diff --git a/.hgtags-top-repo b/.hgtags-top-repo
index 3581496..fe1add5 100644
--- a/.hgtags-top-repo
+++ b/.hgtags-top-repo
@@ -332,3 +332,4 @@
 3fdfe7f1b06354e11e8af51b7c653c8a0adb3987 jdk7u40-b33
 a1ae13479e8767329fa20774b5cea5976aaeb37b jdk7u40-b34
 af755d12719e898e3af917e8a56b64ebf83019bc jdk7u40-b35
+59598f7b6a7be5e0470447694c1f5b7d951f6ff1 jdk7u40-b36
diff --git a/corba/.hgtags b/corba/.hgtags
index a8cb42b..24ea554 100644
--- a/corba/.hgtags
+++ b/corba/.hgtags
@@ -334,3 +334,4 @@
 1b7fbfdc31b859097d6a365ad0ba0e8ef92b4063 jdk7u40-b33
 ddd543ddf33017a15623cdf6908ae4ef2958e24e jdk7u40-b34
 fab3339a833da9631ead479621edcf6df2df457d jdk7u40-b35
+cd3871b1516988ea4a3099d6e1886abe2e74e771 jdk7u40-b36
diff --git a/hotspot/.hgtags b/hotspot/.hgtags
index c41cc9c..00e7ac5 100644
--- a/hotspot/.hgtags
+++ b/hotspot/.hgtags
@@ -540,3 +540,4 @@
 dd9090ad552134cbb20d5dfc89f682f55e2570e9 jdk7u25-b33
 9af6a8fa6a557311bdf2fc124ae6adad59c9b78d jdk7u25-b34
 675a89fd4548389e3d54a29c6fe271d913e7eee6 hs24-b55
+13edc330a937d4323f38b6a59cc255b6d61c51dc jdk7u40-b36
diff --git a/jaxp/.hgtags b/jaxp/.hgtags
index a613256..fd3dfb1 100644
--- a/jaxp/.hgtags
+++ b/jaxp/.hgtags
@@ -334,3 +334,4 @@
 ce771024e07d2bb6521735a14ce68745a2376bd8 jdk7u40-b33
 23ba797b9e78231806d837f7fb4f9feef6dcd61a jdk7u40-b34
 4056df34b559b904edc9f94a323769f19cf8f426 jdk7u40-b35
+07024f18376ce9597ec8679ebcb9f2efdc5afab0 jdk7u40-b36
diff --git a/jaxws/.hgtags b/jaxws/.hgtags
index bad655c..5c1fa0c 100644
--- a/jaxws/.hgtags
+++ b/jaxws/.hgtags
@@ -334,3 +334,4 @@
 3ceef25a8cdd9a27a7a2dea0efd8721100cfa30f jdk7u40-b33
 1ef33d25dd8c776a0b76a8c5c7095f4083ad6993 jdk7u40-b34
 9f74e1f33e6cc89256eb2c61964558460d9d7efe jdk7u40-b35
+b75c19a170c7a1a7b846e4e793e62546b2c54646 jdk7u40-b36
diff --git a/jdk/.hgtags b/jdk/.hgtags
index 631186a..1f54b6c 100644
--- a/jdk/.hgtags
+++ b/jdk/.hgtags
@@ -333,3 +333,4 @@
 419939ecee8311c8a38ff624ae67e473f8c60e51 jdk7u40-b33
 7c1d6fc3b6da19c7b7c0aad0716a2d810dbb974b jdk7u40-b34
 0931b4a280b1e9b3b12936222d1bc6d427310f79 jdk7u40-b35
+cd7a4d0b218f98511068d8336aa3f4cbaf10b128 jdk7u40-b36
diff --git a/jdk/src/share/classes/sun/misc/VM.java b/jdk/src/share/classes/sun/misc/VM.java
index ba9b1f3..b2104c7 100644
--- a/jdk/src/share/classes/sun/misc/VM.java
+++ b/jdk/src/share/classes/sun/misc/VM.java
@@ -216,12 +216,13 @@
         return allowArraySyntax;
     }
 
-    private static boolean allowGetCallerClass = false;
+    private static boolean allowGetCallerClass = true;
 
-    // Reflection.getCallerClass(int) is disabled by default.
-    // It can be enabled by setting the system property
-    // "jdk.reflect.allowGetCallerClass" and also used by
-    // logging stack walk of a resource bundle if it is turned on.
+    // Reflection.getCallerClass(int) is enabled by default.
+    // It can be disabled by setting the system property
+    // "jdk.reflect.allowGetCallerClass" to "false". It cannot be
+    // disabled if the logging stack walk (to find resource bundles)
+    // is enabled.
     public static boolean allowGetCallerClass() {
         return allowGetCallerClass;
     }
@@ -290,14 +291,13 @@
                                ? defaultAllowArraySyntax
                                : Boolean.parseBoolean(s));
 
-        // Reflection.getCallerClass(int) is disabled by default.
-        // It can be enabled by setting the system property
-        // "jdk.reflect.allowGetCallerClass" and also used by
-        // logging stack walk of a resource bundle if it is turned on.
+        // Reflection.getCallerClass(int) is enabled by default.
+        // It can be disabled by setting a system property (but only if
+        // the logging stack walk is not enabled)
         s = props.getProperty("jdk.reflect.allowGetCallerClass");
         allowGetCallerClass = (s != null
                                    ? (s.isEmpty() || Boolean.parseBoolean(s))
-                                   : false) ||
+                                   : true) ||
              Boolean.valueOf(props.getProperty("jdk.logging.allowStackWalkSearch"));
 
         // Remove other private system properties
diff --git a/jdk/src/share/classes/sun/reflect/Reflection.java b/jdk/src/share/classes/sun/reflect/Reflection.java
index 50292f3..bf89c0e 100644
--- a/jdk/src/share/classes/sun/reflect/Reflection.java
+++ b/jdk/src/share/classes/sun/reflect/Reflection.java
@@ -59,8 +59,8 @@
     public static native Class getCallerClass();
 
     /**
-     * @deprecated No replacement.  This method will be removed in the next
-     * JDK 7 update release.
+     * @deprecated No replacement. This method will be removed in a future
+     *   release.
      */
     @Deprecated
     @CallerSensitive
@@ -68,12 +68,8 @@
         if (sun.misc.VM.allowGetCallerClass()) {
             return getCallerClass0(depth+1);
         }
-        throw new UnsupportedOperationException("This method is in the sun.* " +
-             "namespace so it is not a supported, public interface. " +
-             "The 7u40 release notes describe a temporary mechanism " +
-             "to reenable the historical functionality of this method. " +
-             "Update code to function properly and this method will be " +
-             "removed without further warning in a subsequent 7 update release.");
+        throw new UnsupportedOperationException("This method has been disabled by a " +
+            "system property");
     }
 
     // If the VM enforces getting caller class with @CallerSensitive,
diff --git a/jdk/src/share/native/sun/awt/image/jpeg/imageioJPEG.c b/jdk/src/share/native/sun/awt/image/jpeg/imageioJPEG.c
index 0373601..c4fbbb6 100644
--- a/jdk/src/share/native/sun/awt/image/jpeg/imageioJPEG.c
+++ b/jdk/src/share/native/sun/awt/image/jpeg/imageioJPEG.c
@@ -106,7 +106,7 @@
 /******************** StreamBuffer definition ************************/
 
 typedef struct streamBufferStruct {
-    jobject stream;            // ImageInputStream or ImageOutputStream
+    jweak ioRef;               // weak reference to a provider of I/O routines
     jbyteArray hstreamBuffer;  // Handle to a Java buffer for the stream
     JOCTET *buf;               // Pinned buffer pointer */
     size_t bufferOffset;          // holds offset between unpin and the next pin
@@ -125,6 +125,15 @@
  */
 #define STREAMBUF_SIZE 4096
 
+#define GET_IO_REF(io_name)                                            \
+    do {                                                               \
+        if ((*env)->IsSameObject(env, sb->ioRef, NULL) ||              \
+            ((io_name) = (*env)->NewLocalRef(env, sb->ioRef)) == NULL) \
+        {                                                              \
+            cinfo->err->error_exit((j_common_ptr) cinfo);              \
+        }                                                              \
+    } while (0)                                                        \
+
 /*
  * Used to signal that no data need be restored from an unpin to a pin.
  * I.e. the buffer is empty.
@@ -159,7 +168,7 @@
     }
 
 
-    sb->stream = NULL;
+    sb->ioRef = NULL;
 
     sb->buf = NULL;
 
@@ -191,9 +200,9 @@
  * All other state is reset.
  */
 static void resetStreamBuffer(JNIEnv *env, streamBufferPtr sb) {
-    if (sb->stream != NULL) {
-        (*env)->DeleteGlobalRef(env, sb->stream);
-        sb->stream = NULL;
+    if (sb->ioRef != NULL) {
+        (*env)->DeleteWeakGlobalRef(env, sb->ioRef);
+        sb->ioRef = NULL;
     }
     unpinStreamBuffer(env, sb, NULL);
     sb->bufferOffset = NO_DATA;
@@ -571,7 +580,7 @@
 static void imageio_set_stream(JNIEnv *env,
                                j_common_ptr cinfo,
                                imageIODataPtr data,
-                               jobject stream){
+                               jobject io){
     streamBufferPtr sb;
     sun_jpeg_error_ptr jerr;
 
@@ -579,13 +588,13 @@
 
     resetStreamBuffer(env, sb);  // Removes any old stream
 
-    /* Now we need a new global reference for the stream */
-    if (stream != NULL) { // Fix for 4411955
-        sb->stream = (*env)->NewGlobalRef(env, stream);
-        if (sb->stream == NULL) {
+    /* Now we need a new weak global reference for the I/O provider */
+    if (io != NULL) { // Fix for 4411955
+        sb->ioRef = (*env)->NewWeakGlobalRef(env, io);
+        if (sb->ioRef == NULL) {
             JNU_ThrowByName(env,
                             "java/lang/OutOfMemoryError",
-                            "Setting Stream");
+                            "Setting I/O provider");
             return;
         }
     }
@@ -895,6 +904,7 @@
     streamBufferPtr sb = &data->streamBuf;
     JNIEnv *env = (JNIEnv *)JNU_GetEnv(jvm, JNI_VERSION_1_2);
     int ret;
+    jobject input = NULL;
 
     /* This is where input suspends */
     if (sb->suspendable) {
@@ -920,9 +930,11 @@
      * Now fill a complete buffer, or as much of one as the stream
      * will give us if we are near the end.
      */
+    GET_IO_REF(input);
+
     RELEASE_ARRAYS(env, data, src->next_input_byte);
     ret = (*env)->CallIntMethod(env,
-                                sb->stream,
+                                input,
                                 JPEGImageReader_readInputDataID,
                                 sb->hstreamBuffer, 0,
                                 sb->bufferLength);
@@ -982,6 +994,7 @@
     JNIEnv *env = (JNIEnv *)JNU_GetEnv(jvm, JNI_VERSION_1_2);
     jint ret;
     size_t offset, buflen;
+    jobject input = NULL;
 
     /*
      * The original (jpegdecoder.c) had code here that called
@@ -1003,6 +1016,9 @@
     if (src->next_input_byte > sb->buf) {
         memcpy(sb->buf, src->next_input_byte, offset);
     }
+
+    GET_IO_REF(input);
+
     RELEASE_ARRAYS(env, data, src->next_input_byte);
     buflen = sb->bufferLength - offset;
     if (buflen <= 0) {
@@ -1012,7 +1028,7 @@
         return;
     }
 
-    ret = (*env)->CallIntMethod(env, sb->stream,
+    ret = (*env)->CallIntMethod(env, input,
                                 JPEGImageReader_readInputDataID,
                                 sb->hstreamBuffer,
                                 offset, buflen);
@@ -1075,6 +1091,7 @@
     JNIEnv *env = (JNIEnv *)JNU_GetEnv(jvm, JNI_VERSION_1_2);
     jlong ret;
     jobject reader;
+    jobject input = NULL;
 
     if (num_bytes < 0) {
         return;
@@ -1104,9 +1121,11 @@
         return;
     }
 
+    GET_IO_REF(input);
+
     RELEASE_ARRAYS(env, data, src->next_input_byte);
     ret = (*env)->CallLongMethod(env,
-                                 sb->stream,
+                                 input,
                                  JPEGImageReader_skipInputBytesID,
                                  (jlong) num_bytes);
     if ((*env)->ExceptionOccurred(env)
@@ -2285,11 +2304,14 @@
     imageIODataPtr data = (imageIODataPtr) cinfo->client_data;
     streamBufferPtr sb = &data->streamBuf;
     JNIEnv *env = (JNIEnv *)JNU_GetEnv(jvm, JNI_VERSION_1_2);
+    jobject output = NULL;
+
+    GET_IO_REF(output);
 
     RELEASE_ARRAYS(env, data, (const JOCTET *)(dest->next_output_byte));
 
     (*env)->CallVoidMethod(env,
-                           sb->stream,
+                           output,
                            JPEGImageWriter_writeOutputDataID,
                            sb->hstreamBuffer,
                            0,
@@ -2322,11 +2344,16 @@
     /* find out how much needs to be written */
     /* this conversion from size_t to jint is safe, because the lenght of the buffer is limited by jint */
     jint datacount = (jint)(sb->bufferLength - dest->free_in_buffer);
+
     if (datacount != 0) {
+        jobject output = NULL;
+
+        GET_IO_REF(output);
+
         RELEASE_ARRAYS(env, data, (const JOCTET *)(dest->next_output_byte));
 
         (*env)->CallVoidMethod(env,
-                               sb->stream,
+                               output,
                                JPEGImageWriter_writeOutputDataID,
                                sb->hstreamBuffer,
                                0,
diff --git a/jdk/test/java/util/logging/bundlesearch/ResourceBundleSearchTest.java b/jdk/test/java/util/logging/bundlesearch/ResourceBundleSearchTest.java
index ffcf137..3f4436f 100644
--- a/jdk/test/java/util/logging/bundlesearch/ResourceBundleSearchTest.java
+++ b/jdk/test/java/util/logging/bundlesearch/ResourceBundleSearchTest.java
@@ -29,6 +29,7 @@
  * @build  ResourceBundleSearchTest IndirectlyLoadABundle LoadItUp1 LoadItUp2 TwiceIndirectlyLoadABundle LoadItUp2Invoker
  * @run main/othervm ResourceBundleSearchTest
  * @run main/othervm -Djdk.logging.allowStackWalkSearch=true ResourceBundleSearchTest
+ * @run main/othervm -Djdk.reflect.allowGetCallerClass=false -Djdk.logging.allowStackWalkSearch=true ResourceBundleSearchTest
  */
 import java.net.URL;
 import java.net.URLClassLoader;
diff --git a/jdk/test/javax/imageio/plugins/jpeg/JpegWriterLeakTest.java b/jdk/test/javax/imageio/plugins/jpeg/JpegWriterLeakTest.java
new file mode 100644
index 0000000..ffb2b63
--- /dev/null
+++ b/jdk/test/javax/imageio/plugins/jpeg/JpegWriterLeakTest.java
@@ -0,0 +1,125 @@
+/*
+ * Copyright (c) 2013, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/**
+ * @test
+ * @bug     8020983
+ * @summary Test verifies that jpeg writer instances are collected
+ *          even if destroy() or reset() methods is not invoked.
+ *
+ * @run main JpegWriterLeakTest
+ */
+
+import java.awt.Color;
+import java.awt.Graphics2D;
+import java.awt.image.BufferedImage;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.lang.ref.Reference;
+import java.lang.ref.ReferenceQueue;
+import java.lang.ref.WeakReference;
+import java.util.ArrayList;
+import java.util.Random;
+import javax.imageio.ImageIO;
+import javax.imageio.ImageWriter;
+import javax.imageio.stream.ImageOutputStream;
+
+public class JpegWriterLeakTest {
+
+    public static void main(String[] args) {
+        final ReferenceQueue<ImageWriter> queue = new ReferenceQueue<>();
+        final ArrayList<Reference<? extends ImageWriter>> refs = new ArrayList<>();
+
+        int count = 2;
+
+        do {
+            ImageWriter writer =
+                    ImageIO.getImageWritersByFormatName("jpeg").next();
+
+            final WeakReference<? extends ImageWriter> ref =
+                    new WeakReference<>(writer, queue);
+
+            refs.add(ref);
+
+
+            try {
+                final ImageOutputStream os =
+                        ImageIO.createImageOutputStream(new ByteArrayOutputStream());
+                writer.setOutput(os);
+
+                writer.write(getImage());
+
+
+                // NB: dispose() or reset() workarounds the problem.
+            } catch (IOException e) {
+            } finally {
+                writer = null;
+            }
+            count--;
+        } while (count > 0);
+
+
+        System.out.println("Wait for GC...");
+
+        final long testTimeOut = 60000L;
+
+        final long startTime = System.currentTimeMillis();
+
+        while (!refs.isEmpty()) {
+            // check for the test timeout
+            final long now = System.currentTimeMillis();
+
+            if (now - startTime > testTimeOut) {
+                System.out.println();
+                throw new RuntimeException("Test FAILED.");
+            }
+
+            System.gc();
+
+            try {
+                System.out.print(".");
+                Thread.sleep(1000);
+            } catch (InterruptedException e) {
+            };
+
+            Reference<? extends ImageWriter> r = queue.poll();
+            if (r != null) {
+                System.out.println("Got reference: " + r);
+                refs.remove(r);
+            }
+        }
+        System.out.println("Test PASSED.");
+    }
+
+    private static BufferedImage getImage() {
+        int width = 2500;
+        int height = new Random().nextInt(2500) + 1;
+        BufferedImage image = new BufferedImage(width, height, BufferedImage.TYPE_INT_RGB);
+
+        Graphics2D g = image.createGraphics();
+        g.setColor(Color.blue);
+        g.fillRect(0, 0, width, height);
+
+        return image;
+    }
+}
diff --git a/jdk/test/sun/reflect/GetCallerClass.java b/jdk/test/sun/reflect/GetCallerClass.java
index 638b705..5197fcb 100644
--- a/jdk/test/sun/reflect/GetCallerClass.java
+++ b/jdk/test/sun/reflect/GetCallerClass.java
@@ -23,7 +23,7 @@
 
 /*
  * @test
- * @bug 8016814 8014925
+ * @bug 8016814 8014925 8021946
  * @summary Test sun.reflect.Reflection.getCallerClass(int) disabled by default
  * @compile -XDignore.symbol.file GetCallerClass.java
  * @run main/othervm GetCallerClass
@@ -36,10 +36,10 @@
     public static void main(String[] args) throws Exception {
         String s = System.getProperty("jdk.reflect.allowGetCallerClass");
         boolean allowed;
-        if (s == null || s.equals("false")) {
-            allowed = false;
-        } else if (s.equals("") || s.equals("true")) {
+        if (s == null || s.equals("") || s.equals("true")) {
             allowed = true;
+        } else if (s.equals("false")) {
+            allowed = false;
         } else {
             throw new RuntimeException("Unsupported test setting");
         }