Program: 150200
Project: 150200
Buggy source:
/** 
 * Expand an instanceof instruction into the LIR sequence that implements the dynamic type check.  Ref may contain a null ptr at runtime.
 * @param s an INSTANCEOF or INSTANCEOF_UNRESOLVED instruction to expand 
 * @param ir the enclosing OPT_IR
 * @return the last OPT_Instruction in the generated LIR sequence.
 */
static OPT_Instruction instanceOf(OPT_Instruction s,OPT_IR ir){
  OPT_RegisterOperand result=InstanceOf.getClearResult(s);
  VM_TypeReference LHStype=InstanceOf.getType(s).getTypeRef();
  OPT_Operand ref=InstanceOf.getClearRef(s);
  OPT_Instruction next=s.nextInstructionInCodeOrder();
  if (next.operator() == INT_IFCMP && IfCmp.getVal1(next) instanceof OPT_RegisterOperand && result.similar(IfCmp.getVal1(next))) {
    OPT_Operand val2=IfCmp.getVal2(next);
    if (VM.VerifyAssertions)     VM._assert(val2.isIntConstant());
    int ival2=((OPT_IntConstantOperand)val2).value;
    OPT_ConditionOperand cond=IfCmp.getCond(next);
    boolean branchCondition=(((ival2 == 0) && (cond.isNOT_EQUAL() || cond.isLESS_EQUAL())) || ((ival2 == 1) && (cond.isEQUAL() || cond.isGREATER_EQUAL())));
    OPT_BasicBlock branchBB=next.getBranchTarget();
    OPT_RegisterOperand oldGuard=IfCmp.getGuardResult(next);
    next.remove();
    OPT_BasicBlock fallThroughBB=fallThroughBB(s,ir);
    OPT_BasicBlock falseBranch=branchCondition ? fallThroughBB : branchBB;
    OPT_BasicBlock trueBranch=branchCondition ? branchBB : fallThroughBB;
    OPT_Instruction nullComp=IfCmp.create(REF_IFCMP,oldGuard.copyRO(),ref.copy(),new OPT_NullConstantOperand(),OPT_ConditionOperand.EQUAL(),falseBranch.makeJumpTarget(),new OPT_BranchProfileOperand());
    s.insertBefore(nullComp);
    OPT_BasicBlock myBlock=s.getBasicBlock();
    OPT_BasicBlock instanceOfBlock=myBlock.splitNodeAt(nullComp,ir);
    myBlock.insertOut(instanceOfBlock);
    myBlock.insertOut(falseBranch);
    ir.cfg.linkInCodeOrder(myBlock,instanceOfBlock);
    OPT_RegisterOperand RHStib=getTIB(s,ir,ref,oldGuard.copyRO());
    return generateBranchingTypeCheck(s,ir,ref,LHStype,RHStib,trueBranch,falseBranch,oldGuard);
  }
 else {
    OPT_RegisterOperand guard=ir.regpool.makeTempValidation();
    OPT_BasicBlock instanceOfBlock=s.getBasicBlock().segregateInstruction(s,ir);
    OPT_BasicBlock prevBB=instanceOfBlock.prevBasicBlockInCodeOrder();
    OPT_BasicBlock nextBB=instanceOfBlock.nextBasicBlockInCodeOrder();
    OPT_BasicBlock nullCaseBB=instanceOfBlock.createSubBlock(s.bcIndex,ir,.01f);
    prevBB.appendInstruction(IfCmp.create(REF_IFCMP,guard,ref.copy(),new OPT_NullConstantOperand(),OPT_ConditionOperand.EQUAL(),nullCaseBB.makeJumpTarget(),OPT_BranchProfileOperand.unlikely()));
    nullCaseBB.appendInstruction(Move.create(INT_MOVE,result.copyD2D(),I(0)));
    nullCaseBB.appendInstruction(Goto.create(GOTO,nextBB.makeJumpTarget()));
    prevBB.insertOut(nullCaseBB);
    nullCaseBB.insertOut(nextBB);
    ir.cfg.addLastInCodeOrder(nullCaseBB);
    OPT_RegisterOperand RHStib=getTIB(s,ir,ref,guard.copyD2U());
    return generateValueProducingTypeCheck(s,ir,ref,LHStype,RHStib,result);
  }
}

Fixed version (ground truth):
/** 
 * Expand an instanceof instruction into the LIR sequence that implements the dynamic type check.  Ref may contain a null ptr at runtime.
 * @param s an INSTANCEOF or INSTANCEOF_UNRESOLVED instruction to expand 
 * @param ir the enclosing OPT_IR
 * @return the last OPT_Instruction in the generated LIR sequence.
 */
static OPT_Instruction instanceOf(OPT_Instruction s,OPT_IR ir){
  OPT_RegisterOperand result=InstanceOf.getClearResult(s);
  VM_TypeReference LHStype=InstanceOf.getType(s).getTypeRef();
  OPT_Operand ref=InstanceOf.getClearRef(s);
  OPT_Instruction next=s.nextInstructionInCodeOrder();
  if (next.operator() == INT_IFCMP && IfCmp.getVal1(next) instanceof OPT_RegisterOperand && result.similar(IfCmp.getVal1(next))) {
    OPT_Operand val2=IfCmp.getVal2(next);
    if (VM.VerifyAssertions)     VM._assert(val2.isIntConstant());
    int ival2=((OPT_IntConstantOperand)val2).value;
    OPT_ConditionOperand cond=IfCmp.getCond(next);
    boolean branchCondition=(((ival2 == 0) && (cond.isNOT_EQUAL() || cond.isLESS_EQUAL())) || ((ival2 == 1) && (cond.isEQUAL() || cond.isGREATER_EQUAL())));
    OPT_BasicBlock branchBB=next.getBranchTarget();
    OPT_RegisterOperand oldGuard=IfCmp.getGuardResult(next);
    next.remove();
    OPT_BasicBlock fallThroughBB=fallThroughBB(s,ir);
    OPT_BasicBlock falseBranch=branchCondition ? fallThroughBB : branchBB;
    OPT_BasicBlock trueBranch=branchCondition ? branchBB : fallThroughBB;
    OPT_BranchProfileOperand bp=IfCmp.getClearBranchProfile(next);
    if (branchCondition)     bp=bp.flip();
    OPT_Instruction nullComp=IfCmp.create(REF_IFCMP,oldGuard.copyRO(),ref.copy(),new OPT_NullConstantOperand(),OPT_ConditionOperand.EQUAL(),falseBranch.makeJumpTarget(),OPT_BranchProfileOperand.unlikely());
    s.insertBefore(nullComp);
    OPT_BasicBlock myBlock=s.getBasicBlock();
    OPT_BasicBlock instanceOfBlock=myBlock.splitNodeAt(nullComp,ir);
    myBlock.insertOut(instanceOfBlock);
    myBlock.insertOut(falseBranch);
    ir.cfg.linkInCodeOrder(myBlock,instanceOfBlock);
    OPT_RegisterOperand RHStib=getTIB(s,ir,ref,oldGuard.copyRO());
    return generateBranchingTypeCheck(s,ir,ref,LHStype,RHStib,trueBranch,falseBranch,oldGuard,bp);
  }
 else {
    OPT_RegisterOperand guard=ir.regpool.makeTempValidation();
    OPT_BasicBlock instanceOfBlock=s.getBasicBlock().segregateInstruction(s,ir);
    OPT_BasicBlock prevBB=instanceOfBlock.prevBasicBlockInCodeOrder();
    OPT_BasicBlock nextBB=instanceOfBlock.nextBasicBlockInCodeOrder();
    OPT_BasicBlock nullCaseBB=instanceOfBlock.createSubBlock(s.bcIndex,ir,.01f);
    prevBB.appendInstruction(IfCmp.create(REF_IFCMP,guard,ref.copy(),new OPT_NullConstantOperand(),OPT_ConditionOperand.EQUAL(),nullCaseBB.makeJumpTarget(),OPT_BranchProfileOperand.unlikely()));
    nullCaseBB.appendInstruction(Move.create(INT_MOVE,result.copyD2D(),I(0)));
    nullCaseBB.appendInstruction(Goto.create(GOTO,nextBB.makeJumpTarget()));
    prevBB.insertOut(nullCaseBB);
    nullCaseBB.insertOut(nextBB);
    ir.cfg.addLastInCodeOrder(nullCaseBB);
    OPT_RegisterOperand RHStib=getTIB(s,ir,ref,guard.copyD2U());
    return generateValueProducingTypeCheck(s,ir,ref,LHStype,RHStib,result);
  }
}