SimpleAuthenticationInfo.merge does not merge principals if its internal principal collection is not mutable

In SimpleAuthenticationInfo.merge(AuthenticationInfo), there is the following code:

        if (this.principals == null) {
            this.principals = info.getPrincipals();
        } else {
            if (this.principals instanceof MutablePrincipalCollection) {
                ((MutablePrincipalCollection) this.principals).addAll(info.getPrincipals());
            } else {
                this.principals = new SimplePrincipalCollection(this.principals);
            }
        }

The logic in the nested else block appears incorrect. If the current "principals" collection is not MutablePrincipalCollection, a new SimplePrincipalCollection, which is mutable, is constructed from it. However, it does not copy the principals from other.getPrincipals(), which by that point in the method is known to be non-null and non-empty, after it makes a mutable principal collection.