Kinds of expressions that may be objects and how to handle them: * Method call: check return variable `-output-`. * Variable: look for definition via `VariableAction` and check that expression. * Field access: look for definition via `VariableAction` and check that expression. * Parameter: look for definition in every caller to this method (search for `actual-in` nodes' types, transitively) and check that expression. * Array access: assume every type possible (in the future, track each position). * Cast, parenthesis, etc.: unwrap if appropriate (if downcast, assume cast type and subtypes). * Object creation, array creation: only the given type. Alter the creation of the call graph to remove arcs that shouldn't be there: if the scope cannot be of a given type, some method may never be called. This is a fixed-point problem, where we can assume as initial guess that the return values may be of any possible type. Each change (arc deletion) must be propagated in both directions: the callee no longer receives certain types as parameters, and the caller no longer obtains certain types as return value.