--- a/src/java.xml/share/classes/javax/xml/xpath/XPathFactory.java	Wed Oct 04 10:44:21 2017 -0700
+++ b/src/java.xml/share/classes/javax/xml/xpath/XPathFactory.java	Wed Oct 04 10:54:18 2017 -0700
@@ -26,6 +26,7 @@
 package javax.xml.xpath;
 
 import com.sun.org.apache.xpath.internal.jaxp.XPathFactoryImpl;
+import jdk.xml.internal.SecuritySupport;
 
 /**
  * <p>An {@code XPathFactory} instance can be used to create
@@ -63,11 +64,6 @@
     public static final String DEFAULT_OBJECT_MODEL_URI = "http://java.sun.com/jaxp/xpath/dom";
 
     /**
-     *<p> Take care of restrictions imposed by java security model </p>
-     */
-    private static SecuritySupport ss = new SecuritySupport() ;
-
-    /**
      * <p>Protected constructor as {@link #newInstance()} or {@link #newInstance(String uri)}
      * or {@link #newInstance(String uri, String factoryClassName, ClassLoader classLoader)}
      * should be used to create a new instance of an {@code XPathFactory}.</p>
@@ -217,7 +213,7 @@
                     "XPathFactory#newInstance(String uri) cannot be called with uri == \"\"");
         }
 
-        ClassLoader classLoader = ss.getContextClassLoader();
+        ClassLoader classLoader = SecuritySupport.getContextClassLoader();
 
         if (classLoader == null) {
             //use the current class loader
@@ -296,7 +292,7 @@
         }
 
         if (cl == null) {
-            cl = ss.getContextClassLoader();
+            cl = SecuritySupport.getContextClassLoader();
         }
 
         XPathFactory f = new XPathFactoryFinder(cl).createInstance(factoryClassName);