SecuritySupportClass

package com.sun.org.apache.xalan.internal.xsltc.dom;
 private static final Object securitySupport;

    static {
	SecuritySupport ss = null;
	try {
	    Class c = Class.forName("java.security.AccessController");
	  
	    ss = new SecuritySupport12();
	} catch (Exception ex) {
	    // ignore it
	} finally {
	    if (ss == null)
		ss = new SecuritySupport();
	    securitySupport = ss;
	}
    }

Unfortunately, we can't load the class using reflection because the class is package private. And the class has to be package private so the APIs aren't exposed to other code that could use them to circumvent security. Thus, we accept the risk that the direct reference might fail on some JDK 1.1 JVMs, even though we would never execute this code in such a case. Normally we havn't the right to initiate the accessController class. Here we use reflection to get this right.