7:12 Yue Li,Tian Tan,and Jingling Xue ■Instance Methods■Static Methods ■Instance Fields Static Fields 100% 80% 08 (a)Method::invoke()call sites (b)Field::get(/set()call sites Fig.6.The percentage frequency distribution of reflective-action call sites on instance and static members. objects returned from getMethods()and 15 fld.get()and fld.set()call sites called on an array of Field objects returned by getDeclaredFields().Through these calls,dozens of methods are invoked and hundreds of fields are modified reflectively.Ignoring such methods as in prior work [38]and tools(BDDBDDB,WALA,Soor)may lead to significantly missed program behaviours by the analysis. Remark 2.In member-retrieving methods,get(Declared)Methods/Fields/Constructors(),which return an array of member metaobjects,are usually ignored by most of existing reflection analysis tools.However,they play an important role in certain applications for both method invocations and field manipulations. O3.Static or Instance Members.In the literature on reflection analysis [32,38,51,68],reflective targets are mostly assumed to be instance members.Accordingly,calls to the reflective-action methods such as invoke(),get()and set(),are usually considered as virtual calls,instance field accesses,and instance field modifications,respectively (see Table 1 for details).However,in real programs,as shown in Figure 6,on average,37%of the invoke()call sites are found to invoke static methods and 50%of the get()/set()call sites are found to access/modify static fields.Thus in practice,reflection analysis should distinguish both cases and also be aware of whether a reflective target is a static or instance member,since the approaches for resolving both cases are usually different. Remark 3.Static methods/fields are invoked/accessed nearly as frequently as instance methods/- fields in Java reflection,even though the latter has received more attention in the literature.In practice,reflection analysis should distinguish the two cases and adopt appropriate approaches for handling them. Q4.Resolving newInstance()by Casts.In Figure 3,when cName is not a string constant,the (dynamic)type of obj created by newInstance()in line 4 is unknown.For this case,Livshits et al.[38]propose to infer the type of obj by leveraging the cast operation that post-dominates intra-procedurally the newInstance()call site.If the cast type is A,the type of obj must be A or ACM Trans.Softw.Eng.Methodol.,Vol.28,No.2,Article 7.Publication date:February 2019.7:12 Yue Li, Tian Tan, and Jingling Xue 0% 20% 40% 60% 80% 100% antlr chart eclipse fop hsqldb jython lucene pmd xalan eclipse4 javac jedit jetty tomcat average Instance Methods Static Methods (a) Method::invoke() call sites average antlr chart eclipse fop hsqldb jython lucene pmd xalan eclipse4 javac jedit jetty tomcat average Instance Fields Static Fields (b) Field::get()/set() call sites Fig. 6. The percentage frequency distribution of reflective-action call sites on instance and static members. objects returned from getMethods() and 15 fld.get() and fld.set() call sites called on an array of Field objects returned by getDeclaredFields(). Through these calls, dozens of methods are invoked and hundreds of fields are modified reflectively. Ignoring such methods as in prior work [38] and tools (Bddbddb, Wala, Soot) may lead to significantly missed program behaviours by the analysis. Remark 2. In member-retrieving methods, get(Declared)Methods/Fields/Constructors(), which return an array of member metaobjects, are usually ignored by most of existing reflection analysis tools. However, they play an important role in certain applications for both method invocations and field manipulations. Q3. Static or Instance Members. In the literature on reflection analysis [32, 38, 51, 68], reflective targets are mostly assumed to be instance members. Accordingly, calls to the reflective-action methods such as invoke(), get() and set(), are usually considered as virtual calls, instance field accesses, and instance field modifications, respectively (see Table 1 for details). However, in real programs, as shown in Figure 6, on average, 37% of the invoke() call sites are found to invoke static methods and 50% of the get()/set() call sites are found to access/modify static fields. Thus in practice, reflection analysis should distinguish both cases and also be aware of whether a reflective target is a static or instance member, since the approaches for resolving both cases are usually different. Remark 3. Static methods/fields are invoked/accessed nearly as frequently as instance methods/- fields in Java reflection, even though the latter has received more attention in the literature. In practice, reflection analysis should distinguish the two cases and adopt appropriate approaches for handling them. Q4. Resolving newInstance() by Casts. In Figure 3, when cName is not a string constant, the (dynamic) type of obj created by newInstance() in line 4 is unknown. For this case, Livshits et al. [38] propose to infer the type of obj by leveraging the cast operation that post-dominates intra-procedurally the newInstance() call site. If the cast type is A, the type of obj must be A or ACM Trans. Softw. Eng. Methodol., Vol. 28, No. 2, Article 7. Publication date: February 2019