Program: 28031
Project: 28031
Buggy source:
/** 
 * Handles any construct following a "." or ".." operator.
 * @param pn the left-hand side (target) of the operator.  Never null.
 * @return a PropertyGet, XmlMemberGet, or ErrorNode
 */
private AstNode propertyAccess(int tt,AstNode pn) throws IOException {
  if (pn == null)   codeBug();
  int memberTypeFlags=0, lineno=ts.lineno, dotPos=ts.tokenBeg;
  consumeToken();
  if (tt == Token.DOTDOT) {
    mustHaveXML();
    memberTypeFlags=Node.DESCENDANTS_FLAG;
  }
  if (!compilerEnv.isXmlAvailable()) {
    int maybeName=nextToken();
    if (maybeName != Token.NAME && !(compilerEnv.isAllowKeywordAsObjectPropertyName() && TokenStream.isKeyword(ts.getString()))) {
      reportError("String_Node_Str");
    }
    Name name=createNameNode(true,Token.GETPROP);
    PropertyGet pg=new PropertyGet(pn,name,dotPos);
    pg.setLineno(lineno);
    return pg;
  }
  AstNode ref=null;
  int token=nextToken();
switch (token) {
case Token.THROW:
    saveNameTokenData(ts.tokenBeg,"String_Node_Str",ts.lineno);
  ref=propertyName(-1,"String_Node_Str",memberTypeFlags);
break;
case Token.NAME:
ref=propertyName(-1,ts.getString(),memberTypeFlags);
break;
case Token.MUL:
saveNameTokenData(ts.tokenBeg,"String_Node_Str",ts.lineno);
ref=propertyName(-1,"String_Node_Str",memberTypeFlags);
break;
case Token.XMLATTR:
ref=attributeAccess();
break;
default :
if (compilerEnv.isReservedKeywordAsIdentifier()) {
String name=Token.keywordToName(token);
if (name != null) {
saveNameTokenData(ts.tokenBeg,name,ts.lineno);
ref=propertyName(-1,name,memberTypeFlags);
break;
}
}
reportError("String_Node_Str");
return makeErrorNode();
}
boolean xml=ref instanceof XmlRef;
InfixExpression result=xml ? new XmlMemberGet() : new PropertyGet();
if (xml && tt == Token.DOT) result.setType(Token.DOT);
int pos=pn.getPosition();
result.setPosition(pos);
result.setLength(getNodeEnd(ref) - pos);
result.setOperatorPosition(dotPos - pos);
result.setLineno(pn.getLineno());
result.setLeft(pn);
result.setRight(ref);
return result;
}

Fixed version (ground truth):
/** 
 * Handles any construct following a "." or ".." operator.
 * @param pn the left-hand side (target) of the operator.  Never null.
 * @return a PropertyGet, XmlMemberGet, or ErrorNode
 */
private AstNode propertyAccess(int tt,AstNode pn) throws IOException {
  if (pn == null)   codeBug();
  int memberTypeFlags=0, lineno=ts.lineno, dotPos=ts.tokenBeg;
  consumeToken();
  if (tt == Token.DOTDOT) {
    mustHaveXML();
    memberTypeFlags=Node.DESCENDANTS_FLAG;
  }
  if (!compilerEnv.isXmlAvailable()) {
    int maybeName=nextToken();
    if (maybeName != Token.NAME && !(compilerEnv.isReservedKeywordAsIdentifier() && TokenStream.isKeyword(ts.getString()))) {
      reportError("String_Node_Str");
    }
    Name name=createNameNode(true,Token.GETPROP);
    PropertyGet pg=new PropertyGet(pn,name,dotPos);
    pg.setLineno(lineno);
    return pg;
  }
  AstNode ref=null;
  int token=nextToken();
switch (token) {
case Token.THROW:
    saveNameTokenData(ts.tokenBeg,"String_Node_Str",ts.lineno);
  ref=propertyName(-1,"String_Node_Str",memberTypeFlags);
break;
case Token.NAME:
ref=propertyName(-1,ts.getString(),memberTypeFlags);
break;
case Token.MUL:
saveNameTokenData(ts.tokenBeg,"String_Node_Str",ts.lineno);
ref=propertyName(-1,"String_Node_Str",memberTypeFlags);
break;
case Token.XMLATTR:
ref=attributeAccess();
break;
default :
if (compilerEnv.isReservedKeywordAsIdentifier()) {
String name=Token.keywordToName(token);
if (name != null) {
saveNameTokenData(ts.tokenBeg,name,ts.lineno);
ref=propertyName(-1,name,memberTypeFlags);
break;
}
}
reportError("String_Node_Str");
return makeErrorNode();
}
boolean xml=ref instanceof XmlRef;
InfixExpression result=xml ? new XmlMemberGet() : new PropertyGet();
if (xml && tt == Token.DOT) result.setType(Token.DOT);
int pos=pn.getPosition();
result.setPosition(pos);
result.setLength(getNodeEnd(ref) - pos);
result.setOperatorPosition(dotPos - pos);
result.setLineno(pn.getLineno());
result.setLeft(pn);
result.setRight(ref);
return result;
}