Access to package private members of a class should be restricted to classes and interfaces in the same runtime package of the class. When checking the package membership, the JikesRVM code fails to compare the defining class loaders of the accessing and declaring classes, allowing access to package private members by all classes that share the same package name.
The enclosed patch (against revision 13675) fixes the tests in the reflection code. Checking for access from the byte-code is part of the tasks of the byte-code verifier.
A test program and expected correct output are also enclosed.