Program: 68887
Project: 68887
Buggy source:
/** 
 * Handle HTTP GET method.
 * @param request incoming http request
 * @param response http response
 * @exception ServletException
 * @exception IOException
 * @return
 */
public void doGet(HttpServletRequest request,HttpServletResponse response) throws ServletException, IOException {
  if (!__authenticate(request,response)) {
    return;
  }
  try {
    String requestType=request.getHeader(ParameterAccessor.HEADER_REQUEST_TYPE);
    boolean isSoapRequest=ParameterAccessor.HEADER_REQUEST_TYPE_SOAP.equalsIgnoreCase(requestType);
    IViewingSession session=ViewingSessionUtil.getSession(request);
    if (session == null && !isSoapRequest && !ParameterAccessor.isGetImageOperator(request)) {
      if (ViewingSessionUtil.getSessionId(request) == null) {
        session=ViewingSessionUtil.createSession(request);
      }
 else {
        throw new ViewerException(BirtResources.getMessage(ResourceConstants.GENERAL_ERROR_NO_VIEWING_SESSION));
      }
    }
    IContext context=__getContext(request,response);
    if (context.getBean().getException() != null) {
      __handleNonSoapException(request,response,context.getBean().getException());
    }
 else {
      session.lock();
      try {
        if (isSoapRequest) {
          Thread.currentThread().setContextClassLoader(this.getClass().getClassLoader());
          super.doPost(request,response);
        }
 else {
          __doGet(context);
        }
      }
  finally {
        session.unlock();
        if (!session.isLocked() && !context.getBean().isShowParameterPage() && (ParameterAccessor.isServlet(request,IBirtConstants.SERVLET_PATH_DOCUMENT))) {
          session.invalidate();
        }
      }
    }
  }
 catch (  BirtException e) {
    __handleNonSoapException(request,response,e);
  }
}

Fixed version (ground truth):
/** 
 * Handle HTTP GET method.
 * @param request incoming http request
 * @param response http response
 * @exception ServletException
 * @exception IOException
 * @return
 */
public void doGet(HttpServletRequest request,HttpServletResponse response) throws ServletException, IOException {
  if (!__authenticate(request,response)) {
    return;
  }
  try {
    String requestType=request.getHeader(ParameterAccessor.HEADER_REQUEST_TYPE);
    boolean isSoapRequest=ParameterAccessor.HEADER_REQUEST_TYPE_SOAP.equalsIgnoreCase(requestType);
    IViewingSession session=ViewingSessionUtil.getSession(request);
    if (session == null && !isSoapRequest && !ParameterAccessor.isGetImageOperator(request)) {
      if (ViewingSessionUtil.getSessionId(request) == null) {
        session=ViewingSessionUtil.createSession(request);
      }
 else {
        throw new ViewerException(BirtResources.getMessage(ResourceConstants.GENERAL_ERROR_NO_VIEWING_SESSION));
      }
    }
    IContext context=__getContext(request,response);
    if (context.getBean().getException() != null) {
      __handleNonSoapException(request,response,context.getBean().getException());
    }
 else     if (session != null) {
      session.lock();
      try {
        if (isSoapRequest) {
          Thread.currentThread().setContextClassLoader(this.getClass().getClassLoader());
          super.doPost(request,response);
        }
 else {
          __doGet(context);
        }
      }
  finally {
        session.unlock();
        if (!session.isLocked() && !context.getBean().isShowParameterPage() && (ParameterAccessor.isServlet(request,IBirtConstants.SERVLET_PATH_DOCUMENT))) {
          session.invalidate();
        }
      }
    }
  }
 catch (  BirtException e) {
    __handleNonSoapException(request,response,e);
  }
}