--- old/src/java.base/share/classes/java/lang/invoke/MethodHandles.java	2018-01-22 01:04:30.074042933 -0500
+++ new/src/java.base/share/classes/java/lang/invoke/MethodHandles.java	2018-01-22 01:04:27.905918398 -0500
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008, 2017, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2008, 2018, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -835,7 +835,7 @@
             }
             // Allow nestmate lookups to be created without special privilege:
             if ((newModes & PRIVATE) != 0
-                && !VerifyAccess.isSamePackageMember(this.lookupClass, requestedLookupClass)) {
+                && !Reflection.areNestMates(this.lookupClass, requestedLookupClass)) {
                 newModes &= ~(PRIVATE|PROTECTED);
             }
             if ((newModes & PUBLIC) != 0
@@ -2216,17 +2216,13 @@
             return "member is private to package";
         }
 
-        private static final boolean ALLOW_NESTMATE_ACCESS = false; // experiment with protected nestmate access
-
         private void checkSpecialCaller(Class<?> specialCaller, Class<?> refc) throws IllegalAccessException {
             int allowedModes = this.allowedModes;
             if (allowedModes == TRUSTED)  return;
             if (!hasPrivateAccess()
                 || (specialCaller != lookupClass()
                        // ensure non-abstract methods in superinterfaces can be special-invoked
-                    && !(refc != null && refc.isInterface() && refc.isAssignableFrom(specialCaller))
-                    && !(ALLOW_NESTMATE_ACCESS &&
-                         VerifyAccess.isSamePackageMember(specialCaller, lookupClass()))))
+                    && !(refc != null && refc.isInterface() && refc.isAssignableFrom(specialCaller))))
                 throw new MemberName(specialCaller).
                     makeAccessException("no private access for invokespecial", this);
         }
@@ -2237,9 +2233,7 @@
             if (!method.isProtected() || method.isStatic()
                 || allowedModes == TRUSTED
                 || method.getDeclaringClass() == lookupClass()
-                || VerifyAccess.isSamePackage(method.getDeclaringClass(), lookupClass())
-                || (ALLOW_NESTMATE_ACCESS &&
-                    VerifyAccess.isSamePackageMember(method.getDeclaringClass(), lookupClass())))
+                || VerifyAccess.isSamePackage(method.getDeclaringClass(), lookupClass()))
                 return false;
             return true;
         }
--- old/src/java.base/share/classes/sun/invoke/util/VerifyAccess.java	2018-01-22 01:04:36.450409180 -0500
+++ new/src/java.base/share/classes/sun/invoke/util/VerifyAccess.java	2018-01-22 01:04:34.274284187 -0500
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008, 2017, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2008, 2018, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -61,23 +61,29 @@
      * the defining class should be passed for both arguments ({@code defc == refc}).
      * <h3>JVM Specification, 5.4.4 "Access Control"</h3>
      * A field or method R is accessible to a class or interface D if
-     * and only if any of the following conditions is true:<ul>
-     * <li>R is public.
+     * and only if any of the following is true:
+     * <ul>
+     * <li>R is public.</li>
      * <li>R is protected and is declared in a class C, and D is either
-     *     a subclass of C or C itself.  Furthermore, if R is not
-     *     static, then the symbolic reference to R must contain a
-     *     symbolic reference to a class T, such that T is either a
-     *     subclass of D, a superclass of D or D itself.
-     * <li>R is either protected or has default access (that is,
-     *     neither public nor protected nor private), and is declared
-     *     by a class in the same runtime package as D.
-     * <li>R is private and is declared in D.
+     *     a subclass of C or C itself. Furthermore, if R is not static,
+     *     then the symbolic reference to R must contain a symbolic
+     *     reference to a class T, such that T is either a subclass of D,
+     *     a superclass of D, or D itself.
+     *     <p>During verification, it was also required that, even if T is
+     *     a superclass of D, the target reference of a protected instance
+     *     field access or method invocation must be an instance of D or a
+     *     subclass of D (4.10.1.8).</p></li>
+     * <li>R is either protected or has default access (that is, neither
+     *     public nor protected nor private), and is declared by a class
+     *     in the same run-time package as D.</li>
+     * <li>R is private and is declared in D by a class or interface
+     *     belonging to the same nest as D.</li>
      * </ul>
-     * This discussion of access control omits a related restriction
-     * on the target of a protected field access or method invocation
-     * (the target must be of class D or a subtype of D). That
-     * requirement is checked as part of the verification process
-     * (5.4.1); it is not part of link-time access control.
+     * If a referenced field or method is not accessible, access checking
+     * throws an IllegalAccessError. If an exception is thrown while
+     * attempting to determine the nest host of a class or interface,
+     * access checking fails for the same reason.
+     *
      * @param refc the class used in the symbolic reference to the proposed member
      * @param defc the class in which the proposed member is actually defined
      * @param mods modifier flags for the proposed member
@@ -97,9 +103,9 @@
             return false;
         }
         // Usually refc and defc are the same, but verify defc also in case they differ.
-        if (defc == lookupClass &&
-            (allowedModes & PRIVATE) != 0)
+        if (defc == lookupClass)
             return true;        // easy check; all self-access is OK
+
         switch (mods & ALL_ACCESS_MODES) {
         case PUBLIC:
             return true;  // already checked above
@@ -125,9 +131,9 @@
             return ((allowedModes & PACKAGE_ALLOWED) != 0 &&
                     isSamePackage(defc, lookupClass));
         case PRIVATE:
-            // Loosened rules for privates follows access rules for nestmates.
+            // Rules for privates follows access rules for nestmates.
             return ((allowedModes & PRIVATE) != 0 &&
-                    isSamePackageMember(defc, lookupClass));
+                    Reflection.areNestMates(defc, lookupClass));
         default:
             throw new IllegalArgumentException("bad modifiers: "+Modifier.toString(mods));
         }
@@ -330,22 +336,6 @@
         return Objects.equals(class1.getPackageName(), class2.getPackageName());
     }
 
-    /**
-     * Test if two classes are defined as part of the same package member (top-level class).
-     * If this is true, they can share private access with each other.
-     * @param class1 a class
-     * @param class2 another class
-     * @return whether they are identical or nested together
-     */
-    public static boolean isSamePackageMember(Class<?> class1, Class<?> class2) {
-        if (class1 == class2)
-            return true;
-        if (!isSamePackage(class1, class2))
-            return false;
-        
-        return Reflection.areNestMates(class1, class2);
-    }
-
     private static boolean loadersAreRelated(ClassLoader loader1, ClassLoader loader2,
                                              boolean loader1MustBeParent) {
         if (loader1 == loader2 || loader1 == null