The following two lines are missing:

/* Apply any domain caller mapping. This should really only be
done for non-run-as callers.
*/
if (rm != null)
caller = rm.getPrincipal(caller);

This is right after we make an attempt to get the caller principal. If we get a caller principal to be null, the
realm mapping may convert the null principal into an unauthenticatedIdentity defined at the security domain level via
the JAAS login module option.