Program: 40668
Project: 40668
Buggy source:
/** 
 * @param scope scope of analysis
 * @param cha loaded class hierarchy
 */
public ServletEntrypoints(J2EEAnalysisScope scope,IClassHierarchy cha){
  TypeReference servletType=TypeReference.findOrCreate(scope.getExtensionLoader(),servletName);
  TypeReference actionServletType=TypeReference.findOrCreate(scope.getApplicationLoader(),actionServlet);
  IClass actionServletClass=cha.lookupClass(actionServletType);
  ClassLoaderReference appLoaderRef=scope.getApplicationLoader();
  IClassLoader appLoader=cha.getLoader(appLoaderRef);
  for (Iterator<IClass> it=appLoader.iterateAllClasses(); it.hasNext(); ) {
    IClass klass=(IClass)it.next();
    if (DEBUG) {
      Trace.println(getClass() + "String_Node_Str" + klass);
    }
    if (cha.lookupClass(klass.getReference()) == null) {
      continue;
    }
    if (cha.lookupClass(actionServletType) != null) {
      if (cha.isSubclassOf(klass,actionServletClass)) {
        continue;
      }
    }
    if (cha.implementsInterface(klass,servletType)) {
      servlets.add(klass);
      final TypeReference type=klass.getReference();
      for (int i=0; i < servletMethodNames.length; i++) {
        Atom name=servletMethodNames[i];
        Descriptor desc=servletMethodDescs[i];
        MethodReference M=MethodReference.findOrCreate(type,name,desc);
        IMethod m=cha.resolveMethod(M);
        if (cha.resolveMethod(M) != null) {
          entrypoints.add(new DefaultEntrypoint(m,cha){
            /** 
 * Assume all ServletRequest and ServletResponse are HTTP flavor.
 */
            public TypeReference[] getParameterTypes(            int i){
              if (i == 0) {
                return new TypeReference[]{type};
              }
 else {
                TypeReference[] tArray=super.getParameterTypes(i);
                if (Assertions.verifyAssertions) {
                  Assertions._assert(tArray.length == 1);
                }
                TypeReference T=tArray[0];
                TypeName n=T.getName();
                TypeReference Tp=concreteParameterMap.get(n);
                if (Tp != null) {
                  T=Tp;
                }
                return new TypeReference[]{T};
              }
            }
          }
);
        }
      }
    }
  }
}

Fixed version (ground truth):
/** 
 * @param scope scope of analysis
 * @param cha loaded class hierarchy
 */
public ServletEntrypoints(J2EEAnalysisScope scope,IClassHierarchy cha){
  TypeReference servletType=TypeReference.findOrCreate(scope.getExtensionLoader(),servletName);
  TypeReference actionServletType=TypeReference.findOrCreate(scope.getApplicationLoader(),actionServlet);
  IClass actionServletClass=cha.lookupClass(actionServletType);
  ClassLoaderReference appLoaderRef=scope.getApplicationLoader();
  IClassLoader appLoader=cha.getLoader(appLoaderRef);
  IClass servlet=cha.lookupClass(servletType);
  for (Iterator<IClass> it=appLoader.iterateAllClasses(); it.hasNext(); ) {
    IClass klass=(IClass)it.next();
    if (DEBUG) {
      Trace.println(getClass() + "String_Node_Str" + klass);
    }
    if (cha.lookupClass(klass.getReference()) == null) {
      continue;
    }
    if (cha.lookupClass(actionServletType) != null) {
      if (cha.isSubclassOf(klass,actionServletClass)) {
        continue;
      }
    }
    if (cha.implementsInterface(klass,servlet)) {
      servlets.add(klass);
      final TypeReference type=klass.getReference();
      for (int i=0; i < servletMethodNames.length; i++) {
        Atom name=servletMethodNames[i];
        Descriptor desc=servletMethodDescs[i];
        MethodReference M=MethodReference.findOrCreate(type,name,desc);
        IMethod m=cha.resolveMethod(M);
        if (cha.resolveMethod(M) != null) {
          entrypoints.add(new DefaultEntrypoint(m,cha){
            /** 
 * Assume all ServletRequest and ServletResponse are HTTP flavor.
 */
            public TypeReference[] getParameterTypes(            int i){
              if (i == 0) {
                return new TypeReference[]{type};
              }
 else {
                TypeReference[] tArray=super.getParameterTypes(i);
                if (Assertions.verifyAssertions) {
                  Assertions._assert(tArray.length == 1);
                }
                TypeReference T=tArray[0];
                TypeName n=T.getName();
                TypeReference Tp=concreteParameterMap.get(n);
                if (Tp != null) {
                  T=Tp;
                }
                return new TypeReference[]{T};
              }
            }
          }
);
        }
      }
    }
  }
}