7:16 Yue Li,Tian Tan,and Jingling Xue Application:Eclipse (v4.2.2) Class:org.eclipse.osgi.framework.internal.core.FrameworkCommandInterpreter 123 public Object execute(String cmd){... 155 Object[]parameters new Object[](this};... 167 for (int i =0;i<size;i++){ 174 method target.getclass().getMethod("_"+cmd,parameterTypes); 175 retval method.invoke(target,parameters);...} 228} Fig.10.Self-inferencing property for a reflective method invocation,deduced from the number and dynamic types of the components of the one-dimensional array argument,parameters,at a invoke()call site. the descriptor of the target method in line 175 must have only one argument and its actual type must be FrameworkCommandInterpreter or one of its supertypes. Application:Eclipse (v4.2.2) Class:org.eclipse.osgi.framework.internal.core.Framework 1652 public static Field getField(Class clazz,...){ 1653 Field[]fields =clazz.getDeclaredFields();... 1654 for (int i=0;i fields.length;i++){... 1658 return fields[i];}.. 1662) 1682 private static void forceContentHandlerFactory(...){ 1683 Field factoryField getField(URLConnection.class,...); 1687 java.net.ContentHandlerFactory factory (java.net.ContentHandlerFactory)factoryField.get(null);... 1709} Fig.11.Self-inferencing property for a reflective field access,deduced from the type casted on the returned value of,and the null argument used at,a get()call site. Example 2.2(Reflective Field Access(Figure 11)).In line 1683,factoryField is obtained as a Field object from an array of Field objects created in line 1653 for all the fields in URLConnection.In line 1687,the object returned from get()is cast to java.net.ContentHandlerFactory.Based on its cast operation and null argument,we know that the call to get()may only access the static fields of URLConnection with the type java.net.ContentHandlerFactory,its supertypes or its subtypes. Without the self-inferencing property at the get()call site,all the fields in URLConnection must be assumed to be accessed conservatively by an analysis. Example 2.3(Reflective Field Modification (Figure 12)).Like the case in Figure 11,the field object in line 290 is also read from an array of field objects created in line 302.This code pattern appears one more time in line 432 in the same class,i.e,org.eclipse.osgi.util.NLS(not shown here). According to the two arguments,null and value,provided at set()(line 290),we can deduce ACM Trans.Softw.Eng.Methodol.,Vol.28,No.2,Article 7.Publication date:February 2019.7:16 Yue Li, Tian Tan, and Jingling Xue Application: Eclipse (v4.2.2) Class:org.eclipse.osgi.framework.internal.core.FrameworkCommandInterpreter 123 public Object execute(String cmd) {... 155 Object[] parameters = new Object[] {this}; ... 167 for (int i = 0; i < size; i++) { 174 method = target.getClass().getMethod("_" + cmd, parameterTypes); 175 retval = method.invoke(target, parameters); ...} 228 } Fig. 10. Self-inferencing property for a reflective method invocation, deduced from the number and dynamic types of the components of the one-dimensional array argument, parameters, at a invoke() call site. the descriptor of the target method in line 175 must have only one argument and its actual type must be FrameworkCommandInterpreter or one of its supertypes. Application: Eclipse (v4.2.2) Class:org.eclipse.osgi.framework.internal.core.Framework 1652 public static Field getField(Class clazz, ...) { 1653 Field[] fields = clazz.getDeclaredFields(); ... 1654 for (int i = 0; i < fields.length; i++) { ... 1658 return fields[i]; } ... 1662 } 1682 private static void forceContentHandlerFactory(...) { 1683 Field factoryField = getField(URLConnection.class, ...); 1687 java.net.ContentHandlerFactory factory = (java.net.ContentHandlerFactory) factoryField.get(null); ... 1709 } Fig. 11. Self-inferencing property for a reflective field access, deduced from the type casted on the returned value of, and the null argument used at, a get() call site. Example 2.2 (Reflective Field Access (Figure 11)). In line 1683, factoryField is obtained as a Field object from an array of Field objects created in line 1653 for all the fields in URLConnection. In line 1687, the object returned from get() is cast to java.net.ContentHandlerFactory. Based on its cast operation and null argument, we know that the call to get() may only access the static fields of URLConnection with the type java.net.ContentHandlerFactory, its supertypes or its subtypes. Without the self-inferencing property at the get() call site, all the fields in URLConnection must be assumed to be accessed conservatively by an analysis. Example 2.3 (Reflective Field Modification (Figure 12)). Like the case in Figure 11, the field object in line 290 is also read from an array of field objects created in line 302. This code pattern appears one more time in line 432 in the same class, i.e., org.eclipse.osgi.util.NLS (not shown here). According to the two arguments, null and value, provided at set() (line 290), we can deduce ACM Trans. Softw. Eng. Methodol., Vol. 28, No. 2, Article 7. Publication date: February 2019