reachable(r, null, H), null ∈ H ⊦
Used simplifier rules: reach-alloc: ⊦ reachable(r, r1, H) → r1 ∈ H;