When jasper uses org.apache.jasper.xmlparser.ParserUtils, it uses the no-arg newInstance methods of JAXP. These methods use the TCCL to locate the xml parser. The problem with this approach is the assumption that the framework's classes and the deployment classes are on the same class loader. This assumption works fine if a traditional hierarchical class loader is used. However, it does not work under a modern modular class loading environment, where the goal is to isolate the user's classes from the running environment (supporting for example the ability to use the parser of their choice).

The simplest solution to this problem is to wrap all no-arg calls with TCCL push-pop to jaspers's defining class loader.