We got the attached exception unpredictably and very often. I'm not sure about the cause of the problem, but although I don't understand what is happening there, it seems to me that it might be related to ZKSPRING-22 in which they got the same exception and which is fixed in the other branch of the same if statement where we got our exception. By naive interpretation I would suppose that the same fix must be done for this bug.

if (comp instanceof IdSpace) {
	//Shouldn't there be the same fix for VirtualIdSpace as for ZKSPRING-22?
	final Component parent = ((Component)comp).getParent(); // this is where our exception occurs
	spaceOwner = parent == null ? ((Component)comp).getPage() : parent.getSpaceOwner();
} else if (comp instanceof Component){
	spaceOwner = ((Component)comp).getSpaceOwner();
	if (!(spaceOwner instanceof Component)){
		//ZKSPRING-22 in zk6, space owner might be VirtualIdSpace
		spaceOwner = ((Component)comp).getPage(); 
	}
} else {

Caused by: java.lang.ClassCastException: org.zkoss.zk.ui.VirtualIdSpace cannot be cast to org.zkoss.zk.ui.Component
at org.zkoss.spring.security.intercept.zkevent.ZkEventProcessDefinitionSourceImpl.toPath(ZkEventProcessDefinitionSourceImpl.java:147)
at org.zkoss.spring.security.intercept.zkevent.ZkEventProcessDefinitionSourceImpl.toPath(ZkEventProcessDefinitionSourceImpl.java:159)
at org.zkoss.spring.security.intercept.zkevent.ZkEventProcessDefinitionSourceImpl.toPath(ZkEventProcessDefinitionSourceImpl.java:159)
at org.zkoss.spring.security.intercept.zkevent.ZkEventProcessDefinitionSourceImpl.toPath(ZkEventProcessDefinitionSourceImpl.java:159)
at org.zkoss.spring.security.intercept.zkevent.ZkEventProcessDefinitionSourceImpl.toPath(ZkEventProcessDefinitionSourceImpl.java:159)
at org.zkoss.spring.security.intercept.zkevent.ZkEventProcessDefinitionSourceImpl.getAttributes(ZkEventProcessDefinitionSourceImpl.java:135)
at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:172)
at org.zkoss.spring.security.intercept.zkevent.ZkEventProcessInterceptor.beforeInvocation(ZkEventProcessInterceptor.java:57)
at org.zkoss.spring.security.intercept.zkevent.ZkEventProcessListener.beforeProcessEvent(ZkEventProcessListener.java:86)
at org.zkoss.zk.ui.impl.EventInterceptors.beforeProcessEvent(EventInterceptors.java:146)
at org.zkoss.zk.ui.util.Configuration.beforeProcessEvent(Configuration.java:2524)
at org.zkoss.zk.ui.impl.DesktopImpl.beforeProcessEvent(DesktopImpl.java:1210)
at org.zkoss.zk.ui.impl.EventProcessor.process(EventProcessor.java:130)
at org.zkoss.zk.ui.impl.UiEngineImpl.processEvent(UiEngineImpl.java:1710)
... 68 more