Program: 149717
Project: 149717
Buggy source:
/** 
 * Copy an object to the given raw storage address
 */
@Inline public static Object moveObject(Address toAddress,Object fromObj,Object toObj,int numBytes){
  if (VM.VerifyAssertions)   VM._assert(toAddress.isZero() || toObj == null);
  int copyBytes=numBytes;
  int objRefOffset=OBJECT_REF_OFFSET;
  Word statusWord=Word.zero();
  Word hashState=HASH_STATE_UNHASHED;
  if (ADDRESS_BASED_HASHING) {
    statusWord=Magic.getWordAtOffset(fromObj,STATUS_OFFSET);
    hashState=statusWord.and(HASH_STATE_MASK);
    if (hashState.EQ(HASH_STATE_HASHED)) {
      copyBytes-=HASHCODE_BYTES;
      if (!DYNAMIC_HASH_OFFSET) {
        if (toObj == null) {
          toAddress=toAddress.plus(HASHCODE_BYTES);
        }
      }
    }
 else     if (!DYNAMIC_HASH_OFFSET && hashState.EQ(HASH_STATE_HASHED_AND_MOVED)) {
      objRefOffset+=HASHCODE_BYTES;
    }
  }
  if (toObj != null) {
    toAddress=Magic.objectAsAddress(toObj).minus(OBJECT_REF_OFFSET);
  }
  Address fromAddress=Magic.objectAsAddress(fromObj).minus(objRefOffset);
  Memory.aligned32Copy(toAddress,fromAddress,copyBytes);
  toObj=Magic.addressAsObject(toAddress.plus(objRefOffset));
  if (hashState.EQ(HASH_STATE_HASHED)) {
    int hashCode=Magic.objectAsAddress(fromObj).toWord().rshl(SizeConstants.LOG_BYTES_IN_ADDRESS).toInt();
    if (DYNAMIC_HASH_OFFSET) {
      Magic.setIntAtOffset(toObj,Offset.fromIntSignExtend(numBytes - objRefOffset - HASHCODE_BYTES),hashCode);
    }
 else {
      Magic.setIntAtOffset(toObj,HASHCODE_OFFSET,(hashCode << 1) | ALIGNMENT_MASK);
    }
    Magic.setWordAtOffset(toObj,STATUS_OFFSET,statusWord.or(HASH_STATE_HASHED_AND_MOVED));
    if (ObjectModel.HASH_STATS)     ObjectModel.hashTransition2++;
  }
  return toObj;
}

Fixed version (ground truth):
/** 
 * Copy an object to the given raw storage address
 */
@Inline public static Object moveObject(Address toAddress,Object fromObj,Object toObj,int numBytes){
  if (VM.VerifyAssertions)   VM._assert(toAddress.isZero() || toObj == null);
  int copyBytes=numBytes;
  int objRefOffset=OBJECT_REF_OFFSET;
  Word statusWord=Word.zero();
  Word hashState=HASH_STATE_UNHASHED;
  if (ADDRESS_BASED_HASHING) {
    statusWord=Magic.getWordAtOffset(fromObj,STATUS_OFFSET);
    hashState=statusWord.and(HASH_STATE_MASK);
    if (hashState.EQ(HASH_STATE_HASHED)) {
      copyBytes-=HASHCODE_BYTES;
      if (!DYNAMIC_HASH_OFFSET) {
        if (toObj == null) {
          toAddress=toAddress.plus(HASHCODE_BYTES);
        }
      }
    }
 else     if (!DYNAMIC_HASH_OFFSET && hashState.EQ(HASH_STATE_HASHED_AND_MOVED)) {
      objRefOffset+=HASHCODE_BYTES;
    }
  }
  if (toObj != null) {
    toAddress=Magic.objectAsAddress(toObj).minus(objRefOffset);
  }
  Address fromAddress=Magic.objectAsAddress(fromObj).minus(objRefOffset);
  Memory.aligned32Copy(toAddress,fromAddress,copyBytes);
  if (toObj == null) {
    toObj=Magic.addressAsObject(toAddress.plus(objRefOffset));
  }
 else {
    if (VM.VerifyAssertions)     VM._assert(toObj == Magic.addressAsObject(toAddress.plus(objRefOffset)));
  }
  if (hashState.EQ(HASH_STATE_HASHED)) {
    int hashCode=Magic.objectAsAddress(fromObj).toWord().rshl(SizeConstants.LOG_BYTES_IN_ADDRESS).toInt();
    if (DYNAMIC_HASH_OFFSET) {
      Magic.setIntAtOffset(toObj,Offset.fromIntSignExtend(numBytes - OBJECT_REF_OFFSET - HASHCODE_BYTES),hashCode);
    }
 else {
      Magic.setIntAtOffset(toObj,HASHCODE_OFFSET,(hashCode << 1) | ALIGNMENT_MASK);
    }
    Magic.setWordAtOffset(toObj,STATUS_OFFSET,statusWord.or(HASH_STATE_HASHED_AND_MOVED));
    if (ObjectModel.HASH_STATS)     ObjectModel.hashTransition2++;
  }
  return toObj;
}