docs: public Set<Integer> analyze() {
      // Get ExceptionPrunedCFG
      LOG(DEBUG, "DEBUG", "@ " + method.getSignature());
      Set<Integer> derefedParamList = new HashSet<Integer>();
      prunedCFG = ExceptionPrunedCFG.make(cfg);
      // In case the only control flows are exceptional, simply return.
      if (prunedCFG.getNumberOfNodes() == 2
          && prunedCFG.containsNode(cfg.entry())
          && prunedCFG.containsNode(cfg.exit())
          && GraphUtil.countEdges(prunedCFG) == 0) {
        return derefedParamList;
      }
      // Get Dominator Tree
      LOG(DEBUG, "DEBUG", "\tbuilding dominator tree...");
      Graph<ISSABasicBlock> domTree = Dominators.make(prunedCFG, prunedCFG.entry()).dominatorTree();
      // Get Post-dominator Tree
      Graph<ISSABasicBlock> pdomTree = GraphInverter.invert(domTree);
      LOG(DEBUG, "DEBUG", "post-dominator tree:" + pdomTree.toString());
      // Note: WALA creates a single dummy exit node. Multiple exits points will never post-dominate
      // this exit node. (?)
      // TODO: [v0.2] Need data-flow analysis for dereferences on all paths
      // Walk from exit node in post-dominator tree and check for use of params
      LOG(DEBUG, "DEBUG", "\tfinding dereferenced params...");
      ArrayList<ISSABasicBlock> nodeQueue = new ArrayList<ISSABasicBlock>();
      nodeQueue.add(prunedCFG.exit());
      // Get number of params and value number of first param
      int numParam = ir.getSymbolTable().getNumberOfParameters();
      int firstParamIndex =
          method.isStatic() ? 1 : 2; // 1-indexed; v1 is 'this' for non-static methods
      LOG(DEBUG, "DEBUG", "param value numbers : " + firstParamIndex + " ... " + numParam);
      while (!nodeQueue.isEmpty()) {
        ISSABasicBlock node = nodeQueue.get(0);
        nodeQueue.remove(node);
        // check for use of params
        if (!node.isEntryBlock() && !node.isExitBlock()) { // entry and exit are dummy basic blocks
          LOG(DEBUG, "DEBUG", ">> bb: " + node.getNumber());
          // Iterate over all instructions in BB
          for (int i = node.getFirstInstructionIndex(); i <= node.getLastInstructionIndex(); i++) {
            SSAInstruction instr = ir.getInstructions()[i];
            if (instr == null) continue; // Some instructions are null (padding NoOps)
            LOG(DEBUG, "DEBUG", "\tinst: " + instr.toString());
            int derefValueNumber = -1;
            if (instr instanceof SSAGetInstruction && !((SSAGetInstruction) instr).isStatic()) {
              derefValueNumber = ((SSAGetInstruction) instr).getRef();
            } else if (instr instanceof SSAPutInstruction
                && !((SSAPutInstruction) instr).isStatic()) {
              derefValueNumber = ((SSAPutInstruction) instr).getRef();
            } else if (instr instanceof SSAAbstractInvokeInstruction) {
              SSAAbstractInvokeInstruction callInst = (SSAAbstractInvokeInstruction) instr;
              String sign = callInst.getDeclaredTarget().getSignature();
              if (((SSAAbstractInvokeInstruction) instr).isStatic()) {
                // All supported Null testing APIs are static methods
                if (NULL_TEST_APIS.containsKey(sign)) {
                  derefValueNumber = callInst.getUse(NULL_TEST_APIS.get(sign));
                }
              } else {
                Preconditions.checkArgument(
                    !NULL_TEST_APIS.containsKey(sign),
                    "Add support for non-static NULL_TEST_APIS : " + sign);
                derefValueNumber = ((SSAAbstractInvokeInstruction) instr).getReceiver();
              }
            }
            if (derefValueNumber >= firstParamIndex && derefValueNumber <= numParam) {
              LOG(DEBUG, "DEBUG", "\t\tderefed param : " + derefValueNumber);
              // Translate from WALA 1-indexed params, to 0-indexed
              derefedParamList.add(derefValueNumber - 1);
            }
          }
        }
        for (ISSABasicBlock succ : Iterator2Iterable.make(pdomTree.getSuccNodes(node))) {
          nodeQueue.add(succ);
        }
      }
      LOG(DEBUG, "DEBUG", "\tdone...");
      return derefedParamList;
    }