Program: 6235
Project: 6235
Buggy source:
private void doInvoke(String methodName,InstructionHandle stmt,Context context,ContextMap<CallString,SymbolicAddressMap> input,Interpreter<CallString,SymbolicAddressMap> interpreter,Map<InstructionHandle,ContextMap<CallString,SymbolicAddressMap>> state,ContextMap<CallString,SymbolicAddressMap> retval){
  DFAAppInfo p=interpreter.getProgram();
  MethodInfo mi=p.getMethod(methodName);
  MethodGen method=mi.getMethodGen();
  methodName=method.getClassName() + "String_Node_Str" + method.getName()+ method.getSignature();
  if (method.isNative()) {
    handleNative(method,context,input,retval);
  }
 else {
    int varPtr=context.stackPtr - MethodHelper.getArgSize(method);
    Context c=new Context(context);
    c.stackPtr=method.getMaxLocals();
    c.constPool=method.getConstantPool();
    if (method.isSynchronized()) {
      c.syncLevel=context.syncLevel + 1;
    }
    c.method=methodName;
    c.callString=c.callString.push(p.getMethod(context.method),stmt.getPosition(),CALLSTRING_LENGTH);
    SymbolicAddressMap in=input.get(context.callString);
    SymbolicAddressMap out=in.cloneInvoke(varPtr);
    HashMap<CallString,SymbolicAddressMap> initialMap=new HashMap<CallString,SymbolicAddressMap>();
    ContextMap<CallString,SymbolicAddressMap> tmpresult=new ContextMap<CallString,SymbolicAddressMap>(c,initialMap);
    tmpresult.put(c.callString,out);
    InstructionHandle entry=mi.getMethodGen().getInstructionList().getStart();
    state.put(entry,join(state.get(entry),tmpresult));
    Map<InstructionHandle,ContextMap<CallString,SymbolicAddressMap>> r=interpreter.interpret(c,entry,state,false);
    SymbolicAddressMap ctxInfo=retval.get(context.callString);
    InstructionHandle exit=mi.getMethodGen().getInstructionList().getEnd();
    if (r.get(exit) != null) {
      SymbolicAddressMap returned=r.get(exit).get(c.callString);
      if (returned != null) {
        ctxInfo.joinReturned(returned,varPtr);
      }
    }
    ctxInfo.addStackUpto(in,context.stackPtr - MethodHelper.getArgSize(method));
  }
}

Fixed version (ground truth):
private void doInvoke(String methodName,InstructionHandle stmt,Context context,ContextMap<CallString,SymbolicAddressMap> input,Interpreter<CallString,SymbolicAddressMap> interpreter,Map<InstructionHandle,ContextMap<CallString,SymbolicAddressMap>> state,ContextMap<CallString,SymbolicAddressMap> retval){
  DFAAppInfo p=interpreter.getProgram();
  MethodInfo mi=p.getMethod(methodName);
  MethodGen method=mi.getMethodGen();
  methodName=method.getClassName() + "String_Node_Str" + method.getName()+ method.getSignature();
  if (method.isNative()) {
    handleNative(method,context,input,retval);
  }
 else {
    int varPtr=context.stackPtr - MethodHelper.getArgSize(method);
    Context c=new Context(context);
    c.stackPtr=method.getMaxLocals();
    c.constPool=method.getConstantPool();
    if (method.isSynchronized()) {
      c.syncLevel=context.syncLevel + 1;
    }
    c.method=methodName;
    c.callString=c.callString.push(p.getMethod(context.method),stmt.getPosition(),CALLSTRING_LENGTH);
    SymbolicAddressMap in=input.get(context.callString);
    SymbolicAddressMap out=in.cloneInvoke(varPtr);
    HashMap<CallString,SymbolicAddressMap> initialMap=new HashMap<CallString,SymbolicAddressMap>();
    ContextMap<CallString,SymbolicAddressMap> tmpresult=new ContextMap<CallString,SymbolicAddressMap>(c,initialMap);
    tmpresult.put(c.callString,out);
    InstructionHandle entry=mi.getMethodGen().getInstructionList().getStart();
    state.put(entry,join(state.get(entry),tmpresult));
    Map<InstructionHandle,ContextMap<CallString,SymbolicAddressMap>> r=interpreter.interpret(c,entry,state,false);
    SymbolicAddressMap ctxInfo=retval.get(context.callString);
    InstructionHandle exit=mi.getMethodGen().getInstructionList().getEnd();
    if (r.get(exit) != null) {
      SymbolicAddressMap returned=r.get(exit).get(c.callString);
      if (returned != null) {
        ctxInfo.joinReturned(returned,varPtr);
      }
 else {
        System.err.println("String_Node_Str");
      }
    }
 else {
      System.err.println("String_Node_Str");
    }
    ctxInfo.addStackUpto(in,context.stackPtr - MethodHelper.getArgSize(method));
  }
}