Application:Eclipse(v4.2.2): Class:org.eclipse.osgi.framework.internal.core.Framework 1652 public static Field getField(Class clazz,...) 1653 Field[]fields clazz.getDeclaredFields();... 1654 for(int i=0;i<fields.length;i++){... 1658 return fields[i];} 1682 private static void forceContentHandlerFactory(...){ 1683 Field factoryField getField(URLConnection.class,...) 1687 java.net.ContentHandlerFactory factory (java.net.ContentHandlerFactory)factoryField.get(null);...} Fig.8.Target field inference based on the type cast at get () The same code pattern in Figure 8 also appears in five other places in Eclipse4.The prior analyses [4,8,20]cannot resolve the call get()above since getDeclaredFields()is ignored.ELF has succeeded in deducing that only two out of a total of 13 static fields in URLConnection are accessed at the callsite. Scenario I2:Field fs1 clz.getDeclaredFields();f2 fs2fil;a =(A)f1.get(obj); GETDECLAREDFIELDS(invo,clz) VCALL(invo,clz,mtd),MTDSTRINC(mtd, "java.lang.Class:java.lang.reflect.Fieldl/getDeclaredFields()") ARRAYPOINTSTo(phArray,phHeap),VARPOINTSTo(fs1,phArray) GETDECLAREDFIELDS(invo,clz),VARPOINTSTo(clz,clzHeap),TYPE-CLASSTYPE(type,clzHeap) MEMBERPHARRAY(invo,phArray),MEMBERPH(invo,type,phHeap),ACTUALRETURN(invo,fs1). VARPOINTSTo(fI,fldHeap) GET(invo,f1),VARPOINTSTo(fI,phHeap), MEMBERPH(getDecInvo,type,phHeap),GETDECLAREDFIELDS(getDecInvo,), GETCAST(invo,cast Type),HIERARCHYTYPE(cast Type,AdType). FLDDECL(type,,fdType,Ald),FLD-FLDHEAP(fd,AldHeap). It is now easy to understand Scenario I2.The second rule processes each call to getDeclaredFields().For each class clz of a known type,type,fsI is made to point to phArray (a placeholder representing an array),which points to phHeap(a placeholder representing implicitly all the fields obtained in the call to getDeclaredFields()).When f2 fs2/i/is analyzed by the pointer analysis engine,fl will point to whatever fs1 contains if the values of fs1 fow into fs2 and the values of f2 flow into f1.The last rule leverages the type cast information to resolve fI at a get()call to its potential target Field objects,fldHeap.As a result.the second rule in Scenario P4 has now been enabled. Scenario I3:Field[]fsl=clz.getDeclaredFields();f2=fs2[i];fl.set(obj,val). This is similar to Scenario I2,except that the dynamic types of val (e.g.,the dynamic type of value in line 290 in Figure 9 is java.lang.String)are used to infer the target fields modified.Thus,the second rule in Scenario P5 is enabled. Application:Eclipse(v4.2.2): Class:org.eclipse.osgi.util.NiS 300 static void load(final String bundleName,Class<?>clazz){ 302 final Field[]fieldArray clazz.getDeclaredFields(); 336 computeMissingMessages(...,fieldArray,...);...} 267 private static void computeMissingMessages(...,Field[]fieldArray,...) 272 for (int i =0;i<numFields;i++){ 273 Field field fieldArray[i]; 284 String value "NLS missing message:"+... 290 field.set(null,value);...}} Fig.9.Target field inference based on the dynamic type of value in set ()Application:Eclipse(v4.2.2): Class:org.eclipse.osgi.framework.internal.core.Framework 1652 public static Field getField(Class clazz, ...) { 1653 Field[] fields = clazz.getDeclaredFields(); ... 1654 for(int i=0; i<fields.length; i++) { ... 1658 return fields[i]; }} 1682 private static void forceContentHandlerFactory(...) { 1683 Field factoryField = getField(URLConnection.class, ...); 1687 java.net.ContentHandlerFactory factory = (java.net.ContentHandlerFactory) factoryField.get(null);...} Fig. 8. Target field inference based on the type cast at get(). The same code pattern in Figure 8 also appears in five other places in Eclipse4. The prior analyses [4, 8, 20] cannot resolve the call get() above since getDeclaredFields() is ignored. Elf has succeeded in deducing that only two out of a total of 13 static fields in URLConnection are accessed at the callsite. Scenario I2: Field[] fs1 = clz.getDeclaredFields(); f2 = fs2[i]; a = (A) f1.get(obj); GetDeclaredFields(invo, clz ) ← Vcall(invo, clz, mtd), MtdString(mtd, “java.lang.Class: java.lang.reflect.Field[] getDeclaredFields()”). ArrayPointsTo(phArray, phHeap), VarPointsTo(fs1, phArray) ← GetDeclaredFields(invo, clz ), VarPointsTo(clz, clzHeap), Type-ClassType(type, clzHeap) MemberPhArray(invo, phArray),MemberPh(invo, type, phHeap),ActualReturn(invo, fs1). VarPointsTo(f1, fldHeap) ← Get(invo, f1), VarPointsTo(f1, phHeap), MemberPh(getDecInvo, type, phHeap), GetDeclaredFields(getDecInvo, _), GetCast(invo, castType), HierarchyType(castType, fldType), FldDecl(type, _, fldType, fld), Fld-FldHeap(fld, fldHeap). It is now easy to understand Scenario I2. The second rule processes each call to getDeclaredFields(). For each class clz of a known type, type, fs1 is made to point to phArray (a placeholder representing an array), which points to phHeap (a placeholder representing implicitly all the fields obtained in the call to getDeclaredFields()). When f2 = fs2[i] is analyzed by the pointer analysis engine, f1 will point to whatever fs1 contains if the values of fs1 flow into fs2 and the values of f2 flow into f1. The last rule leverages the type cast information to resolve f1 at a get() call to its potential target Field objects, fldHeap. As a result, the second rule in Scenario P4 has now been enabled. Scenario I3: Field[] fs1=clz.getDeclaredFields(); f2=fs2[i]; f1.set(obj, val). This is similar to Scenario I2, except that the dynamic types of val (e.g., the dynamic type of value in line 290 in Figure 9 is java.lang.String) are used to infer the target fields modified. Thus, the second rule in Scenario P5 is enabled. Application:Eclipse(v4.2.2): Class:org.eclipse.osgi.util.NLS 300 static void load(final String bundleName, Class<?> clazz) { 302 final Field[] fieldArray = clazz.getDeclaredFields(); 336 computeMissingMessages(..., fieldArray, ...);...} 267 private static void computeMissingMessages(..., Field[] fieldArray, ...) { 272 for (int i = 0; i < numFields; i++) { 273 Field field = fieldArray[i]; 284 String value = "NLS missing message: " + ...; 290 field.set(null, value);...}} Fig. 9. Target field inference based on the dynamic type of value in set()