src/com/sun/org/apache/xerces/internal/jaxp/validation/XMLSchemaFactory.java

@@ -362,14 +362,19 @@
             if (System.getSecurityManager() != null && (!value)) {
                 throw new SAXNotSupportedException(
                         SAXMessageFormatter.formatMessage(null,
                         "jaxp-secureprocessing-feature", null));
             }
-            fSecurityManager = value ? new SecurityManager() : null;
-            fXMLSchemaLoader.setProperty(SECURITY_MANAGER, fSecurityManager);
+            if (value) {
+                fSecurityManager = new SecurityManager();
             fXMLSchemaLoader.setProperty(ACCESS_EXTERNAL_DTD, Constants.EXTERNAL_ACCESS_DEFAULT_FSP);
             fXMLSchemaLoader.setProperty(ACCESS_EXTERNAL_SCHEMA, Constants.EXTERNAL_ACCESS_DEFAULT_FSP);
+            } else {
+                fSecurityManager = null;
+            }
+
+            fXMLSchemaLoader.setProperty(SECURITY_MANAGER, fSecurityManager);
             return;
         } else if (name.equals(Constants.ORACLE_FEATURE_SERVICE_MECHANISM)) {
             //in secure mode, let _useServicesMechanism be determined by the constructor
             if (System.getSecurityManager() != null)
                 return;