am 0a480846: Remove Engine.spi memory leak by clearing after access

Merge commit '0a480846a9798c763b088a122ab0dcd3dc3a17b6' into dalvik-dev

* commit '0a480846a9798c763b088a122ab0dcd3dc3a17b6':
  Remove Engine.spi memory leak by clearing after access

23 files changed, 458 insertions, 382 deletions

diff --git a/luni/src/main/java/java/security/AlgorithmParameterGenerator.java b/luni/src/main/java/java/security/AlgorithmParameterGenerator.java
index 43d577b..32d697d 100644
--- a/luni/src/main/java/java/security/AlgorithmParameterGenerator.java
+++ b/luni/src/main/java/java/security/AlgorithmParameterGenerator.java
@@ -30,10 +30,10 @@ public class AlgorithmParameterGenerator {
     private static final String SERVICE = "AlgorithmParameterGenerator";
 
     // Used to access common engine functionality
-    private static Engine engine = new Engine(SERVICE);
+    private static final Engine ENGINE = new Engine(SERVICE);
 
     // Store SecureRandom
-    private static SecureRandom randm = new SecureRandom();
+    private static final SecureRandom RANDOM = new SecureRandom();
 
     // Store used provider
     private final Provider provider;
@@ -90,10 +90,10 @@ public class AlgorithmParameterGenerator {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, null);
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, null);
             return new AlgorithmParameterGenerator(
-                    (AlgorithmParameterGeneratorSpi) engine.spi, engine.provider,
+                    (AlgorithmParameterGeneratorSpi) ENGINE.getSpi(), ENGINE.getProvider(),
                     algorithm);
         }
     }
@@ -154,11 +154,10 @@ public class AlgorithmParameterGenerator {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, provider, null);
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, provider, null);
             return new AlgorithmParameterGenerator(
-                    (AlgorithmParameterGeneratorSpi) engine.spi, provider,
-                    algorithm);
+                    (AlgorithmParameterGeneratorSpi) ENGINE.getSpi(), provider, algorithm);
         }
     }
 
@@ -182,7 +181,7 @@ public class AlgorithmParameterGenerator {
      *            the size (in number of bits).
      */
     public final void init(int size) {
-        spiImpl.engineInit(size, randm);
+        spiImpl.engineInit(size, RANDOM);
     }
 
     /**
@@ -211,7 +210,7 @@ public class AlgorithmParameterGenerator {
      */
     public final void init(AlgorithmParameterSpec genParamSpec)
             throws InvalidAlgorithmParameterException {
-        spiImpl.engineInit(genParamSpec, randm);
+        spiImpl.engineInit(genParamSpec, RANDOM);
     }
 
     /**
diff --git a/luni/src/main/java/java/security/AlgorithmParameters.java b/luni/src/main/java/java/security/AlgorithmParameters.java
index 8f751d0..aa83af7 100644
--- a/luni/src/main/java/java/security/AlgorithmParameters.java
+++ b/luni/src/main/java/java/security/AlgorithmParameters.java
@@ -36,27 +36,27 @@ public class AlgorithmParameters {
     /**
      * Used to access common engine functionality.
      */
-    private static Engine engine = new Engine(SEVICE);
+    private static final Engine ENGINE = new Engine(SEVICE);
 
     /**
      * The security provider.
      */
-    private Provider provider;
+    private final Provider provider;
 
     /**
      * The SPI implementation.
      */
-    private AlgorithmParametersSpi spiImpl;
+    private final AlgorithmParametersSpi spiImpl;
 
     /**
      * The security algorithm.
      */
-    private String algorithm;
+    private final String algorithm;
 
     /**
      * The initialization state.
      */
-    private boolean initialized; // = false;
+    private boolean initialized;
 
     /**
      * Constructs a new instance of {@code AlgorithmParameters} with the given
@@ -94,10 +94,10 @@ public class AlgorithmParameters {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, null);
-            return new AlgorithmParameters((AlgorithmParametersSpi) engine.spi,
-                    engine.provider, algorithm);
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, null);
+            return new AlgorithmParameters((AlgorithmParametersSpi) ENGINE.getSpi(),
+                    ENGINE.getProvider(), algorithm);
         }
     }
 
@@ -156,9 +156,9 @@ public class AlgorithmParameters {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, provider, null);
-            return new AlgorithmParameters((AlgorithmParametersSpi) engine.spi,
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, provider, null);
+            return new AlgorithmParameters((AlgorithmParametersSpi) ENGINE.getSpi(),
                     provider, algorithm);
         }
     }
diff --git a/luni/src/main/java/java/security/KeyFactory.java b/luni/src/main/java/java/security/KeyFactory.java
index 8387740..eb9d59c 100644
--- a/luni/src/main/java/java/security/KeyFactory.java
+++ b/luni/src/main/java/java/security/KeyFactory.java
@@ -31,18 +31,17 @@ public class KeyFactory {
     // The service name.
     private static final String SERVICE = "KeyFactory";
 
-    // The provider
-    private Provider provider;
-
-
     // Used to access common engine functionality
-    static private Engine engine = new Engine(SERVICE);
+    private static final Engine ENGINE = new Engine(SERVICE);
+
+    // The provider
+    private final Provider provider;
 
     // The SPI implementation.
-    private KeyFactorySpi spiImpl;
+    private final KeyFactorySpi spiImpl;
 
     // The algorithm.
-    private String algorithm;
+    private final String algorithm;
 
     /**
      * Constructs a new instance of {@code KeyFactory} with the specified
@@ -59,7 +58,7 @@ public class KeyFactory {
                          Provider provider,
                          String algorithm) {
         this.provider = provider;
-        this. algorithm = algorithm;
+        this.algorithm = algorithm;
         this.spiImpl = keyFacSpi;
     }
 
@@ -75,13 +74,13 @@ public class KeyFactory {
      *             if no provider provides the requested algorithm.
      */
     public static KeyFactory getInstance(String algorithm)
-                                throws NoSuchAlgorithmException {
+            throws NoSuchAlgorithmException {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, null);
-            return new KeyFactory((KeyFactorySpi)engine.spi, engine.provider, algorithm);
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, null);
+            return new KeyFactory((KeyFactorySpi) ENGINE.getSpi(), ENGINE.getProvider(), algorithm);
         }
     }
 
@@ -136,9 +135,9 @@ public class KeyFactory {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, provider, null);
-            return new KeyFactory((KeyFactorySpi)engine.spi, provider, algorithm);
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, provider, null);
+            return new KeyFactory((KeyFactorySpi) ENGINE.getSpi(), provider, algorithm);
         }
     }
 
diff --git a/luni/src/main/java/java/security/KeyPairGenerator.java b/luni/src/main/java/java/security/KeyPairGenerator.java
index cc91b18..40c06de 100644
--- a/luni/src/main/java/java/security/KeyPairGenerator.java
+++ b/luni/src/main/java/java/security/KeyPairGenerator.java
@@ -34,10 +34,10 @@ public abstract class KeyPairGenerator extends KeyPairGeneratorSpi {
     private static final String SERVICE = "KeyPairGenerator";
 
     // Used to access common engine functionality
-    private static Engine engine = new Engine(SERVICE);
+    private static final Engine ENGINE = new Engine(SERVICE);
 
     // Store SecureRandom
-    private static SecureRandom random = new SecureRandom();
+    private static final SecureRandom RANDOM = new SecureRandom();
 
     // Store used provider
     private Provider provider;
@@ -82,19 +82,20 @@ public abstract class KeyPairGenerator extends KeyPairGeneratorSpi {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        KeyPairGenerator result;
-        synchronized (engine) {
-            engine.getInstance(algorithm, null);
-            if (engine.spi instanceof KeyPairGenerator) {
-                result = (KeyPairGenerator) engine.spi;
-                result.algorithm = algorithm;
-                result.provider = engine.provider;
-                return result;
-            }
-            result = new KeyPairGeneratorImpl((KeyPairGeneratorSpi) engine.spi,
-                    engine.provider, algorithm);
+        Object spi;
+        Provider provider;
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, null);
+            spi = ENGINE.getSpi();
+            provider = ENGINE.getProvider();
+        }
+        if (spi instanceof KeyPairGenerator) {
+            KeyPairGenerator result = (KeyPairGenerator) spi;
+            result.algorithm = algorithm;
+            result.provider = provider;
             return result;
         }
+        return new KeyPairGeneratorImpl((KeyPairGeneratorSpi) spi, provider, algorithm);
     }
 
     /**
@@ -148,19 +149,18 @@ public abstract class KeyPairGenerator extends KeyPairGeneratorSpi {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        KeyPairGenerator result;
-        synchronized (engine) {
-            engine.getInstance(algorithm, provider, null);
-            if (engine.spi instanceof KeyPairGenerator) {
-                result = (KeyPairGenerator) engine.spi;
-                result.algorithm = algorithm;
-                result.provider = provider;
-                return result;
-            }
-            result = new KeyPairGeneratorImpl((KeyPairGeneratorSpi) engine.spi,
-                    provider, algorithm);
+        Object spi;
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, provider, null);
+            spi = ENGINE.getSpi();
+        }
+        if (spi instanceof KeyPairGenerator) {
+            KeyPairGenerator result = (KeyPairGenerator) spi;
+            result.algorithm = algorithm;
+            result.provider = provider;
             return result;
         }
+        return new KeyPairGeneratorImpl((KeyPairGeneratorSpi) spi, provider, algorithm);
     }
 
     /**
@@ -181,7 +181,7 @@ public abstract class KeyPairGenerator extends KeyPairGeneratorSpi {
      *            the size of the key (number of bits)
      */
     public void initialize(int keysize) {
-        initialize(keysize, random);
+        initialize(keysize, RANDOM);
     }
 
     /**
@@ -196,7 +196,7 @@ public abstract class KeyPairGenerator extends KeyPairGeneratorSpi {
      */
     public void initialize(AlgorithmParameterSpec param)
             throws InvalidAlgorithmParameterException {
-        initialize(param, random);
+        initialize(param, RANDOM);
     }
 
     /**
@@ -262,11 +262,6 @@ public abstract class KeyPairGenerator extends KeyPairGeneratorSpi {
         // Save KeyPairGeneratorSpi
         private KeyPairGeneratorSpi spiImpl;
 
-        // Implementation of KeyPaiGenerator constructor
-        //
-        // @param KeyPairGeneratorSpi
-        // @param provider
-        // @param algorithm
         private KeyPairGeneratorImpl(KeyPairGeneratorSpi keyPairGeneratorSpi,
                 Provider provider, String algorithm) {
             super(algorithm);
diff --git a/luni/src/main/java/java/security/KeyStore.java b/luni/src/main/java/java/security/KeyStore.java
index c0347f9..a03d6bd 100644
--- a/luni/src/main/java/java/security/KeyStore.java
+++ b/luni/src/main/java/java/security/KeyStore.java
@@ -52,7 +52,7 @@ public class KeyStore {
     private static final String SERVICE = "KeyStore";
 
     // Used to access common engine functionality
-    private static Engine engine = new Engine(SERVICE);
+    private static final Engine ENGINE = new Engine(SERVICE);
 
     //  Store KeyStore property name
     private static final String PROPERTYNAME = "keystore.type";
@@ -112,10 +112,10 @@ public class KeyStore {
         if (type == null) {
             throw new NullPointerException();
         }
-        synchronized (engine) {
+        synchronized (ENGINE) {
             try {
-                engine.getInstance(type, null);
-                return new KeyStore((KeyStoreSpi) engine.spi, engine.provider, type);
+                ENGINE.getInstance(type, null);
+                return new KeyStore((KeyStoreSpi) ENGINE.getSpi(), ENGINE.getProvider(), type);
             } catch (NoSuchAlgorithmException e) {
                 throw new KeyStoreException(e.getMessage());
             }
@@ -188,10 +188,10 @@ public class KeyStore {
             throw new NullPointerException();
         }
         // return KeyStore instance
-        synchronized (engine) {
+        synchronized (ENGINE) {
             try {
-                engine.getInstance(type, provider, null);
-                return new KeyStore((KeyStoreSpi) engine.spi, provider, type);
+                ENGINE.getInstance(type, provider, null);
+                return new KeyStore((KeyStoreSpi) ENGINE.getSpi(), provider, type);
             } catch (Exception e) {
             // override exception
                 throw new KeyStoreException(e.getMessage());
@@ -880,7 +880,8 @@ public class KeyStore {
             // CallbackHandlerProtection
             if (!(protectionParameter instanceof PasswordProtection)
                     && !(protectionParameter instanceof CallbackHandlerProtection)) {
-                throw new IllegalArgumentException("protectionParameter is neither PasswordProtection nor CallbackHandlerProtection instance");
+                throw new IllegalArgumentException("protectionParameter is neither "
+                        + "PasswordProtection nor CallbackHandlerProtection instance");
             }
             // check file parameter
             if (!file.exists()) {
@@ -964,13 +965,13 @@ public class KeyStore {
             // Store AccessControlContext which is used in getKeyStore() method
             private final AccessControlContext accControlContext;
 
-            //
-            // Constructor BuilderImpl initializes private fields: keyStore,
-            // protParameter, typeForKeyStore providerForKeyStore fileForLoad,
-            // isGetKeyStore
-            //
+            /**
+             * Constructor BuilderImpl initializes private fields: keyStore,
+             * protParameter, typeForKeyStore providerForKeyStore fileForLoad,
+             * isGetKeyStore
+             */
             BuilderImpl(KeyStore ks, ProtectionParameter pp, File file,
-                    String type, Provider provider, AccessControlContext context) {
+                        String type, Provider provider, AccessControlContext context) {
                 super();
                 keyStore = ks;
                 protParameter = pp;
@@ -982,20 +983,20 @@ public class KeyStore {
                 accControlContext = context;
             }
 
-            //
-            // Implementation of abstract getKeyStore() method If
-            // KeyStoreBuilder encapsulates KeyStore object then this object is
-            // returned
-            //
-            // If KeyStoreBuilder encapsulates KeyStore type and provider then
-            // KeyStore is created using these parameters. If KeyStoreBuilder
-            // encapsulates file and ProtectionParameter then KeyStore data are
-            // loaded from FileInputStream that is created on file. If file is
-            // not defined then KeyStore object is initialized with null
-            // InputStream and null password.
-            //
-            // Result KeyStore object is returned.
-            //
+            /**
+             * Implementation of abstract getKeyStore() method If
+             * KeyStoreBuilder encapsulates KeyStore object then this object is
+             * returned
+             *
+             * If KeyStoreBuilder encapsulates KeyStore type and provider then
+             * KeyStore is created using these parameters. If KeyStoreBuilder
+             * encapsulates file and ProtectionParameter then KeyStore data are
+             * loaded from FileInputStream that is created on file. If file is
+             * not defined then KeyStore object is initialized with null
+             * InputStream and null password.
+             *
+             * Result KeyStore object is returned.
+             */
             @Override
             public synchronized KeyStore getKeyStore() throws KeyStoreException {
                 // If KeyStore was created but in final block some exception was
@@ -1028,7 +1029,8 @@ public class KeyStore {
                         passwd = KeyStoreSpi
                                 .getPasswordFromCallBack(protParameter);
                     } else {
-                        throw new KeyStoreException("protectionParameter is neither PasswordProtection nor CallbackHandlerProtection instance");
+                        throw new KeyStoreException("protectionParameter is neither "
+                                + "PasswordProtection nor CallbackHandlerProtection instance");
                     }
 
                     // load KeyStore from file
@@ -1063,13 +1065,13 @@ public class KeyStore {
                 }
             }
 
-            //
-            // This is implementation of abstract method
-            // getProtectionParameter(String alias)
-            //
-            // Return: ProtectionParameter to get Entry which was saved in
-            // KeyStore with defined alias
-            //
+            /**
+             * This is implementation of abstract method
+             * getProtectionParameter(String alias)
+             *
+             * Return: ProtectionParameter to get Entry which was saved in
+             * KeyStore with defined alias
+             */
             @Override
             public synchronized ProtectionParameter getProtectionParameter(
                     String alias) throws KeyStoreException {
@@ -1284,13 +1286,15 @@ public class KeyStore {
             // the end certificate
             String s = chain[0].getType();
             if (!(chain[0].getPublicKey().getAlgorithm()).equals(privateKey.getAlgorithm())) {
-                throw new IllegalArgumentException("Algorithm of private key does not match " +
-                        "algorithm of public key in end certificate of entry (with index number: 0)");
+                throw new IllegalArgumentException("Algorithm of private key does not match "
+                        + "algorithm of public key in end certificate of entry "
+                        + "(with index number: 0)");
             }
             // Match certificate types
             for (int i = 1; i < chain.length; i++) {
                 if (!s.equals(chain[i].getType())) {
-                    throw new IllegalArgumentException("Certificates from the given chain have different types");
+                    throw new IllegalArgumentException("Certificates from the given chain have "
+                                                       + "different types");
                 }
             }
             // clone chain - this.chain = (Certificate[])chain.clone();
diff --git a/luni/src/main/java/java/security/MessageDigest.java b/luni/src/main/java/java/security/MessageDigest.java
index aac5403..b71be8e 100644
--- a/luni/src/main/java/java/security/MessageDigest.java
+++ b/luni/src/main/java/java/security/MessageDigest.java
@@ -51,7 +51,7 @@ import org.apache.harmony.security.fortress.Engine;
 public abstract class MessageDigest extends MessageDigestSpi {
 
     // Used to access common engine functionality
-    private static final Engine engine = new Engine("MessageDigest");
+    private static final Engine ENGINE = new Engine("MessageDigest");
 
     // The provider
     private Provider provider;
@@ -88,18 +88,20 @@ public abstract class MessageDigest extends MessageDigestSpi {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        MessageDigest result;
-        synchronized (engine) {
-            engine.getInstance(algorithm, null);
-            if (engine.spi instanceof MessageDigest) {
-                result = (MessageDigest) engine.spi;
-                result.algorithm = algorithm;
-                result.provider = engine.provider;
-                return result;
-            }
-            return new MessageDigestImpl((MessageDigestSpi) engine.spi,
-                    engine.provider, algorithm);
+        Object spi;
+        Provider provider;
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, null);
+            spi = ENGINE.getSpi();
+            provider = ENGINE.getProvider();
+        }
+        if (spi instanceof MessageDigest) {
+            MessageDigest result = (MessageDigest) spi;
+            result.algorithm = algorithm;
+            result.provider = provider;
+            return result;
         }
+        return new MessageDigestImpl((MessageDigestSpi) spi, provider, algorithm);
     }
 
     /**
@@ -156,19 +158,18 @@ public abstract class MessageDigest extends MessageDigestSpi {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        MessageDigest result;
-        synchronized (engine) {
-            engine.getInstance(algorithm, provider, null);
-            if (engine.spi instanceof MessageDigest) {
-                result = (MessageDigest) engine.spi;
-                result.algorithm = algorithm;
-                result.provider = provider;
-                return result;
-            }
-            result = new MessageDigestImpl((MessageDigestSpi) engine.spi,
-                    provider, algorithm);
+        Object spi;
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, provider, null);
+            spi = ENGINE.getSpi();
+        }
+        if (spi instanceof MessageDigest) {
+            MessageDigest result = (MessageDigest) spi;
+            result.algorithm = algorithm;
+            result.provider = provider;
             return result;
         }
+        return new MessageDigestImpl((MessageDigestSpi) spi, provider, algorithm);
     }
 
     /**
diff --git a/luni/src/main/java/java/security/Policy.java b/luni/src/main/java/java/security/Policy.java
index baaedfc..177deeb 100644
--- a/luni/src/main/java/java/security/Policy.java
+++ b/luni/src/main/java/java/security/Policy.java
@@ -44,30 +44,31 @@ public abstract class Policy {
             "setPolicy");
 
     // The SecurityPermission required to get current Policy.
-    static final SecurityPermission GET_POLICY = new SecurityPermission("getPolicy");
+    private static final SecurityPermission GET_POLICY = new SecurityPermission("getPolicy");
 
     // The policy currently in effect.
+    // protected by Policy.class monitor.
     private static Policy activePolicy;
 
     // Store spi implementation service name
     private static final String POLICYSERVICE = "Policy";
 
     // Used to access common engine functionality
-    private static Engine engine = new Engine(POLICYSERVICE);
+    private static final Engine ENGINE = new Engine(POLICYSERVICE);
 
-    private String type;
+    private final String type;
 
-    private Policy.Parameters params;
+    private final Policy.Parameters params;
 
-    private Provider provider;
+    private final Provider provider;
 
     // Store used spi implementation
-    private PolicySpi spiImpl;
+    private final PolicySpi spiImpl;
 
     private static final String CREATE_POLICY = "createPolicy.";
 
     public Policy() {
-        // default constructor
+        this(null, null, null, null);
     }
 
     private Policy(PolicySpi spi, Provider p, String t, Policy.Parameters para) {
@@ -97,22 +98,22 @@ public abstract class Policy {
      * Note that the list of registered providers may be retrieved via the
      * Security.getProviders() method.
      *
-     * @param type -
+     * @param type
      *            the specified Policy type. See Appendix A in the Java
      *            Cryptography Architecture API Specification & Reference for a
      *            list of standard Policy types.
-     * @param params -
+     * @param params
      *            parameters for the Policy, which may be null.
      * @return the new Policy object.
-     * @throws NoSuchAlgorithmException -
+     * @throws NoSuchAlgorithmException
      *             if no Provider supports a PolicySpi implementation for the
      *             specified type.
-     * @throws SecurityException -
+     * @throws SecurityException
      *             if the caller does not have permission to get a Policy
      *             instance for the specified type.
-     * @throws NullPointerException -
+     * @throws NullPointerException
      *             if the specified type is null.
-     * @throws IllegalArgumentException -
+     * @throws IllegalArgumentException
      *             if the specified parameters' type are not allowed by the
      *             PolicySpi implementation from the selected Provider.
      */
@@ -125,10 +126,10 @@ public abstract class Policy {
         }
 
         try {
-            synchronized (engine) {
-                engine.getInstance(type, params);
-                return new PolicyDelegate((PolicySpi) engine.spi,
-                        engine.provider, type, params);
+            synchronized (ENGINE) {
+                ENGINE.getInstance(type, params);
+                return new PolicyDelegate((PolicySpi) ENGINE.getSpi(),
+                        ENGINE.getProvider(), type, params);
             }
 
         } catch (NoSuchAlgorithmException e) {
@@ -147,27 +148,27 @@ public abstract class Policy {
      * in the provider list via the Security.getProviders() method, otherwise
      * NoSuchProviderException will be thrown.
      *
-     * @param type -
+     * @param type
      *            the specified Policy type. So far in Java 6, only 'JavaPolicy'
      *            supported.
-     * @param params -
+     * @param params
      *            the Policy.Parameter object, which may be null.
-     * @param provider -
+     * @param provider
      *            the provider.
      * @return the new Policy object.
      *
-     * @throws NoSuchProviderException -
+     * @throws NoSuchProviderException
      *             if the specified provider is not registered in the security
      *             provider list.
-     * @throws NoSuchAlgorithmException -
+     * @throws NoSuchAlgorithmException
      *             if the specified provider does not support a PolicySpi
      *             implementation for the specified type.
-     * @throws SecurityException -
+     * @throws SecurityException
      *             if the caller does not have permission to get a Policy
      *             instance for the specified type.
-     * @throws NullPointerException -
+     * @throws NullPointerException
      *             if the specified type is null.
-     * @throws IllegalArgumentException -
+     * @throws IllegalArgumentException
      *             if the specified Provider is null, or if the specified
      *             parameters' type are not allowed by the PolicySpi
      *             implementation from the specified Provider.
@@ -195,25 +196,25 @@ public abstract class Policy {
      * specified Provider object is returned. Note that the specified Provider
      * object does not have to be registered in the provider list.
      *
-     * @param type -
+     * @param type
      *            the specified Policy type. So far in Java 6, only 'JavaPolicy'
      *            supported.
-     * @param params -
+     * @param params
      *            the Policy.Parameter object, which may be null.
-     * @param provider -
+     * @param provider
      *            the Policy service Provider.
      * @return the new Policy object.
      *
-     * @throws NoSuchAlgorithmException -
+     * @throws NoSuchAlgorithmException
      *             if the specified Provider does not support a PolicySpi
      *             implementation for the specified type.
-     * @throws IllegalArgumentException -
+     * @throws IllegalArgumentException
      *             if the specified Provider is null, or if the specified
      *             parameters' type are not allowed by the PolicySpi
      *             implementation from the specified Provider.
-     * @throws NullPointerException -
+     * @throws NullPointerException
      *             if the specified type is null.
-     * @throws SecurityException -
+     * @throws SecurityException
      *             if the caller does not have permission to get a Policy
      *             instance for the specified type.
      */
@@ -234,15 +235,16 @@ public abstract class Policy {
         }
     }
 
-    private static Policy getInstanceImpl(String type, Policy.Parameters params, Provider provider) throws NoSuchAlgorithmException {
+    private static Policy getInstanceImpl(String type, Policy.Parameters params, Provider provider)
+            throws NoSuchAlgorithmException {
         if (type == null) {
             throw new NullPointerException();
         }
 
         try {
-            synchronized (engine) {
-                engine.getInstance(type, provider, params);
-                return new PolicyDelegate((PolicySpi) engine.spi, provider,
+            synchronized (ENGINE) {
+                ENGINE.getInstance(type, provider, params);
+                return new PolicyDelegate((PolicySpi) ENGINE.getSpi(), provider,
                         type, params);
             }
         } catch (NoSuchAlgorithmException e) {
@@ -484,8 +486,7 @@ public abstract class Policy {
                 try {
                     return (Policy) Class.forName(defaultClass, true,
                             ClassLoader.getSystemClassLoader()).newInstance();
-                }
-                catch (Exception e) {
+                } catch (Exception e) {
                     //TODO log error
                     //System.err.println("Error loading policy provider <"
                     //                 + defaultClass + "> : " + e
@@ -502,7 +503,9 @@ public abstract class Policy {
      * Returns {@code true} if system policy provider is instantiated.
      */
     static boolean isSet() {
-        return activePolicy != null;
+        synchronized (Policy.class) {
+            return activePolicy != null;
+        }
     }
 
     /**
@@ -511,11 +514,13 @@ public abstract class Policy {
      * so this method never returns <code>null</code>. <br>
      * This method is synchronized with setPolicy()
      */
-    static synchronized Policy getAccessiblePolicy() {
-        if (activePolicy == null) {
-            activePolicy = getDefaultProvider();
+    static Policy getAccessiblePolicy() {
+        synchronized (Policy.class) {
+            if (activePolicy == null) {
+                activePolicy = getDefaultProvider();
+            }
+            return activePolicy;
         }
-        return activePolicy;
     }
 
     /**
diff --git a/luni/src/main/java/java/security/SecureRandom.java b/luni/src/main/java/java/security/SecureRandom.java
index 31a1ba1..f686ba6 100644
--- a/luni/src/main/java/java/security/SecureRandom.java
+++ b/luni/src/main/java/java/security/SecureRandom.java
@@ -31,27 +31,19 @@ public class SecureRandom extends Random {
     private static final long serialVersionUID = 4940670005562187L;
 
     // The service name.
-    private static final transient String SERVICE = "SecureRandom";
+    private static final String SERVICE = "SecureRandom";
 
     // Used to access common engine functionality
-    private static transient Engine engine = new Engine(SERVICE);
+    private static final Engine ENGINE = new Engine(SERVICE);
 
-    private Provider provider;
+    private final Provider provider;
 
-    private SecureRandomSpi secureRandomSpi;
+    private final SecureRandomSpi secureRandomSpi;
 
-    private String algorithm;
-
-    private byte[] state;
-
-    private byte[] randomBytes;
-
-    private int randomBytesUsed;
-
-    private long counter;
+    private final String algorithm;
 
     // Internal SecureRandom used for getSeed(int)
-    private static transient SecureRandom internalSecureRandom;
+    private static volatile SecureRandom internalSecureRandom;
 
     /**
      * Constructs a new instance of {@code SecureRandom}. An implementation for
@@ -132,9 +124,10 @@ public class SecureRandom extends Random {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, null);
-            return new SecureRandom((SecureRandomSpi)engine.spi, engine.provider, algorithm);
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, null);
+            return new SecureRandom((SecureRandomSpi) ENGINE.getSpi(), ENGINE.getProvider(),
+                                    algorithm);
         }
     }
 
@@ -192,9 +185,9 @@ public class SecureRandom extends Random {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, provider, null);
-            return new SecureRandom((SecureRandomSpi)engine.spi, provider, algorithm);
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, provider, null);
+            return new SecureRandom((SecureRandomSpi) ENGINE.getSpi(), provider, algorithm);
         }
     }
 
@@ -305,10 +298,12 @@ public class SecureRandom extends Random {
      * @return the seed bytes
      */
     public static byte[] getSeed(int numBytes) {
-        if (internalSecureRandom == null) {
-            internalSecureRandom = new SecureRandom();
+        SecureRandom result = internalSecureRandom;
+        if (result == null) {
+            // single-check idiom
+            internalSecureRandom = result = new SecureRandom();
         }
-        return internalSecureRandom.generateSeed(numBytes);
+        return result.generateSeed(numBytes);
     }
 
     /**
diff --git a/luni/src/main/java/java/security/Signature.java b/luni/src/main/java/java/security/Signature.java
index f8fb2bb..046bd4d 100644
--- a/luni/src/main/java/java/security/Signature.java
+++ b/luni/src/main/java/java/security/Signature.java
@@ -39,7 +39,7 @@ public abstract class Signature extends SignatureSpi {
     private static final String SERVICE = "Signature";
 
     // Used to access common engine functionality
-    private static Engine engine = new Engine(SERVICE);
+    private static Engine ENGINE = new Engine(SERVICE);
 
     // The provider
     private Provider provider;
@@ -101,19 +101,20 @@ public abstract class Signature extends SignatureSpi {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        Signature result;
-        synchronized (engine) {
-            engine.getInstance(algorithm, null);
-            if (engine.spi instanceof Signature) {
-                result = (Signature) engine.spi;
-                result.algorithm = algorithm;
-                result.provider = engine.provider;
-            } else {
-                result = new SignatureImpl((SignatureSpi) engine.spi,
-                        engine.provider, algorithm);
-            }
+        Object spi;
+        Provider provider;
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, null);
+            spi = ENGINE.getSpi();
+            provider = ENGINE.getProvider();
+        }
+        if (spi instanceof Signature) {
+            Signature result = (Signature) spi;
+            result.algorithm = algorithm;
+            result.provider = provider;
+            return result;
         }
-        return result;
+        return new SignatureImpl((SignatureSpi) spi, provider, algorithm);
     }
 
     /**
@@ -178,19 +179,18 @@ public abstract class Signature extends SignatureSpi {
 
     private static Signature getSignatureInstance(String algorithm,
             Provider provider) throws NoSuchAlgorithmException {
-        Signature result;
-        synchronized (engine) {
-            engine.getInstance(algorithm, provider, null);
-            if (engine.spi instanceof Signature) {
-                result = (Signature) engine.spi;
-                result.algorithm = algorithm;
-                result.provider = provider;
-            } else {
-                result = new SignatureImpl((SignatureSpi) engine.spi, provider,
-                        algorithm);
-            }
-        }
-        return result;
+        Object spi;
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, provider, null);
+            spi = ENGINE.getSpi();
+        }
+        if (spi instanceof Signature) {
+            Signature result = (Signature) spi;
+            result.algorithm = algorithm;
+            result.provider = provider;
+            return result;
+        }
+        return new SignatureImpl((SignatureSpi) spi, provider, algorithm);
     }
 
     /**
diff --git a/luni/src/main/java/java/security/cert/CertPathBuilder.java b/luni/src/main/java/java/security/cert/CertPathBuilder.java
index 11a38cc..c25fd54 100644
--- a/luni/src/main/java/java/security/cert/CertPathBuilder.java
+++ b/luni/src/main/java/java/security/cert/CertPathBuilder.java
@@ -35,7 +35,7 @@ public class CertPathBuilder {
     private static final String SERVICE = "CertPathBuilder";
 
     // Used to access common engine functionality
-    private static Engine engine = new Engine(SERVICE);
+    private static final Engine ENGINE = new Engine(SERVICE);
 
     // Store default property name
     private static final String PROPERTYNAME = "certpathbuilder.type";
@@ -48,7 +48,7 @@ public class CertPathBuilder {
     private final Provider provider;
 
     // Store spi implementation
-    private CertPathBuilderSpi spiImpl;
+    private final CertPathBuilderSpi spiImpl;
 
     // Store algorithm name
     private final String algorithm;
@@ -105,10 +105,10 @@ public class CertPathBuilder {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, null);
-            return new CertPathBuilder((CertPathBuilderSpi) engine.spi,
-                    engine.provider, algorithm);
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, null);
+            return new CertPathBuilder((CertPathBuilderSpi) ENGINE.getSpi(),
+                    ENGINE.getProvider(), algorithm);
         }
     }
 
@@ -165,10 +165,9 @@ public class CertPathBuilder {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, provider, null);
-            return new CertPathBuilder((CertPathBuilderSpi) engine.spi, provider,
-                    algorithm);
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, provider, null);
+            return new CertPathBuilder((CertPathBuilderSpi) ENGINE.getSpi(), provider, algorithm);
         }
     }
 
diff --git a/luni/src/main/java/java/security/cert/CertPathValidator.java b/luni/src/main/java/java/security/cert/CertPathValidator.java
index b73857f..e1ad4d8 100644
--- a/luni/src/main/java/java/security/cert/CertPathValidator.java
+++ b/luni/src/main/java/java/security/cert/CertPathValidator.java
@@ -35,7 +35,7 @@ public class CertPathValidator {
     private static final String SERVICE = "CertPathValidator";
 
     // Used to access common engine functionality
-    private static Engine engine = new Engine(SERVICE);
+    private static final Engine ENGINE = new Engine(SERVICE);
 
     // Store default property name
     private static final String PROPERTYNAME = "certpathvalidator.type";
@@ -104,10 +104,10 @@ public class CertPathValidator {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, null);
-            return new CertPathValidator((CertPathValidatorSpi) engine.spi,
-                    engine.provider, algorithm);
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, null);
+            return new CertPathValidator((CertPathValidatorSpi) ENGINE.getSpi(),
+                    ENGINE.getProvider(), algorithm);
         }
     }
 
@@ -166,9 +166,9 @@ public class CertPathValidator {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, provider, null);
-            return new CertPathValidator((CertPathValidatorSpi) engine.spi,
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, provider, null);
+            return new CertPathValidator((CertPathValidatorSpi) ENGINE.getSpi(),
                     provider, algorithm);
         }
     }
diff --git a/luni/src/main/java/java/security/cert/CertStore.java b/luni/src/main/java/java/security/cert/CertStore.java
index 775236c..b21ba1b 100644
--- a/luni/src/main/java/java/security/cert/CertStore.java
+++ b/luni/src/main/java/java/security/cert/CertStore.java
@@ -37,7 +37,7 @@ public class CertStore {
     private static final String SERVICE = "CertStore";
 
     // Used to access common engine functionality
-    private static Engine engine = new Engine(SERVICE);
+    private static final Engine ENGINE = new Engine(SERVICE);
 
     // Store default property name
     private static final String PROPERTYNAME = "certstore.type";
@@ -101,9 +101,9 @@ public class CertStore {
             throw new NullPointerException();
         }
         try {
-            synchronized (engine) {
-                engine.getInstance(type, params);
-                return new CertStore((CertStoreSpi) engine.spi, engine.provider,
+            synchronized (ENGINE) {
+                ENGINE.getInstance(type, params);
+                return new CertStore((CertStoreSpi) ENGINE.getSpi(), ENGINE.getProvider(),
                         type, params);
             }
         } catch (NoSuchAlgorithmException e) {
@@ -182,9 +182,9 @@ public class CertStore {
             throw new NullPointerException();
         }
         try {
-            synchronized (engine) {
-                engine.getInstance(type, provider, params);
-                return new CertStore((CertStoreSpi) engine.spi, provider, type,
+            synchronized (ENGINE) {
+                ENGINE.getInstance(type, provider, params);
+                return new CertStore((CertStoreSpi) ENGINE.getSpi(), provider, type,
                         params);
             }
         } catch (NoSuchAlgorithmException e) {
diff --git a/luni/src/main/java/java/security/cert/CertificateFactory.java b/luni/src/main/java/java/security/cert/CertificateFactory.java
index 6bef771..b60b723 100644
--- a/luni/src/main/java/java/security/cert/CertificateFactory.java
+++ b/luni/src/main/java/java/security/cert/CertificateFactory.java
@@ -41,7 +41,7 @@ public class CertificateFactory {
     private static final String SERVICE = "CertificateFactory";
 
     // Used to access common engine functionality
-    private static Engine engine = new Engine(SERVICE);
+    private static final Engine ENGINE = new Engine(SERVICE);
 
     // Store used provider
     private final Provider provider;
@@ -87,10 +87,10 @@ public class CertificateFactory {
             throw new NullPointerException();
         }
         try {
-            synchronized (engine) {
-                engine.getInstance(type, null);
-                return new CertificateFactory((CertificateFactorySpi) engine.spi,
-                        engine.provider, type);
+            synchronized (ENGINE) {
+                ENGINE.getInstance(type, null);
+                return new CertificateFactory((CertificateFactorySpi) ENGINE.getSpi(),
+                        ENGINE.getProvider(), type);
             }
         } catch (NoSuchAlgorithmException e) {
             throw new CertificateException(e);
@@ -156,9 +156,9 @@ public class CertificateFactory {
             throw new NullPointerException();
         }
         try {
-            synchronized (engine) {
-                engine.getInstance(type, provider, null);
-                return new CertificateFactory((CertificateFactorySpi) engine.spi,
+            synchronized (ENGINE) {
+                ENGINE.getInstance(type, provider, null);
+                return new CertificateFactory((CertificateFactorySpi) ENGINE.getSpi(),
                         provider, type);
             }
         } catch (NoSuchAlgorithmException e) {
diff --git a/luni/src/main/java/javax/crypto/Cipher.java b/luni/src/main/java/javax/crypto/Cipher.java
index 20dca98..209a040 100644
--- a/luni/src/main/java/javax/crypto/Cipher.java
+++ b/luni/src/main/java/javax/crypto/Cipher.java
@@ -107,7 +107,7 @@ public class Cipher {
     /**
      * Used to access common engine functionality.
      */
-    private static final Engine engine = new Engine(SERVICE);
+    private static final Engine ENGINE = new Engine(SERVICE);
 
     /**
      * The provider.
@@ -264,53 +264,57 @@ public class Cipher {
 
         boolean needSetPadding = false;
         boolean needSetMode = false;
-        if (transf[1] == null && transf[2] == null) { // "algorithm"
-            if (provider == null) {
-                engine.getInstance(transf[0], null);
+        Object engineSpi;
+        Provider engineProvider;
+        synchronized (ENGINE) {
+            if (transf[1] == null && transf[2] == null) { // "algorithm"
+                if (provider == null) {
+                    ENGINE.getInstance(transf[0], null);
+                } else {
+                    ENGINE.getInstance(transf[0], provider, null);
+                }
             } else {
-                engine.getInstance(transf[0], provider, null);
-            }
-        } else {
-            String[] searhOrder = {
+                String[] searhOrder = {
                     transf[0] + "/" + transf[1] + "/" + transf[2], // "algorithm/mode/padding"
                     transf[0] + "/" + transf[1], // "algorithm/mode"
                     transf[0] + "//" + transf[2], // "algorithm//padding"
                     transf[0] // "algorithm"
-            };
-            int i;
-            for (i = 0; i < searhOrder.length; i++) {
-                try {
-                    if (provider == null) {
-                        engine.getInstance(searhOrder[i], null);
-                    } else {
-                        engine.getInstance(searhOrder[i], provider, null);
-                    }
-                    break;
-                } catch (NoSuchAlgorithmException e) {
-                    if ( i == searhOrder.length-1) {
-                        throw new NoSuchAlgorithmException(transformation);
+                };
+                int i;
+                for (i = 0; i < searhOrder.length; i++) {
+                    try {
+                        if (provider == null) {
+                            ENGINE.getInstance(searhOrder[i], null);
+                        } else {
+                            ENGINE.getInstance(searhOrder[i], provider, null);
+                        }
+                        break;
+                    } catch (NoSuchAlgorithmException e) {
+                        if ( i == searhOrder.length-1) {
+                            throw new NoSuchAlgorithmException(transformation);
+                        }
                     }
                 }
+                switch (i) {
+                    case 1: // "algorithm/mode"
+                        needSetPadding = true;
+                        break;
+                    case 2: // "algorithm//padding"
+                        needSetMode = true;
+                        break;
+                    case 3: // "algorithm"
+                        needSetPadding = true;
+                        needSetMode = true;
+                }
             }
-            switch (i) {
-            case 1: // "algorithm/mode"
-                needSetPadding = true;
-                break;
-            case 2: // "algorithm//padding"
-                needSetMode = true;
-                break;
-            case 3: // "algorithm"
-                needSetPadding = true;
-                needSetMode = true;
-            }
+            engineSpi = ENGINE.getSpi();
+            engineProvider = ENGINE.getProvider();
         }
-        CipherSpi cspi;
-        try {
-            cspi = (CipherSpi) engine.spi;
-        } catch (ClassCastException e) {
-            throw new NoSuchAlgorithmException(e);
+        if (!(engineSpi instanceof CipherSpi)) {
+            throw new NoSuchAlgorithmException(engineSpi.getClass().getName());
         }
-        Cipher c = new Cipher(cspi, engine.provider, transformation);
+        CipherSpi cspi = (CipherSpi) engineSpi;
+        Cipher c = new Cipher(cspi, engineProvider, transformation);
         if (needSetMode) {
             c.spiImpl.engineSetMode(transf[1]);
         }
@@ -513,7 +517,8 @@ public class Cipher {
     }
 
     private void checkMode(int mode) {
-        if (mode != ENCRYPT_MODE && mode != DECRYPT_MODE && mode != UNWRAP_MODE && mode != WRAP_MODE) {
+        if (mode != ENCRYPT_MODE && mode != DECRYPT_MODE
+            && mode != UNWRAP_MODE && mode != WRAP_MODE) {
             throw new InvalidParameterException("Invalid mode: " + mode);
         }
     }
@@ -801,9 +806,11 @@ public class Cipher {
                     //                          decipherOnly (8) }
                     if (keyUsage != null) {
                         if (opmode == ENCRYPT_MODE && (!keyUsage[7])) {
-                            throw new InvalidKeyException("The public key in the certificate cannot be used for ENCRYPT_MODE");
+                            throw new InvalidKeyException("The public key in the certificate "
+                                                          + "cannot be used for ENCRYPT_MODE");
                         } else if (opmode == DECRYPT_MODE && (!keyUsage[8])) {
-                            throw new InvalidKeyException("The public key in the certificate cannot be used for DECRYPT_MODE");
+                            throw new InvalidKeyException("The public key in the certificate "
+                                                          + "cannot be used for DECRYPT_MODE");
                         }
                     }
                 }
diff --git a/luni/src/main/java/javax/crypto/ExemptionMechanism.java b/luni/src/main/java/javax/crypto/ExemptionMechanism.java
index e3e6975..16da203 100644
--- a/luni/src/main/java/javax/crypto/ExemptionMechanism.java
+++ b/luni/src/main/java/javax/crypto/ExemptionMechanism.java
@@ -36,7 +36,7 @@ import org.apache.harmony.security.fortress.Engine;
 public class ExemptionMechanism {
 
     // Used to access common engine functionality
-    private static final Engine engine = new Engine("ExemptionMechanism");
+    private static final Engine ENGINE = new Engine("ExemptionMechanism");
 
     // Store used provider
     private final Provider provider;
@@ -100,10 +100,10 @@ public class ExemptionMechanism {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, null);
-            return new ExemptionMechanism((ExemptionMechanismSpi) engine.spi,
-                    engine.provider, algorithm);
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, null);
+            return new ExemptionMechanism((ExemptionMechanismSpi) ENGINE.getSpi(),
+                    ENGINE.getProvider(), algorithm);
         }
     }
 
@@ -167,9 +167,9 @@ public class ExemptionMechanism {
         if (provider == null) {
             throw new IllegalArgumentException("provider == null");
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, provider, null);
-            return new ExemptionMechanism((ExemptionMechanismSpi) engine.spi,
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, provider, null);
+            return new ExemptionMechanism((ExemptionMechanismSpi) ENGINE.getSpi(),
                     provider, algorithm);
         }
     }
diff --git a/luni/src/main/java/javax/crypto/KeyAgreement.java b/luni/src/main/java/javax/crypto/KeyAgreement.java
index 8df7447..4640c96 100644
--- a/luni/src/main/java/javax/crypto/KeyAgreement.java
+++ b/luni/src/main/java/javax/crypto/KeyAgreement.java
@@ -36,10 +36,10 @@ import org.apache.harmony.security.fortress.Engine;
 public class KeyAgreement {
 
     // Used to access common engine functionality
-    private static final Engine engine = new Engine("KeyAgreement");
+    private static final Engine ENGINE = new Engine("KeyAgreement");
 
     // Store SecureRandom
-    private static final SecureRandom rndm = new SecureRandom();
+    private static final SecureRandom RANDOM = new SecureRandom();
 
     // Store used provider
     private final Provider provider;
@@ -101,9 +101,9 @@ public class KeyAgreement {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, null);
-            return new KeyAgreement((KeyAgreementSpi) engine.spi, engine.provider,
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, null);
+            return new KeyAgreement((KeyAgreementSpi) ENGINE.getSpi(), ENGINE.getProvider(),
                     algorithm);
         }
     }
@@ -166,9 +166,9 @@ public class KeyAgreement {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, provider, null);
-            return new KeyAgreement((KeyAgreementSpi) engine.spi, provider,
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, provider, null);
+            return new KeyAgreement((KeyAgreementSpi) ENGINE.getSpi(), provider,
                     algorithm);
         }
     }
@@ -183,7 +183,7 @@ public class KeyAgreement {
      *             agreement.
      */
     public final void init(Key key) throws InvalidKeyException {
-        spiImpl.engineInit(key, rndm);//new SecureRandom());
+        spiImpl.engineInit(key, RANDOM);//new SecureRandom());
     }
 
     /**
@@ -220,7 +220,7 @@ public class KeyAgreement {
      */
     public final void init(Key key, AlgorithmParameterSpec params)
             throws InvalidKeyException, InvalidAlgorithmParameterException {
-        spiImpl.engineInit(key, params, rndm);//new SecureRandom());
+        spiImpl.engineInit(key, params, RANDOM);//new SecureRandom());
     }
 
     /**
diff --git a/luni/src/main/java/javax/crypto/KeyGenerator.java b/luni/src/main/java/javax/crypto/KeyGenerator.java
index 915662c..1cca416 100644
--- a/luni/src/main/java/javax/crypto/KeyGenerator.java
+++ b/luni/src/main/java/javax/crypto/KeyGenerator.java
@@ -34,10 +34,10 @@ import org.apache.harmony.security.fortress.Engine;
 public class KeyGenerator {
 
     // Used to access common engine functionality
-    private static final Engine engine = new Engine("KeyGenerator");
+    private static final Engine ENGINE = new Engine("KeyGenerator");
 
     // Store SecureRandom
-    private static final SecureRandom rndm = new SecureRandom();
+    private static final SecureRandom RANDOM = new SecureRandom();
 
     // Store used provider
     private final Provider provider;
@@ -100,9 +100,9 @@ public class KeyGenerator {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, null);
-            return new KeyGenerator((KeyGeneratorSpi) engine.spi, engine.provider,
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, null);
+            return new KeyGenerator((KeyGeneratorSpi) ENGINE.getSpi(), ENGINE.getProvider(),
                     algorithm);
         }
     }
@@ -163,9 +163,9 @@ public class KeyGenerator {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, provider, null);
-            return new KeyGenerator((KeyGeneratorSpi) engine.spi, provider,
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, provider, null);
+            return new KeyGenerator((KeyGeneratorSpi) ENGINE.getSpi(), provider,
                     algorithm);
         }
     }
@@ -191,7 +191,7 @@ public class KeyGenerator {
      */
     public final void init(AlgorithmParameterSpec params)
             throws InvalidAlgorithmParameterException {
-        spiImpl.engineInit(params, rndm);//new SecureRandom());
+        spiImpl.engineInit(params, RANDOM);//new SecureRandom());
     }
 
     /**
@@ -219,7 +219,7 @@ public class KeyGenerator {
      *            the size of the key (in bits).
      */
     public final void init(int keysize) {
-        spiImpl.engineInit(keysize, rndm);//new SecureRandom());
+        spiImpl.engineInit(keysize, RANDOM);//new SecureRandom());
     }
 
     /**
diff --git a/luni/src/main/java/javax/crypto/Mac.java b/luni/src/main/java/javax/crypto/Mac.java
index 1e98db8..e677515 100644
--- a/luni/src/main/java/javax/crypto/Mac.java
+++ b/luni/src/main/java/javax/crypto/Mac.java
@@ -36,7 +36,7 @@ import org.apache.harmony.security.fortress.Engine;
 public class Mac implements Cloneable {
 
     //Used to access common engine functionality
-    private static final Engine engine = new Engine("Mac");
+    private static final Engine ENGINE = new Engine("Mac");
 
     // Store used provider
     private final Provider provider;
@@ -103,9 +103,9 @@ public class Mac implements Cloneable {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, null);
-            return new Mac((MacSpi) engine.spi, engine.provider, algorithm);
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, null);
+            return new Mac((MacSpi) ENGINE.getSpi(), ENGINE.getProvider(), algorithm);
         }
     }
 
@@ -167,9 +167,9 @@ public class Mac implements Cloneable {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, provider, null);
-            return new Mac((MacSpi) engine.spi, provider, algorithm);
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, provider, null);
+            return new Mac((MacSpi) ENGINE.getSpi(), provider, algorithm);
         }
     }
 
diff --git a/luni/src/main/java/javax/crypto/SecretKeyFactory.java b/luni/src/main/java/javax/crypto/SecretKeyFactory.java
index 05dc1ba..f4c15eb 100644
--- a/luni/src/main/java/javax/crypto/SecretKeyFactory.java
+++ b/luni/src/main/java/javax/crypto/SecretKeyFactory.java
@@ -42,7 +42,7 @@ import org.apache.harmony.security.fortress.Engine;
 public class SecretKeyFactory {
 
     // Used to access common engine functionality
-    private static final Engine engine = new Engine("SecretKeyFactory");
+    private static final Engine ENGINE = new Engine("SecretKeyFactory");
 
     // Store used provider
     private final Provider provider;
@@ -105,10 +105,10 @@ public class SecretKeyFactory {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, null);
-            return new SecretKeyFactory((SecretKeyFactorySpi) engine.spi,
-                    engine.provider, algorithm);
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, null);
+            return new SecretKeyFactory((SecretKeyFactorySpi) ENGINE.getSpi(),
+                    ENGINE.getProvider(), algorithm);
         }
     }
 
@@ -170,9 +170,9 @@ public class SecretKeyFactory {
         if (algorithm == null) {
             throw new NullPointerException();
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, provider, null);
-            return new SecretKeyFactory((SecretKeyFactorySpi) engine.spi, provider,
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, provider, null);
+            return new SecretKeyFactory((SecretKeyFactorySpi) ENGINE.getSpi(), provider,
                     algorithm);
         }
     }
diff --git a/luni/src/main/java/javax/net/ssl/KeyManagerFactory.java b/luni/src/main/java/javax/net/ssl/KeyManagerFactory.java
index 21b9b59..b8311d0 100644
--- a/luni/src/main/java/javax/net/ssl/KeyManagerFactory.java
+++ b/luni/src/main/java/javax/net/ssl/KeyManagerFactory.java
@@ -37,7 +37,7 @@ public class KeyManagerFactory {
     private static final String SERVICE = "KeyManagerFactory";
 
     // Used to access common engine functionality
-    private static Engine engine = new Engine(SERVICE);
+    private static final Engine ENGINE = new Engine(SERVICE);
 
     // Store default property name
     private static final String PROPERTY_NAME = "ssl.KeyManagerFactory.algorithm";
@@ -76,10 +76,10 @@ public class KeyManagerFactory {
         if (algorithm == null) {
             throw new NullPointerException("algorithm is null");
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, null);
-            return new KeyManagerFactory((KeyManagerFactorySpi) engine.spi, engine.provider,
-                    algorithm);
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, null);
+            return new KeyManagerFactory((KeyManagerFactorySpi) ENGINE.getSpi(),
+                                         ENGINE.getProvider(), algorithm);
         }
     }
 
@@ -138,9 +138,10 @@ public class KeyManagerFactory {
         if (algorithm == null) {
             throw new NullPointerException("algorithm is null");
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, provider, null);
-            return new KeyManagerFactory((KeyManagerFactorySpi) engine.spi, provider, algorithm);
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, provider, null);
+            return new KeyManagerFactory((KeyManagerFactorySpi) ENGINE.getSpi(), provider,
+                                         algorithm);
         }
     }
 
@@ -163,8 +164,8 @@ public class KeyManagerFactory {
      * @param algorithm
      *            the key management algorithm name.
      */
-    protected KeyManagerFactory(KeyManagerFactorySpi factorySpi, Provider provider, String algorithm) {
-        super();
+    protected KeyManagerFactory(KeyManagerFactorySpi factorySpi, Provider provider,
+                                String algorithm) {
         this.provider = provider;
         this.algorithm = algorithm;
         this.spiImpl = factorySpi;
@@ -216,7 +217,8 @@ public class KeyManagerFactory {
      * @throws InvalidAlgorithmParameterException
      *             if an error occurs.
      */
-    public final void init(ManagerFactoryParameters spec) throws InvalidAlgorithmParameterException {
+    public final void init(ManagerFactoryParameters spec)
+            throws InvalidAlgorithmParameterException {
         spiImpl.engineInit(spec);
     }
 
diff --git a/luni/src/main/java/javax/net/ssl/SSLContext.java b/luni/src/main/java/javax/net/ssl/SSLContext.java
index 5299771..8958bf8 100644
--- a/luni/src/main/java/javax/net/ssl/SSLContext.java
+++ b/luni/src/main/java/javax/net/ssl/SSLContext.java
@@ -97,7 +97,7 @@ public class SSLContext {
         }
         synchronized (ENGINE) {
             ENGINE.getInstance(protocol, null);
-            return new SSLContext((SSLContextSpi) ENGINE.spi, ENGINE.provider, protocol);
+            return new SSLContext((SSLContextSpi) ENGINE.getSpi(), ENGINE.getProvider(), protocol);
         }
     }
 
@@ -160,7 +160,7 @@ public class SSLContext {
         }
         synchronized (ENGINE) {
             ENGINE.getInstance(protocol, provider, null);
-            return new SSLContext((SSLContextSpi) ENGINE.spi, provider, protocol);
+            return new SSLContext((SSLContextSpi) ENGINE.getSpi(), provider, protocol);
         }
     }
 
diff --git a/luni/src/main/java/javax/net/ssl/TrustManagerFactory.java b/luni/src/main/java/javax/net/ssl/TrustManagerFactory.java
index 896a486..8b4ba54 100644
--- a/luni/src/main/java/javax/net/ssl/TrustManagerFactory.java
+++ b/luni/src/main/java/javax/net/ssl/TrustManagerFactory.java
@@ -37,7 +37,7 @@ public class TrustManagerFactory {
     private static final String SERVICE = "TrustManagerFactory";
 
     // Used to access common engine functionality
-    private static Engine engine = new Engine(SERVICE);
+    private static final Engine ENGINE = new Engine(SERVICE);
 
     // Store default property name
     private static final String PROPERTYNAME = "ssl.TrustManagerFactory.algorithm";
@@ -75,10 +75,10 @@ public class TrustManagerFactory {
         if (algorithm == null) {
             throw new NullPointerException("algorithm is null");
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, null);
-            return new TrustManagerFactory((TrustManagerFactorySpi) engine.spi, engine.provider,
-                    algorithm);
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, null);
+            return new TrustManagerFactory((TrustManagerFactorySpi) ENGINE.getSpi(),
+                                           ENGINE.getProvider(), algorithm);
         }
     }
 
@@ -137,9 +137,10 @@ public class TrustManagerFactory {
         if (algorithm == null) {
             throw new NullPointerException("algorithm is null");
         }
-        synchronized (engine) {
-            engine.getInstance(algorithm, provider, null);
-            return new TrustManagerFactory((TrustManagerFactorySpi) engine.spi, provider, algorithm);
+        synchronized (ENGINE) {
+            ENGINE.getInstance(algorithm, provider, null);
+            return new TrustManagerFactory((TrustManagerFactorySpi) ENGINE.getSpi(), provider,
+                                           algorithm);
         }
     }
 
@@ -211,7 +212,8 @@ public class TrustManagerFactory {
      * @throws InvalidAlgorithmParameterException
      *             if the initialization fails.
      */
-    public final void init(ManagerFactoryParameters spec) throws InvalidAlgorithmParameterException {
+    public final void init(ManagerFactoryParameters spec)
+            throws InvalidAlgorithmParameterException {
         spiImpl.engineInit(spec);
     }
 
diff --git a/luni/src/main/java/org/apache/harmony/security/fortress/Engine.java b/luni/src/main/java/org/apache/harmony/security/fortress/Engine.java
index c5bb376..924ba01 100644
--- a/luni/src/main/java/org/apache/harmony/security/fortress/Engine.java
+++ b/luni/src/main/java/org/apache/harmony/security/fortress/Engine.java
@@ -28,12 +28,62 @@ import org.apache.harmony.security.Util;
 
 
 /**
+ * This class implements common functionality for Provider supplied
+ * classes. The usage pattern is to allocate static Engine instance
+ * per service type and synchronize on that instance during calls to
+ * {@code getInstance} and retreival of the selected {@code Provider}
+ * and Service Provider Interface (SPI) results. Retreiving the
+ * results with {@code getProvider} and {@code getSpi} sets the
+ * internal {@code Engine} values to null to prevent memory leaks.
  *
- * This class implements common functionality for all engine classes
+ * <p>
  *
+ * For example: <pre>   {@code
+ *   public class Foo {
+ *
+ *       private static final Engine ENGINE = new Engine("Foo");
+ *
+ *       private final FooSpi spi;
+ *       private final Provider provider;
+ *       private final String algorithm;
+ *
+ *       protected Foo(FooSpi spi,
+ *                     Provider provider,
+ *                     String algorithm) {
+ *           this.spi = spi;
+ *           this.provider = provider;
+ *           this.algorithm = algorithm;
+ *       }
+ *
+ *       public static Foo getInstance(String algorithm) {
+ *           synchronized (ENGINE) {
+ *               ENGINE.getInstance(algorithm, null);
+ *               return new Foo((FooSpi) ENGINE.getSpi(),
+ *                              ENGINE.getProvider(),
+ *                              algorithm);
+ *           }
+ *       }
+ *
+ *       public static Foo getInstance(String algorithm, Provider provider) {
+ *           synchronized (ENGINE) {
+ *               ENGINE.getInstance(algorithm, provider, null);
+ *               return new Foo((FooSpi) ENGINE.getSpi(),
+ *                              provider(),
+ *                              algorithm);
+ *           }
+ *       }
+ *
+ *       ...
+ *
+ * }</pre>
  */
 public class Engine {
 
+    /**
+     * Access to package visible api in java.security
+     */
+    public static SecurityAccess door;
+
     // Service name
     private final String serviceName;
 
@@ -47,19 +97,14 @@ public class Engine {
     private int refreshNumber;
 
     /**
-     * Provider
+     * Provider selected by last call to getInstance
      */
-    public Provider provider;
+    private Provider provider;
 
     /**
-     * SPI instance
+     * SPI selected by last call to getInstance
      */
-    public Object spi;
-
-    /**
-     * Access to package visible api in java.security
-     */
-    public static SecurityAccess door;
+    private Object spi;
 
     /**
      * Creates a Engine object
@@ -79,7 +124,7 @@ public class Engine {
      * @param service
      * @throws NoSuchAlgorithmException
      */
-    public synchronized void getInstance(String algorithm, Object param)
+    public void getInstance(String algorithm, Object param)
             throws NoSuchAlgorithmException {
         Provider.Service serv;
 
@@ -88,8 +133,8 @@ public class Engine {
         }
         Services.refresh();
         if (returnedService != null
-                && Util.equalsIgnoreCase(algorithm, lastAlgorithm)
-                && refreshNumber == Services.refreshNumber) {
+                && Util.equalsIgnoreCase(algorithm, this.lastAlgorithm)
+                && this.refreshNumber == Services.refreshNumber) {
             serv = returnedService;
         } else {
             if (Services.isEmpty()) {
@@ -102,15 +147,17 @@ public class Engine {
                 throw notFound(serviceName, algorithm);
             }
             returnedService = serv;
-            lastAlgorithm = algorithm;
-            refreshNumber = Services.refreshNumber;
+            this.lastAlgorithm = algorithm;
+            this.refreshNumber = Services.refreshNumber;
         }
-        spi = serv.newInstance(param);
+        this.spi = serv.newInstance(param);
         this.provider = serv.getProvider();
     }
 
-    private NoSuchAlgorithmException notFound(String serviceName, String algorithm) throws NoSuchAlgorithmException {
-        throw new NoSuchAlgorithmException(serviceName + " " + algorithm + " implementation not found");
+    private NoSuchAlgorithmException notFound(String serviceName, String algorithm)
+            throws NoSuchAlgorithmException {
+        throw new NoSuchAlgorithmException(serviceName + " " + algorithm
+                                           + " implementation not found");
     }
 
     /**
@@ -123,7 +170,7 @@ public class Engine {
      * @param provider
      * @throws NoSuchAlgorithmException
      */
-    public synchronized void getInstance(String algorithm, Provider provider,
+    public void getInstance(String algorithm, Provider provider,
             Object param) throws NoSuchAlgorithmException {
 
         Provider.Service serv = null;
@@ -134,8 +181,29 @@ public class Engine {
         if (serv == null) {
             throw notFound(serviceName, algorithm);
         }
-        spi = serv.newInstance(param);
+        this.spi = serv.newInstance(param);
         this.provider = provider;
     }
 
+    /**
+     * Returns the provider selected by last call to getInstance and
+     * then clears the internal provider state such that subsequent
+     * calls with return null until the next call to getInstance.
+     */
+    public Provider getProvider() {
+        Provider result = provider;
+        provider = null;
+        return result;
+    }
+
+    /**
+     * Returns the provider selected by last call to getInstance and
+     * then clears the internal provider state such that subsequent
+     * calls with return null until the next call to getInstance.
+     */
+    public Object getSpi() {
+        Object result = spi;
+        spi = null;
+        return result;
+    }
 }