The test program use reflection and subclassing to groom the softreferences in both classes CacheEntry and CachedJarFile for garbage collections at 2 references. Deploy code do have mechanism to recover from situation where soft-reference being cleared. However, the signing cache data were store in multiple pieces and the client calls might get one piece from old referenced before the recovery, then use that data as key to retrieve another data in the after-recovery map, hence failure to lookup.
The immediate and simple fix is to make sure that before we return the signing data from soft reference, check all other soft reference to see if they are still there. If any are not, clear all together, so signing data would be rebuild together on first access since in being garbage-collected.