core/src/main/java/org/springframework/security/access/method/AbstractMethodSecurityMetadataSource.java
public final Collection<ConfigAttribute> getAttributes(Object object) {
		if (object instanceof MethodInvocation) {
			MethodInvocation mi = (MethodInvocation) object;
			Object target = mi.getThis();
			Class<?> targetClass = null;

			if (target != null) {
				targetClass = target instanceof Class<?> ? (Class<?>) target
						: AopProxyUtils.ultimateTargetClass(target);
			}
			Collection<ConfigAttribute> attrs = getAttributes(mi.getMethod(), targetClass);
			if (attrs != null && !attrs.isEmpty()) {
				return attrs;
			}
			if (target != null && !(target instanceof Class<?>)) {
				attrs = getAttributes(mi.getMethod(), target.getClass());
			}
			return attrs;
		}

		throw new IllegalArgumentException("Object must be a non-null MethodInvocation");
	}
public final Collection<ConfigAttribute> getAttributes(Object object) {
		if (object instanceof MethodInvocation) {
			MethodInvocation mi = (MethodInvocation) object;
			Object target = mi.getThis();
			Class<?> targetClass = null;

			if (target != null) {
				targetClass = target instanceof Class<?> ? (Class<?>) target
						: AopProxyUtils.ultimateTargetClass(target);
			}
			Collection<ConfigAttribute> attrs = getAttributes(mi.getMethod(), targetClass);
			if (attrs != null && !attrs.isEmpty()) {
				return attrs;
			}
			if (target != null && !(target instanceof Class<?>)) {
				attrs = getAttributes(mi.getMethod(), target.getClass());
			}
			return attrs;
		}

		throw new IllegalArgumentException("Object must be a non-null MethodInvocation");
	}
========================================================================================================