ELF works as part of a flow-insensitive Andersen's pointer analysis context- sensitively.However,all the Datalog rules are given here context-insensitively. There are 207 Datalog rules.One set of rules handles all the 98 possible scenarios (i.e.,combinations)involving the methods listed in Table 2(illustrated in Figure 5),where 98 =4 (four member-introspecting methods)x 3 (three side-effect methods,invoke(),get()and set())x 4(four possible arrows in Figure 5)x 2(two types of side-effect methods each,instance or static)+2 (newInstance()with a statically known or unknown type).This set of rules is further divided into those for performing target propagation(involving 4x 3x 1x 2+1 =25 scenarios)and those for performing target inference.The remaining set of rules handles Constructor and arrays and performs bookkeeping duties. Section 4.1 gives a set of domains and input/output relations used.Section 4.2 describes the seven target propagation scenarios corresponding to Labels 1-7 in Figure 5.Section 4.3 describes four representative target inference scenarios.All the other rules(available as an open-source tool)can be understood analogously. Section 4.4 discusses briefly some properties about our analysis. T:set of class types V:set of program variables M:set of methods F:set of fields H:set of heap abstractions I:set of invocation sites N:set of natural numbers S:set of strings SCALL(invo:I,mtd:M) VCALL(invo:I.base:V,mtd:M) ACTUALARC(invo:I,i:N,arg:V) ACTUALRETURN(invo:I,var:V) HEAPTYPE(heap:H,type:T) ASSICNABLE(to Type:T,from Type:T) THISVAR(mtd:M,this:V) LOOKUPMTD(type:T,mName:H,dp:S,mtd:M) MTDSTRING(mtd:M,str:S) STRING ToCLASS(strConst:H,type:T) MTDDECL(type:T,mName:H,dp:S,mtd:M) FLDDECL(type:T,fName:H,fType:T,Ad:F) PUBLICMTD(type:T,mName:H,mtd:M) PUBLICFLD(type:T.fName:H,Ad:F) NEWINSTANCEHEAP(type:T.heap:H) TYPE-CLASSHEAP(type:T,clzHeap:H) MTD-MTDHEAP(mtd:M,mtdHeap:H) FLD-FLDHEAP(Ad:F,fdHeap:H) VARPOINTSTo(var:V,heap:H) CALLGRAPH(invo:I,mtd:M) FLDPOINTSTo(base:H,Ad:F,heap:H) REPCALLGRAPH(invo:I.mtd:M) Fig.6.Domains and input/output relations 4.1 Domains and Input/Output Relations Figure 6 shows the eight domains used,18 input relations and four output rela- tions.Given a method mtd called at an invocation site I.as a static call (SCALL) or a virtual call(VCALL),its i-th argument arg is identified by AcTuALARG and its returned value is assigned to var as identified by AcruALRETURN. HEAPTYPE describes the types of heap objects.AssIGNABLE is the usual sub- typing relation.THIsVAR correlates this to each method where it is declared. MrDSTRING specifies the signatures (in the form of strings)for all the meth- ods,including also their containing class types and return types.STRINGTo- CLAss records the class type information for all compile-time string names. LookUPMTD matches a method mtd named mName with descriptor dp to its definition in a class,type.For simplicity,mName is modeled as a heap object inElf works as part of a flow-insensitive Andersen’s pointer analysis context￾sensitively. However, all the Datalog rules are given here context-insensitively. There are 207 Datalog rules. One set of rules handles all the 98 possible scenarios (i.e., combinations) involving the methods listed in Table 2 (illustrated in Figure 5), where 98 = 4 (four member-introspecting methods) × 3 (three side-effect methods, invoke(), get() and set()) × 4 (four possible arrows in Figure 5) × 2 (two types of side-effect methods each, instance or static) + 2 (newInstance() with a statically known or unknown type). This set of rules is further divided into those for performing target propagation (involving 4×3×1× 2 + 1 = 25 scenarios) and those for performing target inference. The remaining set of rules handles Constructor and arrays and performs bookkeeping duties. Section 4.1 gives a set of domains and input/output relations used. Section 4.2 describes the seven target propagation scenarios corresponding to Labels 1 – 7 in Figure 5. Section 4.3 describes four representative target inference scenarios. All the other rules (available as an open-source tool) can be understood analogously. Section 4.4 discusses briefly some properties about our analysis. T: set of class types V : set of program variables M: set of methods F: set of fields H : set of heap abstractions I : set of invocation sites N : set of natural numbers S: set of strings Scall(invo:I, mtd:M) Vcall(invo:I, base:V, mtd:M) ActualArg(invo:I, i:N, arg:V ) ActualReturn(invo:I, var:V ) HeapType(heap:H, type:T) Assignable(toType:T, fromType:T) ThisVar(mtd:M, this:V ) LookUpMtd(type:T, mName:H, dp:S, mtd:M) MtdString(mtd:M, str:S) StringToClass(strConst:H, type:T) MtdDecl(type:T, mName:H, dp:S, mtd:M) FldDecl(type:T, fName:H, fType:T, fld:F) PublicMtd(type:T, mName:H, mtd:M) PublicFld(type:T, fName:H, fld:F) NewInstanceHeap(type:T, heap:H ) Type-ClassHeap(type:T, clzHeap:H ) Mtd-MtdHeap(mtd:M, mtdHeap:H ) Fld-FldHeap(fld:F, fldHeap:H ) VarPointsTo(var:V, heap:H ) CallGraph(invo:I, mtd:M) FldPointsTo(base:H, fld:F, heap:H ) RefCallGraph(invo:I, mtd:M) Fig. 6. Domains and input/output relations. 4.1 Domains and Input/Output Relations Figure 6 shows the eight domains used, 18 input relations and four output rela￾tions. Given a method mtd called at an invocation site I, as a static call (Scall) or a virtual call (Vcall), its i-th argument arg is identified by ActualArg and its returned value is assigned to var as identified by ActualReturn. HeapType describes the types of heap objects. Assignable is the usual sub￾typing relation. ThisVar correlates this to each method where it is declared. MtdString specifies the signatures (in the form of strings) for all the meth￾ods, including also their containing class types and return types. StringTo￾Class records the class type information for all compile-time string names. LookUpMtd matches a method mtd named mName with descriptor dp to its definition in a class, type. For simplicity, mName is modeled as a heap object in