It is quite sophisticated for this bug: but the path tracing needs to care about the indirect jump: in the rollback (and forward with data modification) the indirect jump can lead to a new trace (though the conditional branches are still the same).