/ConcurrentModificationException.java
+++ b/ojluni/src/main/java/java/util/ConcurrentModificationException.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
diff --git a/ojluni/src/main/java/java/util/Observable.java b/ojluni/src/main/java/java/util/Observable.java
index 1d8be3b..1f21aaa 100644
--- a/ojluni/src/main/java/java/util/Observable.java
+++ b/ojluni/src/main/java/java/util/Observable.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1994, 2004, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1994, 2012, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -44,7 +44,7 @@
  * notifications on separate threads, or may guarantee that their
  * subclass follows this order, as they choose.
  * <p>
- * Note that this notification mechanism is has nothing to do with threads
+ * Note that this notification mechanism has nothing to do with threads
  * and is completely separate from the <tt>wait</tt> and <tt>notify</tt>
  * mechanism of class <tt>Object</tt>.
  * <p>
@@ -61,12 +61,12 @@
  */
 public class Observable {
     private boolean changed = false;
-    private final ArrayList<Observer> observers;
+    private Vector<Observer> obs;
 
     /** Construct an Observable with zero Observers. */
 
     public Observable() {
-        observers = new ArrayList<>();
+        obs = new Vector<>();
     }
 
     /**
@@ -81,8 +81,8 @@
     public synchronized void addObserver(Observer o) {
         if (o == null)
             throw new NullPointerException();
-        if (!observers.contains(o)) {
-            observers.add(o);
+        if (!obs.contains(o)) {
+            obs.addElement(o);
         }
     }
 
@@ -92,7 +92,7 @@
      * @param   o   the observer to be deleted.
      */
     public synchronized void deleteObserver(Observer o) {
-        observers.remove(o);
+        obs.removeElement(o);
     }
 
     /**
@@ -134,38 +134,37 @@
          * a temporary array buffer, used as a snapshot of the state of
          * current Observers.
          */
-        Observer[] arrLocal;
+        Object[] arrLocal;
 
         synchronized (this) {
             /* We don't want the Observer doing callbacks into
-             * arbitrary Observables while holding its own Monitor.
+             * arbitrary code while holding its own Monitor.
              * The code where we extract each Observable from
-             * the ArrayList and store the state of the Observer
+             * the Vector and store the state of the Observer
              * needs synchronization, but notifying observers
              * does not (should not).  The worst result of any
              * potential race-condition here is that:
-             *
              * 1) a newly-added Observer will miss a
              *   notification in progress
              * 2) a recently unregistered Observer will be
              *   wrongly notified when it doesn't care
              */
+            // Android-changed: Call out to hasChanged() to figure out if something changes.
             if (!hasChanged())
                 return;
-
-            arrLocal = observers.toArray(new Observer[observers.size()]);
+            arrLocal = obs.toArray();
             clearChanged();
         }
 
         for (int i = arrLocal.length-1; i>=0; i--)
-            arrLocal[i].update(this, arg);
+            ((Observer)arrLocal[i]).update(this, arg);
     }
 
     /**
      * Clears the observer list so that this object no longer has any observers.
      */
     public synchronized void deleteObservers() {
-        observers.clear();
+        obs.removeAllElements();
     }
 
     /**
@@ -210,6 +209,6 @@
      * @return  the number of observers of this object.
      */
     public synchronized int countObservers() {
-        return observers.size();
+        return obs.size();
     }
 }
diff --git a/ojluni/src/main/java/java/util/Scanner.java b/ojluni/src/main/java/java/util/Scanner.java
index fdc787d..d2ac697 100644
--- a/ojluni/src/main/java/java/util/Scanner.java
+++ b/ojluni/src/main/java/java/util/Scanner.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2014 The Android Open Source Project
- * Copyright (c) 2003, 2011, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -50,47 +50,51 @@
  *
  * <p>For example, this code allows a user to read a number from
  * <tt>System.in</tt>:
- * <blockquote><pre>
+ * <blockquote><pre>{@code
  *     Scanner sc = new Scanner(System.in);
  *     int i = sc.nextInt();
- * </pre></blockquote>
+ * }</pre></blockquote>
  *
  * <p>As another example, this code allows <code>long</code> types to be
  * assigned from entries in a file <code>myNumbers</code>:
- * <blockquote><pre>
+ * <blockquote><pre>{@code
  *      Scanner sc = new Scanner(new File("myNumbers"));
  *      while (sc.hasNextLong()) {
  *          long aLong = sc.nextLong();
- *      }</pre></blockquote>
+ *      }
+ * }</pre></blockquote>
  *
  * <p>The scanner can also use delimiters other than whitespace. This
  * example reads several items in from a string:
- *<blockquote><pre>
+ * <blockquote><pre>{@code
  *     String input = "1 fish 2 fish red fish blue fish";
  *     Scanner s = new Scanner(input).useDelimiter("\\s*fish\\s*");
  *     System.out.println(s.nextInt());
  *     System.out.println(s.nextInt());
  *     System.out.println(s.next());
  *     System.out.println(s.next());
- *     s.close(); </pre></blockquote>
+ *     s.close();
+ * }</pre></blockquote>
  * <p>
  * prints the following output:
- * <blockquote><pre>
+ * <blockquote><pre>{@code
  *     1
  *     2
  *     red
- *     blue </pre></blockquote>
+ *     blue
+ * }</pre></blockquote>
  *
  * <p>The same output can be generated with this code, which uses a regular
  * expression to parse all four tokens at once:
- *<blockquote><pre>
+ * <blockquote><pre>{@code
  *     String input = "1 fish 2 fish red fish blue fish";
  *     Scanner s = new Scanner(input);
  *     s.findInLine("(\\d+) fish (\\d+) fish (\\w+) fish (\\w+)");
  *     MatchResult result = s.match();
  *     for (int i=1; i<=result.groupCount(); i++)
  *         System.out.println(result.group(i));
- *     s.close(); </pre></blockquote>
+ *     s.close();
+ * }</pre></blockquote>
  *
  * <p>The <a name="default-delimiter">default whitespace delimiter</a> used
  * by a scanner is as recognized by {@link java.lang.Character}.{@link
@@ -146,13 +150,13 @@
  * {@link #reset} method will reset the value of the scanner's radix to
  * <code>10</code> regardless of whether it was previously changed.
  *
- * <a name="localized-numbers">
- * <h4> Localized numbers </h4>
+ * <h3> <a name="localized-numbers">Localized numbers</a> </h3>
  *
  * <p> An instance of this class is capable of scanning numbers in the standard
  * formats as well as in the formats of the scanner's locale. A scanner's
  * <a name="initial-locale">initial locale </a>is the value returned by the {@link
- * java.util.Locale#getDefault} method; it may be changed via the {@link
+ * java.util.Locale#getDefault(Locale.Category)
+ * Locale.getDefault(Locale.Category.FORMAT)} method; it may be changed via the {@link
  * #useLocale} method. The {@link #reset} method will reset the value of the
  * scanner's locale to the initial locale regardless of whether it was
  * previously changed.
@@ -163,186 +167,138 @@
  * {@link java.text.DecimalFormatSymbols DecimalFormatSymbols} object,
  * <tt>dfs</tt>.
  *
- * <blockquote><table>
- * <tr><td valign="top"><i>LocalGroupSeparator&nbsp;&nbsp;</i></td>
- *     <td valign="top">The character used to separate thousands groups,
- *                      <i>i.e.,</i>&nbsp;<tt>dfs.</tt>{@link
- *                      java.text.DecimalFormatSymbols#getGroupingSeparator
- *                      getGroupingSeparator()}</td></tr>
- * <tr><td valign="top"><i>LocalDecimalSeparator&nbsp;&nbsp;</i></td>
- *     <td valign="top">The character used for the decimal point,
- *                      <i>i.e.,</i>&nbsp;<tt>dfs.</tt>{@link
- *                      java.text.DecimalFormatSymbols#getDecimalSeparator
- *                      getDecimalSeparator()}</td></tr>
- * <tr><td valign="top"><i>LocalPositivePrefix&nbsp;&nbsp;</i></td>
- *     <td valign="top">The string that appears before a positive number (may
- *                      be empty), <i>i.e.,</i>&nbsp;<tt>df.</tt>{@link
- *                      java.text.DecimalFormat#getPositivePrefix
- *                      getPositivePrefix()}</td></tr>
- * <tr><td valign="top"><i>LocalPositiveSuffix&nbsp;&nbsp;</i></td>
- *     <td valign="top">The string that appears after a positive number (may be
- *                      empty), <i>i.e.,</i>&nbsp;<tt>df.</tt>{@link
- *                      java.text.DecimalFormat#getPositiveSuffix
- *                      getPositiveSuffix()}</td></tr>
- * <tr><td valign="top"><i>LocalNegativePrefix&nbsp;&nbsp;</i></td>
- *     <td valign="top">The string that appears before a negative number (may
- *                      be empty), <i>i.e.,</i>&nbsp;<tt>df.</tt>{@link
- *                      java.text.DecimalFormat#getNegativePrefix
- *                      getNegativePrefix()}</td></tr>
- * <tr><td valign="top"><i>LocalNegativeSuffix&nbsp;&nbsp;</i></td>
- *     <td valign="top">The string that appears after a negative number (may be
- *                      empty), <i>i.e.,</i>&nbsp;<tt>df.</tt>{@link
- *                      java.text.DecimalFormat#getNegativeSuffix
- *                      getNegativeSuffix()}</td></tr>
- * <tr><td valign="top"><i>LocalNaN&nbsp;&nbsp;</i></td>
- *     <td valign="top">The string that represents not-a-number for
- *                      floating-point values,
- *                      <i>i.e.,</i>&nbsp;<tt>dfs.</tt>{@link
- *                      java.text.DecimalFormatSymbols#getNaN
- *                      getNaN()}</td></tr>
- * <tr><td valign="top"><i>LocalInfinity&nbsp;&nbsp;</i></td>
- *     <td valign="top">The string that represents infinity for floating-point
- *                      values, <i>i.e.,</i>&nbsp;<tt>dfs.</tt>{@link
- *                      java.text.DecimalFormatSymbols#getInfinity
- *                      getInfinity()}</td></tr>
- * </table></blockquote>
+ * <blockquote><dl>
+ *     <dt><i>LocalGroupSeparator&nbsp;&nbsp;</i>
+ *         <dd>The character used to separate thousands groups,
+ *         <i>i.e.,</i>&nbsp;<tt>dfs.</tt>{@link
+ *         java.text.DecimalFormatSymbols#getGroupingSeparator
+ *         getGroupingSeparator()}
+ *     <dt><i>LocalDecimalSeparator&nbsp;&nbsp;</i>
+ *         <dd>The character used for the decimal point,
+ *     <i>i.e.,</i>&nbsp;<tt>dfs.</tt>{@link
+ *     java.text.DecimalFormatSymbols#getDecimalSeparator
+ *     getDecimalSeparator()}
+ *     <dt><i>LocalPositivePrefix&nbsp;&nbsp;</i>
+ *         <dd>The string that appears before a positive number (may
+ *         be empty), <i>i.e.,</i>&nbsp;<tt>df.</tt>{@link
+ *         java.text.DecimalFormat#getPositivePrefix
+ *         getPositivePrefix()}
+ *     <dt><i>LocalPositiveSuffix&nbsp;&nbsp;</i>
+ *         <dd>The string that appears after a positive number (may be
+ *         empty), <i>i.e.,</i>&nbsp;<tt>df.</tt>{@link
+ *         java.text.DecimalFormat#getPositiveSuffix
+ *         getPositiveSuffix()}
+ *     <dt><i>LocalNegativePrefix&nbsp;&nbsp;</i>
+ *         <dd>The string that appears before a negative number (may
+ *         be empty), <i>i.e.,</i>&nbsp;<tt>df.</tt>{@link
+ *         java.text.DecimalFormat#getNegativePrefix
+ *         getNegativePrefix()}
+ *     <dt><i>LocalNegativeSuffix&nbsp;&nbsp;</i>
+ *         <dd>The string that appears after a negative number (may be
+ *         empty), <i>i.e.,</i>&nbsp;<tt>df.</tt>{@link
+ *     java.text.DecimalFormat#getNegativeSuffix
+ *     getNegativeSuffix()}
+ *     <dt><i>LocalNaN&nbsp;&nbsp;</i>
+ *         <dd>The string that represents not-a-number for
+ *         floating-point values,
+ *         <i>i.e.,</i>&nbsp;<tt>dfs.</tt>{@link
+ *         java.text.DecimalFormatSymbols#getNaN
+ *         getNaN()}
+ *     <dt><i>LocalInfinity&nbsp;&nbsp;</i>
+ *         <dd>The string that represents infinity for floating-point
+ *         values, <i>i.e.,</i>&nbsp;<tt>dfs.</tt>{@link
+ *         java.text.DecimalFormatSymbols#getInfinity
+ *         getInfinity()}
+ * </dl></blockquote>
  *
- * <a name="number-syntax">
- * <h4> Number syntax </h4>
+ * <h4> <a name="number-syntax">Number syntax</a> </h4>
  *
  * <p> The strings that can be parsed as numbers by an instance of this class
  * are specified in terms of the following regular-expression grammar, where
- * Rmax is the highest digit in the radix being used (for example, Rmax is 9
- * in base 10).
+ * Rmax is the highest digit in the radix being used (for example, Rmax is 9 in base 10).
  *
- * <p>
- * <table cellspacing=0 cellpadding=0 align=center>
- *
- *   <tr><td valign=top align=right><i>NonASCIIDigit</i>&nbsp;&nbsp;::</td>
- *       <td valign=top>= A non-ASCII character c for which
+ * <dl>
+ *   <dt><i>NonAsciiDigit</i>:
+ *       <dd>A non-ASCII character c for which
  *            {@link java.lang.Character#isDigit Character.isDigit}<tt>(c)</tt>
- *                        returns&nbsp;true</td></tr>
+ *                        returns&nbsp;true
  *
- *   <tr><td>&nbsp;</td></tr>
+ *   <dt><i>Non0Digit</i>:
+ *       <dd><tt>[1-</tt><i>Rmax</i><tt>] | </tt><i>NonASCIIDigit</i>
  *
- *   <tr><td align=right><i>Non0Digit</i>&nbsp;&nbsp;::</td>
- *   <td><tt>= [1-</tt><i>Rmax</i><tt>] | </tt><i>NonASCIIDigit</i></td></tr>
+ *   <dt><i>Digit</i>:
+ *       <dd><tt>[0-</tt><i>Rmax</i><tt>] | </tt><i>NonASCIIDigit</i>
  *
- *   <tr><td>&nbsp;</td></tr>
+ *   <dt><i>GroupedNumeral</i>:
+ *       <dd><tt>(&nbsp;</tt><i>Non0Digit</i>
+ *                   <i>Digit</i><tt>?
+ *                   </tt><i>Digit</i><tt>?</tt>
+ *       <dd>&nbsp;&nbsp;&nbsp;&nbsp;<tt>(&nbsp;</tt><i>LocalGroupSeparator</i>
+ *                         <i>Digit</i>
+ *                         <i>Digit</i>
+ *                         <i>Digit</i><tt> )+ )</tt>
  *
- *   <tr><td align=right><i>Digit</i>&nbsp;&nbsp;::</td>
- *   <td><tt>= [0-</tt><i>Rmax</i><tt>] | </tt><i>NonASCIIDigit</i></td></tr>
+ *   <dt><i>Numeral</i>:
+ *       <dd><tt>( ( </tt><i>Digit</i><tt>+ )
+ *               | </tt><i>GroupedNumeral</i><tt> )</tt>
  *
- *   <tr><td>&nbsp;</td></tr>
+ *   <dt><a name="Integer-regex"><i>Integer</i>:</a>
+ *       <dd><tt>( [-+]? ( </tt><i>Numeral</i><tt>
+ *                               ) )</tt>
+ *       <dd><tt>| </tt><i>LocalPositivePrefix</i> <i>Numeral</i>
+ *                      <i>LocalPositiveSuffix</i>
+ *       <dd><tt>| </tt><i>LocalNegativePrefix</i> <i>Numeral</i>
+ *                 <i>LocalNegativeSuffix</i>
  *
- *   <tr><td valign=top align=right><i>GroupedNumeral</i>&nbsp;&nbsp;::</td>
- *       <td valign=top>
- *         <table cellpadding=0 cellspacing=0>
- *           <tr><td><tt>= (&nbsp;</tt></td>
- *               <td><i>Non0Digit</i><tt>
- *                   </tt><i>Digit</i><tt>?
- *                   </tt><i>Digit</i><tt>?</tt></td></tr>
- *           <tr><td></td>
- *               <td><tt>(&nbsp;</tt><i>LocalGroupSeparator</i><tt>
- *                         </tt><i>Digit</i><tt>
- *                         </tt><i>Digit</i><tt>
- *                         </tt><i>Digit</i><tt> )+ )</tt></td></tr>
- *         </table></td></tr>
+ *   <dt><i>DecimalNumeral</i>:
+ *       <dd><i>Numeral</i>
+ *       <dd><tt>| </tt><i>Numeral</i>
+ *                 <i>LocalDecimalSeparator</i>
+ *                 <i>Digit</i><tt>*</tt>
+ *       <dd><tt>| </tt><i>LocalDecimalSeparator</i>
+ *                 <i>Digit</i><tt>+</tt>
  *
- *   <tr><td>&nbsp;</td></tr>
+ *   <dt><i>Exponent</i>:
+ *       <dd><tt>( [eE] [+-]? </tt><i>Digit</i><tt>+ )</tt>
  *
- *   <tr><td align=right><i>Numeral</i>&nbsp;&nbsp;::</td>
- *       <td><tt>= ( ( </tt><i>Digit</i><tt>+ )
- *               | </tt><i>GroupedNumeral</i><tt> )</tt></td></tr>
+ *   <dt><a name="Decimal-regex"><i>Decimal</i>:</a>
+ *       <dd><tt>( [-+]? </tt><i>DecimalNumeral</i>
+ *                         <i>Exponent</i><tt>? )</tt>
+ *       <dd><tt>| </tt><i>LocalPositivePrefix</i>
+ *                 <i>DecimalNumeral</i>
+ *                 <i>LocalPositiveSuffix</i>
+ *                 <i>Exponent</i><tt>?</tt>
+ *       <dd><tt>| </tt><i>LocalNegativePrefix</i>
+ *                 <i>DecimalNumeral</i>
+ *                 <i>LocalNegativeSuffix</i>
+ *                 <i>Exponent</i><tt>?</tt>
  *
- *   <tr><td>&nbsp;</td></tr>
+ *   <dt><i>HexFloat</i>:
+ *       <dd><tt>[-+]? 0[xX][0-9a-fA-F]*\.[0-9a-fA-F]+
+ *                 ([pP][-+]?[0-9]+)?</tt>
  *
- *   <tr><td valign=top align=right>
- *         <a name="Integer-regex"><i>Integer</i>&nbsp;&nbsp;::</td>
- *       <td valign=top><tt>= ( [-+]? ( </tt><i>Numeral</i><tt>
- *                               ) )</tt></td></tr>
- *   <tr><td></td>
- *       <td><tt>| </tt><i>LocalPositivePrefix</i><tt> </tt><i>Numeral</i><tt>
- *                      </tt><i>LocalPositiveSuffix</i></td></tr>
- *   <tr><td></td>
- *       <td><tt>| </tt><i>LocalNegativePrefix</i><tt> </tt><i>Numeral</i><tt>
- *                 </tt><i>LocalNegativeSuffix</i></td></tr>
- *
- *   <tr><td>&nbsp;</td></tr>
- *
- *   <tr><td align=right><i>DecimalNumeral</i>&nbsp;&nbsp;::</td>
- *       <td><tt>= </tt><i>Numeral</i></td></tr>
- *   <tr><td></td>
- *       <td><tt>| </tt><i>Numeral</i><tt>
- *                 </tt><i>LocalDecimalSeparator</i><tt>
- *                 </tt><i>Digit</i><tt>*</tt></td></tr>
- *   <tr><td></td>
- *       <td><tt>| </tt><i>LocalDecimalSeparator</i><tt>
- *                 </tt><i>Digit</i><tt>+</tt></td></tr>
- *
- *   <tr><td>&nbsp;</td></tr>
- *
- *   <tr><td align=right><i>Exponent</i>&nbsp;&nbsp;::</td>
- *       <td><tt>= ( [eE] [+-]? </tt><i>Digit</i><tt>+ )</tt></td></tr>
- *
- *   <tr><td>&nbsp;</td></tr>
- *
- *   <tr><td align=right>
- *         <a name="Decimal-regex"><i>Decimal</i>&nbsp;&nbsp;::</td>
- *       <td><tt>= ( [-+]? </tt><i>DecimalNumeral</i><tt>
- *                         </tt><i>Exponent</i><tt>? )</tt></td></tr>
- *   <tr><td></td>
- *       <td><tt>| </tt><i>LocalPositivePrefix</i><tt>
- *                 </tt><i>DecimalNumeral</i><tt>
- *                 </tt><i>LocalPositiveSuffix</i>
- *                 </tt><i>Exponent</i><tt>?</td></tr>
- *   <tr><td></td>
- *       <td><tt>| </tt><i>LocalNegativePrefix</i><tt>
- *                 </tt><i>DecimalNumeral</i><tt>
- *                 </tt><i>LocalNegativeSuffix</i>
- *                 </tt><i>Exponent</i><tt>?</td></tr>
- *
- *   <tr><td>&nbsp;</td></tr>
- *
- *   <tr><td align=right><i>HexFloat</i>&nbsp;&nbsp;::</td>
- *       <td><tt>= [-+]? 0[xX][0-9a-fA-F]*\.[0-9a-fA-F]+
- *                 ([pP][-+]?[0-9]+)?</tt></td></tr>
- *
- *   <tr><td>&nbsp;</td></tr>
- *
- *   <tr><td align=right><i>NonNumber</i>&nbsp;&nbsp;::</td>
- *       <td valign=top><tt>= NaN
+ *   <dt><i>NonNumber</i>:
+ *       <dd><tt>NaN
  *                          | </tt><i>LocalNan</i><tt>
  *                          | Infinity
- *                          | </tt><i>LocalInfinity</i></td></tr>
+ *                          | </tt><i>LocalInfinity</i>
  *
- *   <tr><td>&nbsp;</td></tr>
+ *   <dt><i>SignedNonNumber</i>:
+ *       <dd><tt>( [-+]? </tt><i>NonNumber</i><tt> )</tt>
+ *       <dd><tt>| </tt><i>LocalPositivePrefix</i>
+ *                 <i>NonNumber</i>
+ *                 <i>LocalPositiveSuffix</i>
+ *       <dd><tt>| </tt><i>LocalNegativePrefix</i>
+ *                 <i>NonNumber</i>
+ *                 <i>LocalNegativeSuffix</i>
  *
- *   <tr><td align=right><i>SignedNonNumber</i>&nbsp;&nbsp;::</td>
- *       <td><tt>= ( [-+]? </tt><i>NonNumber</i><tt> )</tt></td></tr>
- *   <tr><td></td>
- *       <td><tt>| </tt><i>LocalPositivePrefix</i><tt>
- *                 </tt><i>NonNumber</i><tt>
- *                 </tt><i>LocalPositiveSuffix</i></td></tr>
- *   <tr><td></td>
- *       <td><tt>| </tt><i>LocalNegativePrefix</i><tt>
- *                 </tt><i>NonNumber</i><tt>
- *                 </tt><i>LocalNegativeSuffix</i></td></tr>
+ *   <dt><a name="Float-regex"><i>Float</i></a>:
+ *       <dd><i>Decimal</i>
+ *           <tt>| </tt><i>HexFloat</i>
+ *           <tt>| </tt><i>SignedNonNumber</i>
  *
- *   <tr><td>&nbsp;</td></tr>
- *
- *   <tr><td valign=top align=right>
- *         <a name="Float-regex"><i>Float</i>&nbsp;&nbsp;::</td>
- *       <td valign=top><tt>= </tt><i>Decimal</i><tt></td></tr>
- *       <tr><td></td>
- *           <td><tt>| </tt><i>HexFloat</i><tt></td></tr>
- *       <tr><td></td>
- *           <td><tt>| </tt><i>SignedNonNumber</i><tt></td></tr>
- *
- * </table>
- * </center>
- *
- * <p> Whitespace is not significant in the above regular expressions.
+ * </dl>
+ * <p>Whitespace is not significant in the above regular expressions.
  *
  * @since   1.5
  */
@@ -466,7 +422,7 @@
     private int SIMPLE_GROUP_INDEX = 5;
     private String buildIntegerPatternString() {
         String radixDigits = digits.substring(0, radix);
-        // Android changed : Support non-decimal starting digits. (i.e, a-z are valid radix digits).
+        // Android-changed : Support non-decimal starting digits. (i.e, a-z are valid radix digits).
         String nonZeroRadixDigits = "((?i)[" + digits.substring(1, radix) + "]|(" + non0Digit + "))";
 
         // \\p{javaDigit} is not guaranteed to be appropriate
@@ -474,7 +430,7 @@
         // whatever parse method is invoked, so ultimately the
         // Scanner will do the right thing
         String digit = "((?i)["+radixDigits+"]|\\p{javaDigit})";
-        // Android changed : Support non-decimal starting digits.
+        // Android-changed : Support non-decimal starting digits.
         String groupedNumeral = "("+nonZeroRadixDigits+digit+"?"+digit+"?("+
                                 groupSeparator+digit+digit+digit+")+)";
         // digit++ is the possessive form which is necessary for reducing
@@ -573,9 +529,8 @@
      * Constructs a <code>Scanner</code> that returns values scanned
      * from the specified source delimited by the specified pattern.
      *
-     * @param  source A character source implementing the Readable interface
+     * @param source A character source implementing the Readable interface
      * @param pattern A delimiting pattern
-     * @return A scanner with the specified source and pattern
      */
     private Scanner(Readable source, Pattern pattern) {
         assert source != null : "source should not be null";
@@ -741,7 +696,7 @@
     public Scanner(Path source, String charsetName) throws IOException {
         this(Objects.requireNonNull(source), toCharset(charsetName));
     }
-    
+
     private Scanner(Path source, Charset charset)  throws IOException {
         this(makeReadable(Files.newInputStream(source), charset));
     }
@@ -1688,6 +1643,7 @@
      * <tt>findWithinHorizon(Pattern.compile(pattern, horizon))</tt>.
      *
      * @param pattern a string specifying the pattern to search for
+     * @param horizon the search horizon
      * @return the text that matched the specified pattern
      * @throws IllegalStateException if this scanner is closed
      * @throws IllegalArgumentException if horizon is negative
@@ -1722,6 +1678,7 @@
      * thrown.
      *
      * @param pattern the pattern to scan for
+     * @param horizon the search horizon
      * @return the text that matched the specified pattern
      * @throws IllegalStateException if this scanner is closed
      * @throws IllegalArgumentException if horizon is negative
@@ -2660,11 +2617,11 @@
      * <tt>scanner.reset()</tt> behaves in exactly the same way as the
      * invocation
      *
-     * <blockquote><pre>
+     * <blockquote><pre>{@code
      *   scanner.useDelimiter("\\p{javaWhitespace}+")
-     *          .useLocale(Locale.getDefault())
+     *          .useLocale(Locale.getDefault(Locale.Category.FORMAT))
      *          .useRadix(10);
-     * </pre></blockquote>
+     * }</pre></blockquote>
      *
      * @return this scanner
      *
diff --git a/ojluni/src/main/java/java/util/UUID.java b/ojluni/src/main/java/java/util/UUID.java
index 7e30b9e..b4ea41f 100644
--- a/ojluni/src/main/java/java/util/UUID.java
+++ b/ojluni/src/main/java/java/util/UUID.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003, 2011, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2003, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -164,7 +164,7 @@
         try {
             md = MessageDigest.getInstance("MD5");
         } catch (NoSuchAlgorithmException nsae) {
-            throw new InternalError("MD5 not supported");
+            throw new InternalError("MD5 not supported", nsae);
         }
         byte[] md5Bytes = md.digest(name);
         md5Bytes[6]  &= 0x0f;  /* clear version        */
@@ -233,7 +233,7 @@
      * number describes how this {@code UUID} was generated.
      *
      * The version number has the following meaning:
-     * <p><ul>
+     * <ul>
      * <li>1    Time-based UUID
      * <li>2    DCE security UUID
      * <li>3    Name-based UUID
@@ -252,7 +252,7 @@
      * number describes the layout of the {@code UUID}.
      *
      * The variant number has the following meaning:
-     * <p><ul>
+     * <ul>
      * <li>0    Reserved for NCS backward compatibility
      * <li>2    <a href="http://www.ietf.org/rfc/rfc4122.txt">IETF&nbsp;RFC&nbsp;4122</a>
      * (Leach-Salz), used by this class
@@ -286,6 +286,7 @@
      *
      * @throws UnsupportedOperationException
      *         If this UUID is not a version 1 UUID
+     * @return The timestamp of this {@code UUID}.
      */
     public long timestamp() {
         if (version() != 1) {
diff --git a/ojluni/src/main/java/sun/security/x509/X509CRLImpl.java b/ojluni/src/main/java/sun/security/x509/X509CRLImpl.java
index 0a4cc4e..96e9763 100644
--- a/ojluni/src/main/java/sun/security/x509/X509CRLImpl.java
+++ b/ojluni/src/main/java/sun/security/x509/X509CRLImpl.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2012, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -32,7 +32,7 @@
 import java.security.Principal;
 import java.security.PublicKey;
 import java.security.PrivateKey;
-import java.security.Security;
+import java.security.Provider;
 import java.security.Signature;
 import java.security.NoSuchAlgorithmException;
 import java.security.InvalidKeyException;
@@ -400,6 +400,65 @@
     }
 
     /**
+     * Verifies that this CRL was signed using the
+     * private key that corresponds to the given public key,
+     * and that the signature verification was computed by
+     * the given provider. Note that the specified Provider object
+     * does not have to be registered in the provider list.
+     *
+     * @param key the PublicKey used to carry out the verification.
+     * @param sigProvider the signature provider.
+     *
+     * @exception NoSuchAlgorithmException on unsupported signature
+     * algorithms.
+     * @exception InvalidKeyException on incorrect key.
+     * @exception SignatureException on signature errors.
+     * @exception CRLException on encoding errors.
+     */
+    public synchronized void verify(PublicKey key, Provider sigProvider)
+            throws CRLException, NoSuchAlgorithmException, InvalidKeyException,
+            SignatureException {
+
+        if (signedCRL == null) {
+            throw new CRLException("Uninitialized CRL");
+        }
+        Signature sigVerf = null;
+        if (sigProvider == null) {
+            sigVerf = Signature.getInstance(sigAlgId.getName());
+        } else {
+            sigVerf = Signature.getInstance(sigAlgId.getName(), sigProvider);
+        }
+        sigVerf.initVerify(key);
+
+        if (tbsCertList == null) {
+            throw new CRLException("Uninitialized CRL");
+        }
+
+        sigVerf.update(tbsCertList, 0, tbsCertList.length);
+
+        if (!sigVerf.verify(signature)) {
+            throw new SignatureException("Signature does not match.");
+        }
+        verifiedPublicKey = key;
+    }
+
+    /**
+     * This static method is the default implementation of the
+     * verify(PublicKey key, Provider sigProvider) method in X509CRL.
+     * Called from java.security.cert.X509CRL.verify(PublicKey key,
+     * Provider sigProvider)
+     */
+    /* BEGIN ANDROID-REMOVED
+     * TODO(31294527): in its only usage (the one mentioned in the javadoc) it causes an infinite
+     * loop. Then, the caller has been modified to throw UnsupportedOperationException.
+    public static void verify(X509CRL crl, PublicKey key,
+            Provider sigProvider) throws CRLException,
+            NoSuchAlgorithmException, InvalidKeyException, SignatureException {
+        crl.verify(key, sigProvider);
+    }
+     * END ANDROID-REMOVED */
+
+    /**
      * Encodes an X.509 CRL, and signs it using the given key.
      *
      * @param key the private key used for signing.
@@ -784,7 +843,8 @@
     public KeyIdentifier getAuthKeyId() throws IOException {
         AuthorityKeyIdentifierExtension aki = getAuthKeyIdExtension();
         if (aki != null) {
-            KeyIdentifier keyId = (KeyIdentifier)aki.get(aki.KEY_ID);
+            KeyIdentifier keyId = (KeyIdentifier)aki.get(
+                    AuthorityKeyIdentifierExtension.KEY_ID);
             return keyId;
         } else {
             return null;
@@ -823,7 +883,7 @@
     public BigInteger getCRLNumber() throws IOException {
         CRLNumberExtension numExt = getCRLNumberExtension();
         if (numExt != null) {
-            BigInteger num = (BigInteger)numExt.get(numExt.NUMBER);
+            BigInteger num = numExt.get(CRLNumberExtension.NUMBER);
             return num;
         } else {
             return null;
@@ -852,7 +912,7 @@
     public BigInteger getBaseCRLNumber() throws IOException {
         DeltaCRLIndicatorExtension dciExt = getDeltaCRLIndicatorExtension();
         if (dciExt != null) {
-            BigInteger num = (BigInteger)dciExt.get(dciExt.NUMBER);
+            BigInteger num = dciExt.get(DeltaCRLIndicatorExtension.NUMBER);
             return num;
         } else {
             return null;
@@ -963,7 +1023,7 @@
                                                  e.hasMoreElements();) {
                     ex = e.nextElement();
                     inCertOID = ex.getExtensionId();
-                    if (inCertOID.equals(findOID)) {
+                    if (inCertOID.equals((Object)findOID)) {
                         crlExt = ex;
                         break;
                     }
@@ -1192,8 +1252,7 @@
         CertificateIssuerExtension ciExt =
             entry.getCertificateIssuerExtension();
         if (ciExt != null) {
-            GeneralNames names = (GeneralNames)
-                ciExt.get(CertificateIssuerExtension.ISSUER);
+            GeneralNames names = ciExt.get(CertificateIssuerExtension.ISSUER);
             X500Name issuerDN = (X500Name) names.get(0).getName();
             return issuerDN.asX500Principal();
         } else {
diff --git a/ojluni/src/main/native/PlainDatagramSocketImpl.c b/ojluni/src/main/native/PlainDatagramSocketImpl.c
index f9b9deb..aad8c34 100644
--- a/ojluni/src/main/native/PlainDatagramSocketImpl.c
+++ b/ojluni/src/main/native/PlainDatagramSocketImpl.c
@@ -1284,11 +1284,11 @@
 
 /*
  * Class:     java_net_PlainDatagramSocketImpl
- * Method:    socketSetOption
+ * Method:    socketSetOption0
  * Signature: (ILjava/lang/Object;)V
  */
 JNIEXPORT void JNICALL
-PlainDatagramSocketImpl_socketSetOption(JNIEnv *env,
+PlainDatagramSocketImpl_socketSetOption0(JNIEnv *env,
                                                       jobject this,
                                                       jint opt,
                                                       jobject value) {
@@ -1942,7 +1942,7 @@
   NATIVE_METHOD(PlainDatagramSocketImpl, setTimeToLive, "(I)V"),
   NATIVE_METHOD(PlainDatagramSocketImpl, setTTL, "(B)V"),
   NATIVE_METHOD(PlainDatagramSocketImpl, socketGetOption, "(I)Ljava/lang/Object;"),
-  NATIVE_METHOD(PlainDatagramSocketImpl, socketSetOption, "(ILjava/lang/Object;)V"),
+  NATIVE_METHOD(PlainDatagramSocketImpl, socketSetOption0, "(ILjava/lang/Object;)V"),
   NATIVE_METHOD(PlainDatagramSocketImpl, datagramSocketClose, "()V"),
   NATIVE_METHOD(PlainDatagramSocketImpl, datagramSocketCreate, "()V"),
   NATIVE_METHOD(PlainDatagramSocketImpl, receive0, "(Ljava/net/DatagramPacket;)V"),
diff --git a/ojluni/src/main/native/PlainSocketImpl.c b/ojluni/src/main/native/PlainSocketImpl.c
index af856c5..0129eb5 100644
--- a/ojluni/src/main/native/PlainSocketImpl.c
+++ b/ojluni/src/main/native/PlainSocketImpl.c
@@ -845,11 +845,11 @@
 
 /*
  * Class:     java_net_PlainSocketImpl
- * Method:    socketSetOption
+ * Method:    socketSetOption0
  * Signature: (IZLjava/lang/Object;)V
  */
 JNIEXPORT void JNICALL
-PlainSocketImpl_socketSetOption(JNIEnv *env, jobject this,
+PlainSocketImpl_socketSetOption0(JNIEnv *env, jobject this,
                                               jint cmd, jboolean on,
                                               jobject value) {
     int fd;
@@ -1073,7 +1073,7 @@
 static JNINativeMethod gMethods[] = {
   NATIVE_METHOD(PlainSocketImpl, socketSendUrgentData, "(I)V"),
   NATIVE_METHOD(PlainSocketImpl, socketGetOption, "(ILjava/lang/Object;)I"),
-  NATIVE_METHOD(PlainSocketImpl, socketSetOption, "(IZLjava/lang/Object;)V"),
+  NATIVE_METHOD(PlainSocketImpl, socketSetOption0, "(IZLjava/lang/Object;)V"),
   NATIVE_METHOD(PlainSocketImpl, socketShutdown, "(I)V"),
   NATIVE_METHOD(PlainSocketImpl, socketClose0, "()V"),
   NATIVE_METHOD(PlainSocketImpl, socketAccept, "(Ljava/net/SocketImpl;)V"),
diff --git a/ojluni/src/main/native/net_util_md.c b/ojluni/src/main/native/net_util_md.c
index f1d60fe..0dd6c09 100644
--- a/ojluni/src/main/native/net_util_md.c
+++ b/ojluni/src/main/native/net_util_md.c
@@ -911,12 +911,10 @@
 
     int i;
 
-    /*
-     * Different multicast options if IPv6 is enabled
-     */
 #ifdef AF_INET6
     if (ipv6_available()) {
         switch (cmd) {
+            // Different multicast options if IPv6 is enabled
             case java_net_SocketOptions_IP_MULTICAST_IF:
             case java_net_SocketOptions_IP_MULTICAST_IF2:
                 *level = IPPROTO_IPV6;
@@ -927,6 +925,13 @@
                 *level = IPPROTO_IPV6;
                 *optname = IPV6_MULTICAST_LOOP;
                 return 0;
+#if (defined(__solaris__) || defined(MACOSX))
+            // Map IP_TOS request to IPV6_TCLASS
+            case java_net_SocketOptions_IP_TOS:
+                *level = IPPROTO_IPV6;
+                *optname = IPV6_TCLASS;
+                return 0;
+#endif
         }
     }
 #endif
@@ -950,9 +955,6 @@
  * Wrapper for getsockopt system routine - does any necessary
  * pre/post processing to deal with OS specific oddities :-
  *
- * IP_TOS is a no-op with IPv6 sockets as it's setup when
- * the connection is established.
- *
  * On Linux the SO_SNDBUF/SO_RCVBUF values must be post-processed
  * to compensate for an incorrect value returned by the kernel.
  */
@@ -962,21 +964,6 @@
 {
     int rv;
 
-#ifdef AF_INET6
-    if ((level == IPPROTO_IP) && (opt == IP_TOS)) {
-        if (ipv6_available()) {
-
-            /*
-             * For IPv6 socket option implemented at Java-level
-             * so return -1.
-             */
-            int *tc = (int *)result;
-            *tc = -1;
-            return 0;
-        }
-    }
-#endif
-
 #ifdef __solaris__
     rv = getsockopt(fd, level, opt, result, len);
 #else
@@ -1027,8 +1014,7 @@
  *
  * For IP_TOS socket option need to mask off bits as this
  * aren't automatically masked by the kernel and results in
- * an error. In addition IP_TOS is a NOOP with IPv6 as it
- * should be setup as connection time.
+ * an error.
  */
 int
 NET_SetSockOpt(int fd, int level, int  opt, const void *arg,
@@ -1054,41 +1040,46 @@
 #else
     static long maxsockbuf = -1;
 #endif
-
-    int addopt;
-    struct linger *ling;
 #endif
 
     /*
      * IPPROTO/IP_TOS :-
-     * 1. IPv6 on Solaris/Mac OS: NOOP and will be set
-     *    in flowinfo field when connecting TCP socket,
-     *    or sending UDP packet.
+     * 1. IPv6 on Solaris/Mac OS:
+     *    Set the TOS OR Traffic Class value to cater for
+     *    IPv6 and IPv4 scenarios.
      * 2. IPv6 on Linux: By default Linux ignores flowinfo
      *    field so enable IPV6_FLOWINFO_SEND so that flowinfo
-     *    will be examined.
+     *    will be examined. We also set the IPv4 TOS option in this case.
      * 3. IPv4: set socket option based on ToS and Precedence
      *    fields (otherwise get invalid argument)
      */
     if (level == IPPROTO_IP && opt == IP_TOS) {
         int *iptos;
 
-#if defined(AF_INET6) && (defined(__solaris__) || defined(MACOSX))
-        if (ipv6_available()) {
-            return 0;
-        }
-#endif
-
 #if defined(AF_INET6) && defined(__linux__)
         if (ipv6_available()) {
             int optval = 1;
-            return setsockopt(fd, IPPROTO_IPV6, IPV6_FLOWINFO_SEND,
-                              (void *)&optval, sizeof(optval));
+            if (setsockopt(fd, IPPROTO_IPV6, IPV6_FLOWINFO_SEND,
+                           (void *)&optval, sizeof(optval)) < 0) {
+                return -1;
+            }
+           /*
+            * Let's also set the IPV6_TCLASS flag.
+            * Linux appears to allow both IP_TOS and IPV6_TCLASS to be set
+            * This helps in mixed environments where IPv4 and IPv6 sockets
+            * are connecting.
+            */
+           if (setsockopt(fd, IPPROTO_IPV6, IPV6_TCLASS,
+                           arg, len) < 0) {
+                return -1;
+            }
         }
 #endif
 
         iptos = (int *)arg;
-        *iptos &= (IPTOS_TOS_MASK | IPTOS_PREC_MASK);
+        // Android-changed: This is out-dated RFC 1349 scheme. Modern Linux uses
+        // Diffsev/ECN, and this mask is no longer relavant.
+        // *iptos &= (IPTOS_TOS_MASK | IPTOS_PREC_MASK);
     }
 
     /*
@@ -1153,7 +1144,7 @@
      * On Linux the receive buffer is used for both socket
      * structures and the the packet payload. The implication
      * is that if SO_RCVBUF is too small then small packets
-     * must be discard.
+     * must be discarded.
      */
 #ifdef __linux__
     if (level == SOL_SOCKET && opt == SO_RCVBUF) {
@@ -1222,8 +1213,7 @@
         }
 
         if (sotype == SOCK_DGRAM) {
-            addopt = SO_REUSEPORT;
-            setsockopt(fd, level, addopt, arg, len);
+            setsockopt(fd, level, SO_REUSEPORT, arg, len);
         }
     }
 
@@ -1336,7 +1326,7 @@
  * NET_WAIT_READ, NET_WAIT_WRITE & NET_WAIT_CONNECT.
  *
  * The function will return when either the socket is ready for one
- * of the specified operation or the timeout expired.
+ * of the specified operations or the timeout expired.
  *
  * It returns the time left from the timeout (possibly 0), or -1 if it expired.
  */
diff --git a/openjdk_java_files.mk b/openjdk_java_files.mk
index b7ab504..f1e425e 100644
--- a/openjdk_java_files.mk
+++ b/openjdk_java_files.mk
@@ -574,6 +574,7 @@
     ojluni/src/main/java/java/security/DigestInputStream.java \
     ojluni/src/main/java/java/security/DigestOutputStream.java \
     ojluni/src/main/java/java/security/DomainCombiner.java \
+    ojluni/src/main/java/java/security/DomainLoadStoreParameter.java \
     ojluni/src/main/java/java/security/GeneralSecurityException.java \
     ojluni/src/main/java/java/security/GuardedObject.java \
     ojluni/src/main/java/java/security/Guard.java \
@@ -612,6 +613,7 @@
     ojluni/src/main/java/java/security/MessageDigestSpi.java \
     ojluni/src/main/java/java/security/NoSuchAlgorithmException.java \
     ojluni/src/main/java/java/security/NoSuchProviderException.java \
+    ojluni/src/main/java/java/security/PKCS12Attribute.java \
     ojluni/src/main/java/java/security/PermissionCollection.java \
     ojluni/src/main/java/java/security/Permission.java \
     ojluni/src/main/java/java/security/Permissions.java \
@@ -759,6 +761,7 @@
     ojluni/src/main/java/java/util/ArrayPrefixHelpers.java \
     ojluni/src/main/java/java/util/Arrays.java \
     ojluni/src/main/java/java/util/ArraysParallelSortHelpers.java \
+    ojluni/src/main/java/java/util/Base64.java \
     ojluni/src/main/java/java/util/BitSet.java \
     ojluni/src/main/java/java/util/Calendar.java \
     ojluni/src/main/java/java/util/Collection.java \
diff --git a/support/src/test/java/libcore/java/security/StandardNames.java b/support/src/test/java/libcore/java/security/StandardNames.java
index d414d4b..d2f8b67 100644
--- a/support/src/test/java/libcore/java/security/StandardNames.java
+++ b/support/src/test/java/libcore/java/security/StandardNames.java
@@ -988,6 +988,15 @@
             "TLS_PSK_WITH_AES_256_CBC_SHA"
             );
 
+    // Should be updated to match BoringSSL's defaults when they change.
+    // https://android.googlesource.com/platform/external/boringssl/+/master/src/ssl/t1_lib.c#305
+    public static final List<String> ELLIPTIC_CURVES_DEFAULT = Arrays.asList(
+            "x25519 (29)",
+            "secp256r1 (23)",
+            "secp384r1 (24)",
+            "secp521r1 (25)"
+            );
+
     private static final Set<String> PERMITTED_DEFAULT_KEY_EXCHANGE_ALGS =
             new HashSet<String>(Arrays.asList("RSA",
                                               "DHE_RSA",
@@ -1154,6 +1163,10 @@
         }
     }
 
+    public static void assertDefaultEllipticCurves(String[] curves) {
+        assertEquals(ELLIPTIC_CURVES_DEFAULT, Arrays.asList(curves));
+    }
+
     public static void assertSSLContextEnabledProtocols(String version, String[] protocols) {
         assertEquals("For protocol \"" + version + "\"",
                 Arrays.toString(SSL_CONTEXT_PROTOCOLS_ENABLED.get(version)),
diff --git a/support/src/test/java/libcore/tlswire/handshake/EllipticCurve.java b/support/src/test/java/libcore/tlswire/handshake/EllipticCurve.java
new file mode 100644
index 0000000..a409c41
--- /dev/null
+++ b/support/src/test/java/libcore/tlswire/handshake/EllipticCurve.java
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package libcore.tlswire.handshake;
+
+/**
+ * {@code EllipticCurve} enum from RFC 4492 section 5.1.1. Curves are assigned
+ * via the
+ * <a href="https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8">IANA registry</a>.
+ */
+public enum EllipticCurve {
+    SECT163K1(1, "sect163k1"),
+    SECT163R1(2, "sect163r1"),
+    SECT163R2(3, "sect163r2"),
+    SECT193R1(4, "sect193r1"),
+    SECT193R2(5, "sect193r2"),
+    SECT233K1(6, "sect233k1"),
+    SECT233R1(7, "sect233r1"),
+    SECT239K1(8, "sect239k1"),
+    SECT283K1(9, "sect283k1"),
+    SECT283R1(10, "sect283r1"),
+    SECT409K1(11, "sect409k1"),
+    SECT409R1(12, "sect409r1"),
+    SECT571K1(13, "sect571k1"),
+    SECT571R1(14, "sect571r1"),
+    SECP160K1(15, "secp160k1"),
+    SECP160R1(16, "secp160r1"),
+    SECP160R2(17, "secp160r2"),
+    SECP192K1(18, "secp192k1"),
+    SECP192R1(19, "secp192r1"),
+    SECP224K1(20, "secp224k1"),
+    SECP256K1(22, "secp256k1"),
+    SECP256R1(23, "secp256r1"),
+    SECP384R1(24, "secp384r1"),
+    SECP521R1(25, "secp521r1"),
+    BRAINPOOLP256R1(26, "brainpoolP256r1"),
+    BRAINPOOLP384R1(27, "brainpoolP384r1"),
+    BRAINPOOLP521R1(28, "brainpoolP521r1"),
+    X25519(29, "x25519"),
+    X448(30, "x448"),
+    ARBITRARY_PRIME(0xFF01, "arbitrary_explicit_prime_curves"),
+    ARBITRARY_CHAR2(0xFF02, "arbitrary_explicit_char2_curves");
+
+    public final int identifier;
+    public final String name;
+
+    private EllipticCurve(int identifier, String name) {
+        this.identifier = identifier;
+        this.name = name;
+    }
+
+    public static EllipticCurve fromIdentifier(int identifier) {
+        for (EllipticCurve curve : values()) {
+            if (curve.identifier == identifier) {
+                return curve;
+            }
+        }
+        throw new AssertionError("Unknown curve identifier " + identifier);
+    }
+
+    @Override
+    public String toString() {
+        StringBuilder sb = new StringBuilder(name);
+        sb.append(" (");
+        sb.append(identifier);
+        sb.append(')');
+        return sb.toString();
+    }
+}
diff --git a/support/src/test/java/libcore/tlswire/handshake/EllipticCurvesHelloExtension.java b/support/src/test/java/libcore/tlswire/handshake/EllipticCurvesHelloExtension.java
new file mode 100644
index 0000000..19749a3
--- /dev/null
+++ b/support/src/test/java/libcore/tlswire/handshake/EllipticCurvesHelloExtension.java
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2016 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package libcore.tlswire.handshake;
+
+import libcore.tlswire.util.IoUtils;
+import java.io.ByteArrayInputStream;
+import java.io.DataInputStream;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * {@code elliptic_curves} {@link HelloExtension} from RFC 4492 section 5.1.1.
+ */
+public class EllipticCurvesHelloExtension extends HelloExtension {
+    public List<EllipticCurve> supported;
+    public boolean wellFormed;
+
+    @Override
+    protected void parseData() throws IOException {
+        byte[] ellipticCurvesListBytes = IoUtils.readTlsVariableLengthByteVector(
+                new DataInputStream(new ByteArrayInputStream(data)), 0xffff);
+        ByteArrayInputStream ellipticCurvesListIn = new ByteArrayInputStream(ellipticCurvesListBytes);
+        DataInputStream in = new DataInputStream(ellipticCurvesListIn);
+        wellFormed = (ellipticCurvesListIn.available() % 2) == 0;
+        supported = new ArrayList<EllipticCurve>(ellipticCurvesListIn.available() / 2);
+        while (ellipticCurvesListIn.available() >= 2) {
+            int curve_id = in.readUnsignedShort();
+            supported.add(EllipticCurve.fromIdentifier(curve_id));
+        }
+    }
+
+    @Override
+    public String toString() {
+        StringBuilder sb = new StringBuilder("HelloExtension{type: elliptic_curves, wellFormed: ");
+        sb.append(wellFormed);
+        sb.append(", supported: ");
+        sb.append(supported);
+        sb.append('}');
+        return sb.toString();
+    }
+}
diff --git a/support/src/test/java/libcore/tlswire/handshake/HelloExtension.java b/support/src/test/java/libcore/tlswire/handshake/HelloExtension.java
index a648cdf..2a77687 100644
--- a/support/src/test/java/libcore/tlswire/handshake/HelloExtension.java
+++ b/support/src/test/java/libcore/tlswire/handshake/HelloExtension.java
@@ -29,6 +29,7 @@
 public class HelloExtension {
 
     public static final int TYPE_SERVER_NAME = 0;
+    public static final int TYPE_ELLIPTIC_CURVES = 10;
     public static final int TYPE_PADDING = 21;
     public static final int TYPE_SESSION_TICKET = 35;
     public static final int TYPE_RENEGOTIATION_INFO = 65281;
@@ -45,7 +46,7 @@
         TYPE_TO_NAME.put(7, "client_authz");
         TYPE_TO_NAME.put(8, "server_authz");
         TYPE_TO_NAME.put(9, "cert_type");
-        TYPE_TO_NAME.put(10, "elliptic_curves");
+        TYPE_TO_NAME.put(TYPE_ELLIPTIC_CURVES, "elliptic_curves");
         TYPE_TO_NAME.put(11, "ec_point_formats");
         TYPE_TO_NAME.put(12, "srp");
         TYPE_TO_NAME.put(13, "signature_algorithms");
@@ -75,6 +76,9 @@
             case TYPE_SERVER_NAME:
                 result = new ServerNameHelloExtension();
                 break;
+            case TYPE_ELLIPTIC_CURVES:
+                result = new EllipticCurvesHelloExtension();
+                break;
             default:
                 result = new HelloExtension();
                 break;