I found there was a contradiction in
servlet spec(pdf),
at p313: <!ELEMENT security-role-ref (description?, role-name, role-link)>
at p336: <!ELEMENT security-role-ref (description?, role-name, role-link?)>
Wondering whether role-link is required or not in security-role-ref?