Classc-Class.forName(cName)Ept(eName)P.FoRNAME g{g码sc c=toClass(val(o)) Method m=c.getMethod(mName,.）ept(nName）c∈pt(eP.GETMTD] 「{}ifc-=c'AOtrin6 E3C pt(m)2 (ifc--cf A orine Sc 8.tr u {og}ifc=c“Aorins ESC s.nm =val(osrin) 8.p=u a}ifc=c“Aoin Fig.6.Rules for Propagation. 3.4.3 Inference Fig.7 gives three rules to infer the reflective target methods for x =(A)m.invoke(y,args),where A indicates a post-dominating cast on its result.If A =Object,then no such cast exists.In [I-INvTPl,we use the types of the objects pointed to by y to infer the class types of the target methods called. Note that m'represents a freshly generated Method metaobject.In [I-INvsic),we use the information available at a call site(excluding y)to infer the descriptor in the signature of a target method.In [-INvS2T],we use the signature of a method to infer the class types of the method. x =(A)m.invoke(y,args)muE pt(m) oke(y.args},m-Pl-INvT到ptm2{m2】s.pe Pip(args),a.tr《:A,s.nm=u}-N pt(m)2{moe pt(y)) x(A)m.invoke(y.args)pt(m)oe pt(y)Ptp(args)-IvS2T) pt(m)2{mltE M(s.tr.s.nm:s.p)} Fig.7.Rules for Inference. As is standard,t<:t'holds when t is t'or a subtype of t'.In [I-INvSic)and [-INvs2T],:is used to take advantage of the post-dominating cast (A)during inference when A is not Object.By definition,u:Object holds.If t'is not Object,then t:t'holds if and only if t <t'or t'<:t holds.The information on args is also exploited,where args is an array of type object []only when it can be analyzed exactly element-wise by an intraprocedural analysis.In this case,suppose that args is an array of n elements.Let Ai be the set of types of the objects pointed to by its i-th element,args [i].Let P={t'tAi,t<:t'). Then Ptp(args)=Po×·×Pn-i.Otherwise,Ptp(args)=,implying that args is ignored as it cannot be exploited effectively during inference. To maintain precision in [I-INvs2T],we use a method signature to infer its classes when both its name and descriptor are known.In this rule,the function M(st,,s.nm,s.p)returns the set of class types where the method with the speci- fied signature s is declared if s.nmu and s.pu,and otherwise.The return type of the matching method is ignored if s.tr =u. Let us illustrate some of our rules by considering our example in Fig.1. Erample 1.Note that cName1 is an input string.Suppose that cName2 is also an input string but mName2 is a string constant.By applying [P-FORNAME),[P-GErMTD] and [L-UKWTP](in Fig.9)to the calls to forName()in lines 2 and 6,getMethod() and newInstance(),respectively,we obtain c1“∈pt(c1),c2“∈pt(c2),mg∈ pt(m)and o"e pt(v),where s is a signature with a known method name in mName2.Given args new object [{x,y),Ptp(args)is built as describedClass c “ Class.forNamepcNameq o String i P pt(cName) ptpcq Ě " tc t u if o String i P SC tc uu otherwise c t “ toClasspvalpo String i qq [P-ForName] Method m “ c 1 .getMethodpmName, ...q o String i P pt(mName) c P pt(c1 ) ptpmq Ě $ ’’’& ’’’% tm t s u if c “ c t ^ o String i P SC tm t uu if c “ c t ^ o String i R SC tm u s u if c “ c u ^ o String i P SC tm u uu if c “ c u ^ o String i R SC s.tr “ u s.nm “ valpo String i q s.p “ u [P-GetMtd] Fig. 6. Rules for Propagation. 3.4.3 Inference Fig. 7 gives three rules to infer the reflective target methods for x = (A) m.invoke(y,args), where A indicates a post-dominating cast on its result. If A = Object, then no such cast exists. In [I-InvTp], we use the types of the objects pointed to by y to infer the class types of the target methods called. Note that m t represents a freshly generated Method metaobject. In [I-InvSig], we use the information available at a call site (excluding y) to infer the descriptor in the signature of a target method. In [I-InvS2T], we use the signature of a method to infer the class types of the method. m.invoke(y, args) m u P pt(m) pt(m) Ě t m t | o t i P pt(y)u [I-InvTp] x “ pAq m.invoke(y, args) mu P pt(m) pt(m) Ě t ms | s.p P P tppargsq, s.tr !: A, s.nm “ uu [I-InvSig] x “ pAq m.invoke(y, args) m u s P pt(m) o u i P pt(y) s.tr !: A s.nm ‰ u s.p P P tppargsq pt(m) Ě t m t s | t P Mps.tr, s.nm, s.pqu [I-InvS2T] Fig. 7. Rules for Inference. As is standard, t ă: t 1 holds when t is t 1 or a subtype of t 1 . In [I-InvSig] and [I-InvS2T], !: is used to take advantage of the post-dominating cast (A) during inference when A is not Object. By definition, u !: Object holds. If t 1 is not Object, then t !: t 1 holds if and only if t ă: t 1 or t 1 ă: t holds. The information on args is also exploited, where args is an array of type Object[], only when it can be analyzed exactly element-wise by an intraprocedural analysis. In this case, suppose that args is an array of n elements. Let Ai be the set of types of the objects pointed to by its i-th element, args[i]. Let Pi “ tt 1 | t P Ai , t ă: t 1 u. Then P tppargsq “ P0 ˆ ¨ ¨ ¨ ˆ Pn´1. Otherwise, P tppargsq “ ∅, implying that args is ignored as it cannot be exploited effectively during inference. To maintain precision in [I-InvS2T], we use a method signature to infer its classes when both its name and descriptor are known. In this rule, the function Mpstr , s.nm, s.pq returns the set of class types where the method with the speci- fied signature s is declared if s.nm ‰ u and s.p ‰ u, and ∅ otherwise. The return type of the matching method is ignored if s.tr “ u. Let us illustrate some of our rules by considering our example in Fig. 1. Example 1. Note that cName1 is an input string. Suppose that cName2 is also an input string but mName2 is a string constant. By applying [P-ForName], [P-GetMtd] and [L-UkwTp] (in Fig. 9) to the calls to forName() in lines 2 and 6, getMethod() and newInstance(), respectively, we obtain c1u P ptpc1q, c2u P ptpc2q, m u s P ptpmq and o u i P ptpvq, where s is a signature with a known method name in mName2. Given args = new Object[] {x,y}, P tppargsq is built as described