Program: 27260
Project: 27260
Buggy source:
private EnvTypePair analyzeInstanceofFwd(Node expr,TypeEnv inEnv,JSType specializedType){
  Node obj=expr.getFirstChild();
  Node ctor=expr.getLastChild();
  EnvTypePair objPair, ctorPair;
  objPair=analyzeExprFwd(obj,inEnv);
  JSType objType=objPair.type;
  if (!objType.isTop() && !objType.isUnknown() && !objType.isTrueOrTruthy()&& !objType.hasNonScalar()&& !objType.hasTypeVariable()) {
    warnInvalidOperand(obj,Token.INSTANCEOF,"String_Node_Str",objPair.type);
  }
  ctorPair=analyzeExprFwd(ctor,objPair.env,commonTypes.topFunction());
  JSType ctorType=ctorPair.type;
  FunctionType ctorFunType=ctorType.getFunType();
  boolean mayBeConstructorFunction=ctorFunType != null && (ctorFunType.isLoose() || ctorFunType.isQmarkFunction() || ctorFunType.isSomeConstructorOrInterface());
  if (!(ctorType.isUnknown() || mayBeConstructorFunction)) {
    warnInvalidOperand(ctor,Token.INSTANCEOF,"String_Node_Str",ctorType);
  }
  if (ctorFunType == null || !ctorFunType.isUniqueConstructor() || (!specializedType.isTrueOrTruthy() && !specializedType.isFalseOrFalsy())) {
    ctorPair.type=BOOLEAN;
    return ctorPair;
  }
  JSType instanceType=ctorFunType.getInstanceTypeOfCtor();
  JSType instanceSpecType;
  if (specializedType.isTrueOrTruthy()) {
    instanceSpecType=objType.specialize(instanceType);
  }
 else   if (objType.isTop()) {
    instanceSpecType=objType;
  }
 else {
    instanceSpecType=objType.removeType(instanceType);
  }
  if (!instanceSpecType.isBottom()) {
    objPair=analyzeExprFwd(obj,inEnv,UNKNOWN,instanceSpecType);
    ctorPair=analyzeExprFwd(ctor,objPair.env,commonTypes.topFunction());
  }
  ctorPair.type=BOOLEAN;
  return ctorPair;
}

Fixed version (ground truth):
private EnvTypePair analyzeInstanceofFwd(Node expr,TypeEnv inEnv,JSType specializedType){
  Node obj=expr.getFirstChild();
  Node ctor=expr.getLastChild();
  EnvTypePair objPair;
  EnvTypePair ctorPair;
  objPair=analyzeExprFwd(obj,inEnv);
  JSType objType=objPair.type;
  if (!objType.isTop() && !objType.isUnknown() && !objType.isTrueOrTruthy()&& !objType.hasNonScalar()&& !objType.hasTypeVariable()) {
    warnInvalidOperand(obj,Token.INSTANCEOF,"String_Node_Str",objPair.type);
  }
  ctorPair=analyzeExprFwd(ctor,objPair.env,commonTypes.topFunction());
  JSType ctorType=ctorPair.type;
  FunctionType ctorFunType=ctorType.getFunType();
  boolean mayBeConstructorFunction=ctorFunType != null && (ctorFunType.isLoose() || ctorFunType.isQmarkFunction() || ctorFunType.isSomeConstructorOrInterface());
  if (!(ctorType.isUnknown() || mayBeConstructorFunction)) {
    warnInvalidOperand(ctor,Token.INSTANCEOF,"String_Node_Str",ctorType);
  }
  if (ctorFunType == null || !ctorFunType.isUniqueConstructor() || (!specializedType.isTrueOrTruthy() && !specializedType.isFalseOrFalsy())) {
    ctorPair.type=BOOLEAN;
    return ctorPair;
  }
  JSType instanceType=ctorFunType.getInstanceTypeOfCtor();
  JSType instanceSpecType;
  if (specializedType.isTrueOrTruthy()) {
    instanceSpecType=objType.specialize(instanceType);
  }
 else   if (objType.isTop()) {
    instanceSpecType=objType;
  }
 else {
    instanceSpecType=objType.removeType(instanceType);
  }
  if (!instanceSpecType.isBottom()) {
    objPair=analyzeExprFwd(obj,inEnv,UNKNOWN,instanceSpecType);
    ctorPair=analyzeExprFwd(ctor,objPair.env,commonTypes.topFunction());
  }
  ctorPair.type=BOOLEAN;
  return ctorPair;
}