Program: 150196
Project: 150196
Buggy source:
/** 
 * Expand an instanceof instruction into the LIR sequence that implements  the dynamic type check.  Ref is known to never contain a null ptr at  runtime.
 * @param s an INSTANCEOF_NOTNULL instruction to expand 
 * @param ir the enclosing OPT_IR
 * @return the last OPT_Instruction in the generated LIR sequence.
 */
static OPT_Instruction instanceOfNotNull(OPT_Instruction s,OPT_IR ir){
  OPT_RegisterOperand result=InstanceOf.getClearResult(s);
  VM_TypeReference LHStype=InstanceOf.getType(s).getTypeRef();
  OPT_Operand ref=InstanceOf.getClearRef(s);
  OPT_Operand guard=InstanceOf.getClearGuard(s);
  OPT_Instruction next=s.nextInstructionInCodeOrder();
  if (next.operator() == INT_IFCMP && IfCmp.getVal1(next) instanceof OPT_RegisterOperand && result.similar(IfCmp.getVal1(next))) {
    OPT_Operand val2=IfCmp.getVal2(next);
    if (VM.VerifyAssertions)     VM._assert(val2.isIntConstant());
    int ival2=((OPT_IntConstantOperand)val2).value;
    OPT_ConditionOperand cond=IfCmp.getCond(next);
    boolean branchCondition=(((ival2 == 0) && (cond.isNOT_EQUAL() || cond.isLESS_EQUAL())) || ((ival2 == 1) && (cond.isEQUAL() || cond.isGREATER_EQUAL())));
    OPT_BasicBlock branchBB=next.getBranchTarget();
    OPT_RegisterOperand oldGuard=IfCmp.getGuardResult(next);
    next.remove();
    OPT_BasicBlock fallThroughBB=fallThroughBB(s,ir);
    OPT_RegisterOperand RHStib=getTIB(s,ir,ref,guard);
    if (branchCondition) {
      return generateBranchingTypeCheck(s,ir,ref,LHStype,RHStib,branchBB,fallThroughBB,oldGuard);
    }
 else {
      return generateBranchingTypeCheck(s,ir,ref,LHStype,RHStib,fallThroughBB,branchBB,oldGuard);
    }
  }
 else {
    OPT_RegisterOperand RHStib=getTIB(s,ir,ref,guard);
    return generateValueProducingTypeCheck(s,ir,ref,LHStype,RHStib,result);
  }
}

Fixed version (ground truth):
/** 
 * Expand an instanceof instruction into the LIR sequence that implements  the dynamic type check.  Ref is known to never contain a null ptr at  runtime.
 * @param s an INSTANCEOF_NOTNULL instruction to expand 
 * @param ir the enclosing OPT_IR
 * @return the last OPT_Instruction in the generated LIR sequence.
 */
static OPT_Instruction instanceOfNotNull(OPT_Instruction s,OPT_IR ir){
  OPT_RegisterOperand result=InstanceOf.getClearResult(s);
  VM_TypeReference LHStype=InstanceOf.getType(s).getTypeRef();
  OPT_Operand ref=InstanceOf.getClearRef(s);
  OPT_Operand guard=InstanceOf.getClearGuard(s);
  OPT_Instruction next=s.nextInstructionInCodeOrder();
  if (next.operator() == INT_IFCMP && IfCmp.getVal1(next) instanceof OPT_RegisterOperand && result.similar(IfCmp.getVal1(next))) {
    OPT_Operand val2=IfCmp.getVal2(next);
    if (VM.VerifyAssertions)     VM._assert(val2.isIntConstant());
    int ival2=((OPT_IntConstantOperand)val2).value;
    OPT_ConditionOperand cond=IfCmp.getCond(next);
    boolean branchCondition=(((ival2 == 0) && (cond.isNOT_EQUAL() || cond.isLESS_EQUAL())) || ((ival2 == 1) && (cond.isEQUAL() || cond.isGREATER_EQUAL())));
    OPT_BasicBlock branchBB=next.getBranchTarget();
    OPT_RegisterOperand oldGuard=IfCmp.getGuardResult(next);
    next.remove();
    OPT_BasicBlock fallThroughBB=fallThroughBB(s,ir);
    OPT_RegisterOperand RHStib=getTIB(s,ir,ref,guard);
    if (branchCondition) {
      return generateBranchingTypeCheck(s,ir,ref,LHStype,RHStib,branchBB,fallThroughBB,oldGuard,IfCmp.getClearBranchProfile(next).flip());
    }
 else {
      return generateBranchingTypeCheck(s,ir,ref,LHStype,RHStib,fallThroughBB,branchBB,oldGuard,IfCmp.getClearBranchProfile(next));
    }
  }
 else {
    OPT_RegisterOperand RHStib=getTIB(s,ir,ref,guard);
    return generateValueProducingTypeCheck(s,ir,ref,LHStype,RHStib,result);
  }
}