are therefore motivated to partition D into different du-chain Finally,for each representative path selected for a du-chain groups so that one group contains exactly one definition for group X partitioned from DR,we obtain a path-based slice every variable used at R.Clearly,all the paths that contain the by applying traditional slicing [23].[24]to R.However, same du-chains for R must trigger the same set of reflective we only consider the data and control dependences for the targets at R.Therefore,only one representative path needs to statements on the path and restrict the slice to GR. be selected for each du-chain group.As the partition obtained statically this way is not guaranteed to be the coarsest at run time,different du-chain groups may still trigger the same set A4,6-8,9,11,12,13,17,18,21,22,32,33,34,35-37,41,42 of reflective targets at R. B4,6-8,9,11,12,1317,18,21,22,32,33,34,35,36,38,39,41,42 ⊙4,5,6,9,11,12,13,17,18,21,22,32,33,34,35,36,38,39,41,42 7一12一173537 D4,5,6,9,11,12,13,17,18,21,22,32,33,34,35-37,41,42 净42 41 Fig.6:Path-based slices for the paths in Figure 5. 7→1217→3539入 净42 441 Figure 6 gives the slices found for the four representative 39 →12→1735< 净42 paths in Figure 5.For each path,the statements on the path that 41 are irrelevant to line 42 with respect to this path are crossed 12→1735< 37 out.In addition,line 22 is the only (new)statement added. 净42 41 2)Reflection Resolution (Dynamic Analysis):For each path-based slice obtained for R,we generate its test cases and Fig.4:Partitioning of D42 into du-chain groups. discover its reflective targets at R by instrumented execution. a)Stage 3.Automatic Test Case Generation:Each Figure 4 gives a partition of D42 in Equation (1)into four path-based slice has only one execution path.As in sym- du-chain groups,A,B.C and D.Note that 512 and bolic execution [34]-1381.a path condition is collected that 7=12 cannot appear in the same group since className is comprises all the constraints affecting the execution of the defined in lines 5 and 7 but used in line 12.Similarly,37=42 path.However,unlike the prior work,MIRROR models a and 3942 cannot appear in the same group since getM is variety of object-oriented features such as instanceof, defined in lines 37 and 39 but used in line 42. isAssignableFrom and type casts in order to generate Given a du-chain group Xm of DR,we will find a represen- test cases more comprehensively.In general,we will generate tative path that contains all the du-pairs in X such that for a set of different test inputs that satisfy the path condition so every s1→s2∈Xr,ifs→s2∈DR\XR,thens1 will not that different reflective targeted can be captured. appear on the path.This ensures that s is the only definition for s2 on this path.We will achieve this by performing BFS Args[]E"pmd.cpd SimpleRendererer",("pmd.cpd.XMLRendererer", on the ICFG (inter-procedural Control Flow Graph)of the "pmd.cpd.CSVRendererer","pmd.cpd.VSRendererer" program restricted to GR.If such a path does not exist,X B Args[]={"content.HTTPRequcst" is ignored.This can happen when X contains two du-pairs No input needed that appear in two mutually exclusive branches and thus cannot D hold simultaneously during program execution. Fig.7:Test inputs generated for the slices in Figure 6. A4,6-9,11,12,17,18,13,21,32-37,41,42 B4,6-9,11,12,17,18,13,21,32-36,38,39,41,42 Figure 7 give the test inputs generated.For slice A,four test C4-6,9,11,12,17,1813,21,32-36,38,39,41,42 cases for Args [0]at line 4 are generated due to pmd.cpd. D4-6,9,11,12,17,18,13.21,32-37,41,42 Renderer.class.isAssignableFrom(clz)in its path condition.Here,SimpleRenderer,XMLRenderer,C Fig.5:Representative paths for the du-chain groups in Fig- SVRenderer and VSRenderer are the four subclasses of ure 4. interface pmd.cpd.Renderer.For slice B,one test case is generated for Args[0]at line 4 due to content.HTTPRe Figure 5 gives the representative paths found for the four quest.class.isAssignableFrom(clz).For slice C. du-chain groups in Figure 4.In each case,there are two paths no input is needed as all variables are well initialized.For slice due to line 9.The shorter one that contains no statements in D,its path is infeasible due to two inconsistent constraints the if branch in lines 9-10 is selected.Note that for the className="content.HTTPRequest"and pmd.cpd du-chain groups C and D in Figure 4.with each containing Renderer.class.isAssignableFrom(clz). the definition of className in line 5,the other definition Let us now examine the implications of Observation I of className in line 7 is skipped.Thus,the else branch of on the precision of MIRROR.If a conditional,say,x = the if statement in lines 9-10 will be followed. 0 that affects the execution of R involves a definition of 15are therefore motivated to partition DR into different du-chain groups so that one group contains exactly one definition for every variable used at R. Clearly, all the paths that contain the same du-chains for R must trigger the same set of reflective targets at R. Therefore, only one representative path needs to be selected for each du-chain group. As the partition obtained statically this way is not guaranteed to be the coarsest at run time, different du-chain groups may still trigger the same set of reflective targets at R. A 4 7 12 17 35 37 41 42 B 4 7 12 17 35 39 41 42 C 5 12 35 39 41 17 42 5 12 35 37 41 D 5 17 42 Fig. 4: Partitioning of D42 into du-chain groups. Figure 4 gives a partition of D42 in Equation (1) into four du-chain groups, A, B, C and D. Note that 5 ⇒ 12 and 7 ⇒ 12 cannot appear in the same group since className is defined in lines 5 and 7 but used in line 12. Similarly, 37 ⇒ 42 and 39 ⇒ 42 cannot appear in the same group since getM is defined in lines 37 and 39 but used in line 42. Given a du-chain group XR of DR, we will find a represen￾tative path that contains all the du-pairs in XR such that for every s1 ⇒ s2 ∈ XR, if s 1 ⇒ s2 ∈ DR \XR, then s 1 will not appear on the path. This ensures that s1 is the only definition for s2 on this path. We will achieve this by performing BFS on the ICFG (inter-procedural Control Flow Graph) of the program restricted to GR. If such a path does not exist, XR is ignored. This can happen when XR contains two du-pairs that appear in two mutually exclusive branches and thus cannot hold simultaneously during program execution. 4, 6-9, 11, 12, 17, 18, 13, 21, 32-37, 41, 42 4, 6-9, 11, 12, 17, 18, 13, 21, 32-36, 38, 39, 41, 42 4-6, 9, 11, 12, 17, 18, 13, 21, 32-36, 38, 39, 41, 42 4-6, 9, 11, 12, 17, 18, 13, 21, 32-37, 41, 42 A B C D Fig. 5: Representative paths for the du-chain groups in Fig￾ure 4. Figure 5 gives the representative paths found for the four du-chain groups in Figure 4. In each case, there are two paths due to line 9. The shorter one that contains no statements in the if branch in lines 9 – 10 is selected. Note that for the du-chain groups C and D in Figure 4, with each containing the definition of className in line 5, the other definition of className in line 7 is skipped. Thus, the else branch of the if statement in lines 9 – 10 will be followed. Finally, for each representative path selected for a du-chain group XR partitioned from DR, we obtain a path-based slice by applying traditional slicing [23], [24] to R. However, we only consider the data and control dependences for the statements on the path and restrict the slice to GR. B A C D 4, 6-8, 9, 11, 12, 13, 17, 18, 21,
22, 32, 33, 34, 35-37, 41, 42

4, 6-8, 9, 11, 12, 13, 17, 18, 21,
22, 32, 33, 34, 35, 36, 38, 39, 41, 42

4, 5, 6, 9, 11, 12, 13, 17, 18, 21,

22, 32, 33, 34, 35, 36, 38, 39, 41, 42

4, 5, 6, 9, 11, 12, 13, 17, 18, 21,

22, 32, 33, 34, 35-37, 41, 42

Fig. 6: Path-based slices for the paths in Figure 5. Figure 6 gives the slices found for the four representative paths in Figure 5. For each path, the statements on the path that are irrelevant to line 42 with respect to this path are crossed out. In addition, line 22 is the only (new) statement added. 2) Reflection Resolution (Dynamic Analysis): For each path-based slice obtained for R, we generate its test cases and discover its reflective targets at R by instrumented execution. a) Stage 3. Automatic Test Case Generation: Each path-based slice has only one execution path. As in sym￾bolic execution [34]–[38], a path condition is collected that comprises all the constraints affecting the execution of the path. However, unlike the prior work, MIRROR models a variety of object-oriented features such as instanceof, isAssignableFrom and type casts in order to generate test cases more comprehensively. In general, we will generate a set of different test inputs that satisfy the path condition so that different reflective targeted can be captured. B A D Args[] ∈ {{“pmd.cpd.SimpleRendererer”}, {“pmd.cpd.XMLRendererer”}, Args[] = {“content.HTTPRequest”} D Infeasible path C No input needed {“pmd.cpd.CSVRendererer”}, {“pmd.cpd.VSRendererer”}} Fig. 7: Test inputs generated for the slices in Figure 6. Figure 7 give the test inputs generated. For slice A, four test cases for Args[0] at line 4 are generated due to pmd.cpd. Renderer.class.isAssignableFrom(clz) in its path condition. Here, SimpleRenderer, XMLRenderer, C SVRenderer and VSRenderer are the four subclasses of interface pmd.cpd.Renderer. For slice B, one test case is generated for Args[0] at line 4 due to content.HTTPRe quest.class.isAssignableFrom(clz). For slice C, no input is needed as all variables are well initialized. For slice D, its path is infeasible due to two inconsistent constraints, className="content.HTTPRequest" and pmd.cpd .Renderer.class.isAssignableFrom(clz). Let us now examine the implications of Observation 1 on the precision of MIRROR. If a conditional, say, x == 0 that affects the execution of R involves a definition of 15