J2sdk 1.4.1 Subject.doAs() odd (?) behaviour.

Question

I browsed through the forums and it seems like several other people have noticed the same, but nobody has explained it. See threads:
http://forum.java.sun.com/thread.jsp?forum=61&thread=302862
http://forum.java.sun.com/thread.jsp?forum=61&thread=319049
http://forum.java.sun.com/thread.jsp?forum=61&thread=356383
In my opinion, all these threads discuss the same thing.
The description is following:
i) If I call Subject.doAs(subj, new myaction()) within class "A" with classes "A" and myaction from the same codesource, then the subject IS NOT associated with the call.
ii) If I call Subject.doAs(subj, new myaction()) within class "A" with classes "A" and myaction from DIFFERENT codesources, then the subject IS associated with the call.
Note that the behaviour of the Subject.doAsprivileged is the same in both of the situations, i) and ii).
My opinion is that the subject should be associated with the call also in case i). And, if I understood the explanation of the doAs method in http://java.sun.com/j2se/1.4.1/docs/guide/security/jaas/JAASRefGuide.html, thats the way it should be.
Could someone explain this? I just don't get it.
In the above threads there are discussion about permissions, but actually this problem has nothing to do with them. (Except that when the subject is not associated, then the permissions granted to the principals in the subject are not available.)
Then, another question:
Why doesn't the ProtectionDomain class override the equals() -method?

Answer 1

I made a few tests and it seems like that the reason for this behaviour is in the "combine" and "optimize" -methods of the javax.security.auth.SubjectDomainCombiner.
The situation in my test programs, which I used to create the situations i) and ii) referred in the first post, was such that the AccessControlContext calls the SubjectDomainCombiners combine -method with the first and second argument being the same.
Now, the SubjectDomainCombiners combine -method has an optimization that when these two arguments have common ProtectionDomains (and in this case they both have one ProtectionDomain, which is the same one in both) then the common domain is not constructed with the Subjects Principals.
I think that this conflicts with the API description for SubjectDomainCombiners combine -method although it says that "Note that optimizations such as the removal of duplicate ProtectionDomains may have occurred.".
Could someone confirm this result?
Is this a "feature" or bug or am I just totally lost here?
ps. In order to replicate the result described in the first post, the class "A" should be called directly from main and it should belong to the same protectiondomain as main.