Program: 99952
Project: 99952
Buggy source:
private int findReturnToVar(int v,int addr,boolean[] visited) throws InvalidBytecodeException {
  while (true) {
    if (visited[addr]) {
      return 0;
    }
 else     if (retInfo[addr] != null && retInfo[addr].retVar == v) {
      return addr;
    }
 else {
      int offset=decodedOffset[addr];
      if (offset == UNSEEN) {
        return 0;
      }
      int size=decodedSize[addr];
      Instruction instr=null;
      visited[addr]=true;
      for (int j=0; j < rawHandlers.length; j+=4) {
        if (rawHandlers[j] <= addr && addr < rawHandlers[j + 1]) {
          int handlerAddr=rawHandlers[j + 2];
          if (decodedOffset[handlerAddr] < 0) {
            byte[] stackWords=new byte[code.length * 2];
            decodeAt(handlerAddr,1,stackWords);
          }
          int r=findReturnToVar(v,handlerAddr,visited);
          if (r != 0) {
            return r;
          }
        }
      }
      if (JSRs[addr] != 0) {
        if (!doesSubroutineReturn(JSRs[addr])) {
          return 0;
        }
      }
 else {
        for (int j=0; j < size; j++) {
          instr=decoded.get(offset + j);
          if (instr instanceof StoreInstruction && ((StoreInstruction)instr).getVarIndex() == v) {
            return 0;
          }
          int[] targets=instr.getBranchTargets();
          for (int k=0; k < targets.length; k++) {
            if (targets[k] >= 0) {
              int r=findReturnToVar(v,targets[k],visited);
              if (r != 0) {
                return r;
              }
            }
          }
        }
        if (instr != null && !instr.isFallThrough()) {
          return 0;
        }
      }
      do {
        addr++;
      }
 while (decodedOffset[addr] == INSIDE_INSTRUCTION);
    }
  }
}

Fixed version (ground truth):
private int findReturnToVar(int v,int addr,boolean[] visited) throws InvalidBytecodeException {
  while (true) {
    if (visited[addr]) {
      return 0;
    }
 else     if (retInfo[addr] != null && retInfo[addr].retVar == v) {
      return addr;
    }
 else {
      int offset=decodedOffset[addr];
      if (offset == UNSEEN) {
        return 0;
      }
      int size=decodedSize[addr];
      Instruction instr=null;
      visited[addr]=true;
      for (int j=0; j < rawHandlers.length; j+=4) {
        if (rawHandlers[j] <= addr && addr < rawHandlers[j + 1]) {
          int handlerAddr=rawHandlers[j + 2];
          if (decodedOffset[handlerAddr] < 0) {
            byte[] stackWords=new byte[code.length * 2];
            stackWords[0]=1;
            decodeAt(handlerAddr,1,stackWords);
          }
          int r=findReturnToVar(v,handlerAddr,visited);
          if (r != 0) {
            return r;
          }
        }
      }
      if (JSRs[addr] != 0) {
        if (!doesSubroutineReturn(JSRs[addr])) {
          return 0;
        }
      }
 else {
        for (int j=0; j < size; j++) {
          instr=decoded.get(offset + j);
          if (instr instanceof StoreInstruction && ((StoreInstruction)instr).getVarIndex() == v) {
            return 0;
          }
          int[] targets=instr.getBranchTargets();
          for (int k=0; k < targets.length; k++) {
            if (targets[k] >= 0) {
              int r=findReturnToVar(v,targets[k],visited);
              if (r != 0) {
                return r;
              }
            }
          }
        }
        if (instr != null && !instr.isFallThrough()) {
          return 0;
        }
      }
      do {
        addr++;
      }
 while (decodedOffset[addr] == INSIDE_INSTRUCTION);
    }
  }
}