The default behavior of the SecurityAssociation was incorrectly changed to use InheritableThreadLocals, and the initialization of child threads is leaking the parent ArrayList value and this is resulting in unsafe usage of the list as the parent and child thread thread local are referencing the same ArrayList. This can be worked around by setting the org.jboss.security.SecurityAssociation.ThreadLocal system property to true to avoid the use of the InheritableThreadLocal in favor of simple ThreadLocals.

The InheritableThreadLocal.childValue() needs to be overriden to avoid leaking references across threads.