Program: 40285
Project: 40285
Buggy source:
@SuppressWarnings("String_Node_Str") void processJSCall(CGNode caller,JavaScriptInvoke instruction,CGNode target,InstanceKey function,InstanceKey constParams[][],PointerKey uniqueCatchKey){
  caller.addTarget(instruction.getCallSite(),target);
  if (!getBuilder().haveAlreadyVisited(target)) {
    getBuilder().markDiscovered(target);
  }
  IR sourceIR=getBuilder().getCFAContextInterpreter().getIR(caller);
  SymbolTable sourceST=sourceIR.getSymbolTable();
  IR targetIR=getBuilder().getCFAContextInterpreter().getIR(target);
  SymbolTable targetST=targetIR.getSymbolTable();
  int av=-1;
  for (int v=0; v <= targetST.getMaxValueNumber(); v++) {
    String[] vns=targetIR.getLocalNames(1,v);
    for (int n=0; vns != null && n < vns.length; n++) {
      if ("String_Node_Str".equals(vns[n])) {
        av=v;
        break;
      }
    }
  }
  int paramCount=targetST.getParameterValueNumbers().length;
  int argCount=instruction.getNumberOfParameters();
  for (int i=0; i < Math.min(paramCount,argCount); i++) {
    int fn=targetST.getConstant(i);
    PointerKey F=(i == 0) ? getBuilder().getFilteredPointerKeyForLocal(target,targetST.getParameter(i),function) : getBuilder().getPointerKeyForLocal(target,targetST.getParameter(i));
    if (constParams != null && constParams[i] != null) {
      for (int j=0; j < constParams[i].length; j++) {
        system.newConstraint(F,constParams[i][j]);
      }
      if (av != -1)       newFieldWrite(target,av,fn,constParams[i]);
    }
 else {
      PointerKey A=getBuilder().getPointerKeyForLocal(caller,instruction.getUse(i));
      system.newConstraint(F,(F instanceof FilteredPointerKey) ? getBuilder().filterOperator : assignOperator,A);
      if (av != -1)       newFieldWrite(target,av,fn,F);
    }
  }
  if (paramCount < argCount) {
    if (av != -1) {
      for (int i=paramCount; i < argCount; i++) {
        int fn=targetST.getConstant(i);
        if (constParams != null && constParams[i] != null) {
          newFieldWrite(target,av,fn,constParams[i]);
        }
 else {
          PointerKey A=getBuilder().getPointerKeyForLocal(caller,instruction.getUse(i));
          newFieldWrite(target,av,fn,A);
        }
      }
    }
  }
 else   if (argCount < paramCount) {
    int nullvn=sourceST.getNullConstant();
    DefUse sourceDU=getBuilder().getCFAContextInterpreter().getDU(caller);
    InstanceKey[] nullkeys=getInvariantContents(sourceST,sourceDU,caller,nullvn);
    for (int i=argCount; i < paramCount; i++) {
      PointerKey F=getBuilder().getPointerKeyForLocal(target,targetST.getParameter(i));
      for (int k=0; k < nullkeys.length; k++) {
        system.newConstraint(F,nullkeys[k]);
      }
    }
  }
  if (av != -1) {
    int svn=targetST.getConstant(argCount);
    int lnv=targetST.getConstant("String_Node_Str");
    newFieldWrite(target,av,lnv,svn);
  }
  if (instruction.getDef(0) != -1) {
    PointerKey RF=getBuilder().getPointerKeyForReturnValue(target);
    PointerKey RA=getBuilder().getPointerKeyForLocal(caller,instruction.getDef(0));
    system.newConstraint(RA,assignOperator,RF);
  }
  PointerKey EF=getBuilder().getPointerKeyForExceptionalReturnValue(target);
  if (SHORT_CIRCUIT_SINGLE_USES && uniqueCatchKey != null) {
    system.newConstraint(uniqueCatchKey,assignOperator,EF);
  }
 else {
    PointerKey EA=getBuilder().getPointerKeyForLocal(caller,instruction.getDef(1));
    system.newConstraint(EA,assignOperator,EF);
  }
}

Fixed version (ground truth):
@SuppressWarnings("String_Node_Str") void processJSCall(CGNode caller,JavaScriptInvoke instruction,CGNode target,InstanceKey function,InstanceKey constParams[][],PointerKey uniqueCatchKey){
  caller.addTarget(instruction.getCallSite(),target);
  if (!getBuilder().haveAlreadyVisited(target)) {
    getBuilder().markDiscovered(target);
  }
  IR sourceIR=getBuilder().getCFAContextInterpreter().getIR(caller);
  SymbolTable sourceST=sourceIR.getSymbolTable();
  IR targetIR=getBuilder().getCFAContextInterpreter().getIR(target);
  SymbolTable targetST=targetIR.getSymbolTable();
  int av=-1;
  for (int v=0; v <= targetST.getMaxValueNumber(); v++) {
    String[] vns=targetIR.getLocalNames(1,v);
    for (int n=0; vns != null && n < vns.length; n++) {
      if ("String_Node_Str".equals(vns[n])) {
        av=v;
        break;
      }
    }
  }
  int paramCount=targetST.getParameterValueNumbers().length;
  int argCount=instruction.getNumberOfParameters();
  for (int i=0; i < Math.min(paramCount,argCount); i++) {
    int fn=targetST.getConstant(i);
    PointerKey F=(i == 0) ? getBuilder().getFilteredPointerKeyForLocal(target,targetST.getParameter(i),function.getConcreteType()) : getBuilder().getPointerKeyForLocal(target,targetST.getParameter(i));
    if (constParams != null && constParams[i] != null) {
      for (int j=0; j < constParams[i].length; j++) {
        system.newConstraint(F,constParams[i][j]);
      }
      if (av != -1)       newFieldWrite(target,av,fn,constParams[i]);
    }
 else {
      PointerKey A=getBuilder().getPointerKeyForLocal(caller,instruction.getUse(i));
      system.newConstraint(F,(F instanceof FilteredPointerKey) ? getBuilder().filterOperator : assignOperator,A);
      if (av != -1)       newFieldWrite(target,av,fn,F);
    }
  }
  if (paramCount < argCount) {
    if (av != -1) {
      for (int i=paramCount; i < argCount; i++) {
        int fn=targetST.getConstant(i);
        if (constParams != null && constParams[i] != null) {
          newFieldWrite(target,av,fn,constParams[i]);
        }
 else {
          PointerKey A=getBuilder().getPointerKeyForLocal(caller,instruction.getUse(i));
          newFieldWrite(target,av,fn,A);
        }
      }
    }
  }
 else   if (argCount < paramCount) {
    int nullvn=sourceST.getNullConstant();
    DefUse sourceDU=getBuilder().getCFAContextInterpreter().getDU(caller);
    InstanceKey[] nullkeys=getInvariantContents(sourceST,sourceDU,caller,nullvn);
    for (int i=argCount; i < paramCount; i++) {
      PointerKey F=getBuilder().getPointerKeyForLocal(target,targetST.getParameter(i));
      for (int k=0; k < nullkeys.length; k++) {
        system.newConstraint(F,nullkeys[k]);
      }
    }
  }
  if (av != -1) {
    int svn=targetST.getConstant(argCount);
    int lnv=targetST.getConstant("String_Node_Str");
    newFieldWrite(target,av,lnv,svn);
  }
  if (instruction.getDef(0) != -1) {
    PointerKey RF=getBuilder().getPointerKeyForReturnValue(target);
    PointerKey RA=getBuilder().getPointerKeyForLocal(caller,instruction.getDef(0));
    system.newConstraint(RA,assignOperator,RF);
  }
  PointerKey EF=getBuilder().getPointerKeyForExceptionalReturnValue(target);
  if (SHORT_CIRCUIT_SINGLE_USES && uniqueCatchKey != null) {
    system.newConstraint(uniqueCatchKey,assignOperator,EF);
  }
 else {
    PointerKey EA=getBuilder().getPointerKeyForLocal(caller,instruction.getDef(1));
    system.newConstraint(EA,assignOperator,EF);
  }
}