Program: 27201
Project: 27201
Buggy source:
private void analyzeFunctionFwd(NTIWorkset workset){
  for (  DiGraphNode<Node,ControlFlowGraph.Branch> dn : workset.forward()) {
    Node n=dn.getValue();
    Node parent=n.getParent();
    checkState(n != null,"String_Node_Str");
    TypeEnv inEnv=getInEnv(dn);
    TypeEnv outEnv=null;
    if (parent.isScript() || (parent.isNormalBlock() && parent.getParent().isFunction())) {
      inEnv=inEnv.clearChangeLog();
    }
    println("String_Node_Str",n);
    println("String_Node_Str",inEnv);
    boolean conditional=false;
switch (n.getToken()) {
case BLOCK:
case ROOT:
case BREAK:
case CONTINUE:
case DEFAULT_CASE:
case DEBUGGER:
case EMPTY:
case FUNCTION:
case SCRIPT:
case TRY:
case WITH:
      outEnv=inEnv;
    break;
case CATCH:
  String catchVarname=n.getFirstChild().getString();
outEnv=envPutType(inEnv,catchVarname,UNKNOWN);
break;
case EXPR_RESULT:
println("String_Node_Str",n.getFirstChild().getToken());
if (n.getBooleanProp(Node.ANALYZED_DURING_GTI)) {
n.removeProp(Node.ANALYZED_DURING_GTI);
outEnv=inEnv;
}
 else {
outEnv=analyzeExprFwd(n.getFirstChild(),inEnv,UNKNOWN).env;
}
break;
case RETURN:
outEnv=analyzeReturnFwd(n,inEnv);
break;
case DO:
case IF:
case FOR:
case WHILE:
conditional=true;
analyzeConditionalStmFwd(dn,NodeUtil.getConditionExpression(n),inEnv);
break;
case FOR_IN:
outEnv=analyzeForInFwd(n,inEnv);
break;
case FOR_OF:
outEnv=analyzeForOfFwd(n,inEnv);
break;
case CASE:
{
conditional=true;
analyzeConditionalStmFwd(dn,n,inEnv);
break;
}
case VAR:
outEnv=inEnv;
if (NodeUtil.isTypedefDecl(n)) {
break;
}
for (Node nameNode : n.children()) {
outEnv=analyzeVarDeclFwd(nameNode,outEnv);
}
break;
case SWITCH:
outEnv=analyzeExprFwd(n.getFirstChild(),inEnv).env;
break;
case THROW:
{
outEnv=analyzeExprFwd(n.getFirstChild(),inEnv).env;
exitEnvs.add(outEnv);
break;
}
default :
if (NodeUtil.isStatement(n)) {
throw new RuntimeException("String_Node_Str" + n.getToken());
}
 else {
outEnv=analyzeExprFwd(n,inEnv,UNKNOWN).env;
break;
}
}
if (!conditional) {
println("String_Node_Str",outEnv);
setOutEnv(dn,outEnv);
}
}
}

Fixed version (ground truth):
private void analyzeFunctionFwd(NTIWorkset workset){
  for (  DiGraphNode<Node,ControlFlowGraph.Branch> dn : workset.forward()) {
    Node n=dn.getValue();
    Node parent=n.getParent();
    checkState(n != null,"String_Node_Str");
    TypeEnv inEnv=getInEnv(dn);
    TypeEnv outEnv=null;
    if (parent.isScript() || (parent.isNormalBlock() && parent.getParent().isFunction())) {
      inEnv=inEnv.clearChangeLog();
    }
    println("String_Node_Str",n);
    println("String_Node_Str",inEnv);
    boolean conditional=false;
switch (n.getToken()) {
case BLOCK:
case ROOT:
case BREAK:
case CONTINUE:
case DEFAULT_CASE:
case DEBUGGER:
case EMPTY:
case FUNCTION:
case SCRIPT:
case TRY:
case WITH:
      outEnv=inEnv;
    break;
case CATCH:
  Node catchVar=n.getFirstChild();
String catchVarname=catchVar.getString();
outEnv=envPutType(inEnv,catchVarname,UNKNOWN);
maybeSetTypeI(catchVar,UNKNOWN);
break;
case EXPR_RESULT:
println("String_Node_Str",n.getFirstChild().getToken());
if (n.getBooleanProp(Node.ANALYZED_DURING_GTI)) {
n.removeProp(Node.ANALYZED_DURING_GTI);
outEnv=inEnv;
}
 else {
outEnv=analyzeExprFwd(n.getFirstChild(),inEnv,UNKNOWN).env;
}
break;
case RETURN:
outEnv=analyzeReturnFwd(n,inEnv);
break;
case DO:
case IF:
case FOR:
case WHILE:
conditional=true;
analyzeConditionalStmFwd(dn,NodeUtil.getConditionExpression(n),inEnv);
break;
case FOR_IN:
outEnv=analyzeForInFwd(n,inEnv);
break;
case FOR_OF:
outEnv=analyzeForOfFwd(n,inEnv);
break;
case CASE:
{
conditional=true;
analyzeConditionalStmFwd(dn,n,inEnv);
break;
}
case VAR:
outEnv=inEnv;
if (NodeUtil.isTypedefDecl(n)) {
maybeSetTypeI(n.getFirstChild(),UNDEFINED);
break;
}
for (Node nameNode : n.children()) {
outEnv=analyzeVarDeclFwd(nameNode,outEnv);
}
break;
case SWITCH:
outEnv=analyzeExprFwd(n.getFirstChild(),inEnv).env;
break;
case THROW:
{
outEnv=analyzeExprFwd(n.getFirstChild(),inEnv).env;
exitEnvs.add(outEnv);
break;
}
default :
if (NodeUtil.isStatement(n)) {
throw new RuntimeException("String_Node_Str" + n.getToken());
}
 else {
outEnv=analyzeExprFwd(n,inEnv,UNKNOWN).env;
break;
}
}
if (!conditional) {
println("String_Node_Str",outEnv);
setOutEnv(dn,outEnv);
}
}
}