src/java.xml.bind/share/classes/com/sun/xml/internal/bind/v2/ClassFactory.java

@@ -1,7 +1,7 @@
 /*
- * Copyright (c) 1997, 2015, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2011, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License version 2 only, as
  * published by the Free Software Foundation.  Oracle designates this

@@ -85,29 +85,20 @@
         Constructor<T> cons = null;
         WeakReference<Constructor> consRef = m.get(clazz);
         if(consRef!=null)
             cons = consRef.get();
         if(cons==null) {
+            if (System.getSecurityManager() == null) {
+                cons = tryGetDeclaredConstructor(clazz);
+            } else {
             cons = AccessController.doPrivileged(new PrivilegedAction<Constructor<T>>() {
                 @Override
                 public Constructor<T> run() {
-                    try {
-                        return clazz.getDeclaredConstructor(emptyClass);
-                    } catch (NoSuchMethodException e) {
-                        logger.log(Level.INFO,"No default constructor found on "+clazz,e);
-                        NoSuchMethodError exp;
-                        if(clazz.getDeclaringClass()!=null && !Modifier.isStatic(clazz.getModifiers())) {
-                            exp = new NoSuchMethodError(Messages.NO_DEFAULT_CONSTRUCTOR_IN_INNER_CLASS
-                                                                .format(clazz.getName()));
-                        } else {
-                            exp = new NoSuchMethodError(e.getMessage());
-                        }
-                        exp.initCause(e);
-                        throw exp;
-                    }
+                        return tryGetDeclaredConstructor(clazz);
                 }
             });
+            }
 
             int classMod = clazz.getModifiers();
 
             if(!Modifier.isPublic(classMod) || !Modifier.isPublic(cons.getModifiers())) {
                 // attempt to make it work even if the constructor is not accessible

@@ -124,10 +115,27 @@
         }
 
         return cons.newInstance(emptyObject);
     }
 
+    private static <T> Constructor<T> tryGetDeclaredConstructor(Class<T> clazz) {
+        try {
+            return clazz.getDeclaredConstructor((Class<T>[])emptyClass);
+        } catch (NoSuchMethodException e) {
+            logger.log(Level.INFO,"No default constructor found on "+clazz,e);
+            NoSuchMethodError exp;
+            if(clazz.getDeclaringClass()!=null && !Modifier.isStatic(clazz.getModifiers())) {
+                exp = new NoSuchMethodError(Messages.NO_DEFAULT_CONSTRUCTOR_IN_INNER_CLASS
+                                                    .format(clazz.getName()));
+            } else {
+                exp = new NoSuchMethodError(e.getMessage());
+            }
+            exp.initCause(e);
+            throw exp;
+        }
+    }
+
     /**
      * The same as {@link #create0} but with an error handling to make
      * the instantiation error fatal.
      */
     public static <T> T create( Class<T> clazz ) {