From related bug:

Not directly targeting the subject of this bug but on a related topic is the attached patch which replaces the System.security field with a VolatileCallSite. The patch is not working properly yet because of bootstrapping issues but the idea is that CallSite optimizations in the JIT compilers can constant fold the System.getSecurityManager() call. Combined with intrinsification of Class.getClassLoader() (or better moving the class loader field up into Java) we could constant fold two security related checks.