Understanding and Analyzing Java Reflection 7:9 Table 1.Nine reflective-action methods and their side effects on the pointer analysis,assuming that the target class of clz and ctor is A,the target method of mtd is m and the target field of fld is f. Simplified Method Calling Scenario Side Effect Class::newInstance o=clz.newInstance( o=new A() Constructor::newInstance o ctor.newInstance(farg1,.) o new A(arg1,...) Method::invoke a mtdinvoke(o,farg1,...) a=o.m(arg1,.) Field:get a fldget(o) a=o.f Field::set fld.set(o,a) o.f=a Proxy:newProxyInstance o Proxy.newProxyInstance(...) o=new Proxy$*(.) Array::newInstance o Array.newInstance(clz,size) o=new A[size] Array::get a=Array.get(o,i) a=o[i] Array::set Array.set(o,i,a) o[)=a The side effects of get()and set()are retrieving (loading)and modifying (storing)the value of a instance field,respectively,when their first argument,say o,is not null;otherwise, they are operating on a static field. The side effect of newProxyInstance()is creating an object of a proxy class Proxy$*,and this proxy class is generated dynamically according to its arguments(containing a Class object).Proxy.newProxyInstance()can be analyzed according to its semantics.A call to this method returns a Proxy object,which has an associated invocation handler object that implements the InvocationHandler interface.A method invocation on a Proxy object through one of its Proxy interfaces will be dispatched to the invoke()method of the object's invocation handler. The side effect of Array.newInstance()is creating an array (object)with the compo- nent type represented by the Class object(e.g.,clz in Table 1)used as its first argument. Array.get()and Array.set()are retrieving and modifying an index element in the array object specified as their first argument,respectively. 2.3 Reflection Usage The Java reflection API is rich and complex.We have conducted an empirical study to understand reflection usage in practice in order to guide the design and implementation of a sophisticated reflection analysis described in this paper.In this section,we first list the focus questions in Section 2.3.1,then describe the experimental setup in Section 2.3.2,and finally,present the study results in Section 2.3.3. 2.3.1 Focus Questions.We address the following seven focus questions in order to understand how Java reflection is used in the real world. .Q1.Existing reflection analyses resolve reflection by analyzing statically the string arguments of class-retrieving and member-retrieving method calls.How often are these strings constants ACM Trans.Softw.Eng.Methodol.,Vol.28,No.2,Article 7.Publication date:February 2019.Understanding and Analyzing Java Reflection 7:9 Table 1. Nine reflective-action methods and their side effects on the pointer analysis, assuming that the target class of clz and ctor is A, the target method of mtd is m and the target field of fld is f. Simplified Method Calling Scenario Side Effect Class::newInstance o = clz.newInstance() o = new A() Constructor::newInstance o = ctor.newInstance({arg1, ...}) o = new A(arg1, ...) Method::invoke a = mtd.invoke(o, {arg1, ...}) a = o.m(arg1, ...) Field::get a = fld.get(o) a = o.f Field::set fld.set(o, a) o.f = a Proxy::newProxyInstance o = Proxy.newProxyInstance(...) o = new Proxy$*(...) Array::newInstance o = Array.newInstance(clz, size) o = new A[size] Array::get a = Array.get(o, i) a = o[i] Array::set Array.set(o, i, a) o[i] = a • The side effects of get() and set() are retrieving (loading) and modifying (storing) the value of a instance field, respectively, when their first argument, say o, is not null; otherwise, they are operating on a static field. • The side effect of newProxyInstance() is creating an object of a proxy class Proxy$*, and this proxy class is generated dynamically according to its arguments (containing a Class object). Proxy.newProxyInstance() can be analyzed according to its semantics. A call to this method returns a Proxy object, which has an associated invocation handler object that implements the InvocationHandler interface. A method invocation on a Proxy object through one of its Proxy interfaces will be dispatched to the invoke() method of the object’s invocation handler. • The side effect of Array.newInstance() is creating an array (object) with the compo￾nent type represented by the Class object (e.g., clz in Table 1) used as its first argument. Array.get() and Array.set() are retrieving and modifying an index element in the array object specified as their first argument, respectively. 2.3 Reflection Usage The Java reflection API is rich and complex. We have conducted an empirical study to understand reflection usage in practice in order to guide the design and implementation of a sophisticated reflection analysis described in this paper. In this section, we first list the focus questions in Section 2.3.1, then describe the experimental setup in Section 2.3.2, and finally, present the study results in Section 2.3.3. 2.3.1 Focus Questions. We address the following seven focus questions in order to understand how Java reflection is used in the real world. • Q1. Existing reflection analyses resolve reflection by analyzing statically the string arguments of class-retrieving and member-retrieving method calls. How often are these strings constants ACM Trans. Softw. Eng. Methodol., Vol. 28, No. 2, Article 7. Publication date: February 2019