Summary
-------

Change `java.lang.invoke.MethodType::fromMethodDescriptorString(String desc, ClassLoader loader` to call `SecurityManger::checkPermission` with `RuntimePermission("getClassLoader")`  if loader parameter is null.

Problem
-------

`MethodType::fromMethodDescriptorString(String desc, ClassLoader loader` default to use the system class loader if loader parameter is null.   Cross-loader access is not guarded with `RuntimePermission("getClassLoader")` permission check when the security manager is present as it is loading classes on behalf of the caller.

Solution
--------

`MethodType::fromMethodDescriptorString` should perform the same security permission check as `ClassLoader::getSystemClassLoader` does when loader parameter is null.  This only impacts existing code that calls this method with loader == null when security manager is present but "getClassLoader" permission is not granted.

One alternative solution is to require the loader parameter to be non-null but this will impact existing code even it's running with security manager is absent.

Specification
-------------

The spec of `java.lang.invoke.MethodType::fromMethodDescriptorString` is updated as follows:

```
@@ -1076,9 +1078,8 @@
     /**
      * Finds or creates an instance of a method type, given the spelling of its bytecode descriptor.
      * Convenience method for {@link #methodType(java.lang.Class, java.lang.Class[]) methodType}.
-     * Any class or interface name embedded in the descriptor string
-     * will be resolved by calling {@link ClassLoader#loadClass(java.lang.String)}
-     * on the given loader (or if it is null, on the system class loader).
+     * Any class or interface name embedded in the descriptor string will be
+     * resolved by the given loader (or if it is null, on the system class loader).
      * <p>
      * Note that it is possible to encounter method types which cannot be
      * constructed by this method, because their component types are
@@ -1092,10 +1093,19 @@
      * @throws NullPointerException if the string is null
      * @throws IllegalArgumentException if the string is not well-formed
      * @throws TypeNotPresentException if a named type cannot be found
+     * @throws SecurityException if the security manager is present and
+     *         {@code loader} is {@code null} and the caller does not have the
+     *         {@link RuntimePermission}{@code ("getClassLoader")}
      */
```