m.flag = false;
        final Class generate(ClassLoader loader) {            byte[] bytecode = new byte[ pool.length() + stream.length()];            // More efficient to bypass calling charAt() repetitively.            char[] c = pool.toString().toCharArray();            int i = c.length;            while (--i >= 0)                bytecode[ i] = (byte) c[ i];            c = stream.toString().toCharArray();            i = c.length;            int j = bytecode.length;            while (i > 0)                bytecode[ --j] = (byte) c[ --i];            // Patch the constant pool size, which we left at 0 earlier.            int count = poolEntries.size() + 1;            bytecode[ 8] = (byte) (count >> 8);            bytecode[ 9] = (byte) count;            try {                // XXX Do we require more native support here?                // XXX Security hole - it is possible for another thread to grab                // the                // VMClassLoader.defineClass Method object, and abuse it while                // we                // have temporarily made it accessible. Do we need to add some                // synchronization lock to prevent user reflection while we use                // it?                // XXX This is waiting on VM support for protection domains.                Class vmClassLoader = Class.forName("java.lang.VMClassLoader");                Class[] types = { ClassLoader.class, String.class,                        byte[].class, int.class, int.class,                /* ProtectionDomain.class */                };                Method m = vmClassLoader                        .getDeclaredMethod("defineClass", types);                // Bypass the security check of setAccessible(true), since this                // is trusted code. But note the comment above about the                // security                // risk of doing this outside a synchronized block.                m.flag = true;                Object[] args = { loader, qualName, bytecode, new Integer(0),                        new Integer(bytecode.length),                /* Object.class.getProtectionDomain() */                };                Class clazz = (Class) m.invoke(null, args);                m.flag = false;                // Finally, initialize the m field of the proxy class, before                // returning it.                // No security risk here, since clazz has not been exposed yet,                // so user code cannot grab the same reflection object.                Field f = clazz.getDeclaredField("m");                f.flag = true;                // we can share the array, because it is not publicized                f.set(null, methods);                f.flag = false;                return clazz;            } catch (Throwable e) {                // assert false;                throw (Error) new InternalError("Unexpected: " + e)                        .initCause(e);            }        }