The treatment of packages ignores class loader issues. Worse, a malicious party can define classes to be in a sensitive package in order to attack it. The notion of package is based on names alone. Similarly, unless both accessor and accessed class must be defined by the same loader, access control rule 13 in section 5.1, and rules 16 and 18 in section 5.2 are invalid. Another change in the access control rules is necessitated by changes made to the JLS since it was first published.
Resolution now involves a lookup.
It performs no search up the class hierarchy. This would have to be updated to accurately reflect the JVM semantics. This is not true, as classes are loaded only to check subtyping or to merge reference types during the dataflow analysis. Modeling this accurately is difficult however, because it is dependent on the dataflow of each method. An easily corrected problem is that the authors ignore the types of fields in their definitions.