The assertion in Lookup::defineClass ensures that the resulting Class is defined with the same loader in the same package in the same protection domain as the lookup class.  When a class is defined to the boot loader, its protection domain is set to null which implies AllPermission but Class::getProtectionDomain however does not guarantee to return the same PD instance.  Hence the assertion may fail when 2+ threads are getting PD at the same time. This assertion is not strictly necessary and test/jdk/java/lang/invoke/DefineClassTest.java verifies these properties of the resulting Class.  I propose to remove this assertion. diff --git a/src/java.base/share/classes/java/lang/invoke/MethodHandles.java b/src/java.base/share/classes/java/lang/invoke/MethodHandles.java --- a/src/java.base/share/classes/java/lang/invoke/MethodHandles.java +++ b/src/java.base/share/classes/java/lang/invoke/MethodHandles.java @@ -969,9 +969,6 @@              ProtectionDomain pd = (loader != null) ? lookupClassProtectionDomain() : null;              String source = "__Lookup_defineClass__";              Class<?> clazz = SharedSecrets.getJavaLangAccess().defineClass(loader, cn, bytes, pd, source); -            assert clazz.getClassLoader() == lookupClass.getClassLoader() -                    && clazz.getPackageName().equals(lookupClass.getPackageName()) -                    && protectionDomain(clazz) == lookupClassProtectionDomain();              return clazz;          } Mandy