Program: 99690
Project: 99690
Buggy source:
private IMethod makeFunctionObjectConstructor(IClass cls,int nargs){
  JSInstructionFactory insts=(JSInstructionFactory)cls.getClassLoader().getInstructionFactory();
  Object key=Pair.make(cls,new Integer(nargs));
  if (constructors.containsKey(key))   return constructors.get(key);
  MethodReference ref=JavaScriptMethods.makeCtorReference(cls.getReference());
  JavaScriptSummary S=new JavaScriptSummary(ref,nargs + 1);
  S.addStatement(insts.GetInstruction(S.getNumberOfStatements(),nargs + 4,1,"String_Node_Str"));
  S.getNextProgramCounter();
  S.addStatement(insts.NewInstruction(S.getNumberOfStatements(),nargs + 5,NewSiteReference.make(S.getNextProgramCounter(),JavaScriptTypes.Object)));
  S.addStatement(insts.SetPrototype(S.getNumberOfStatements(),nargs + 5,nargs + 4));
  S.getNextProgramCounter();
  CallSiteReference cs=new JSCallSiteReference(S.getNextProgramCounter());
  int[] args=new int[nargs + 1];
  args[0]=nargs + 5;
  for (int i=0; i < nargs; i++)   args[i + 1]=i + 2;
  S.addStatement(insts.Invoke(1,nargs + 7,args,nargs + 8,cs));
  int pc=S.getNextProgramCounter();
  S.addConstant(nargs + 9,null);
  S.addStatement(insts.ConditionalBranchInstruction(S.getNumberOfStatements(),Operator.EQ,JavaScriptTypes.Root,nargs + 7,nargs + 9,pc + 2));
  S.getNextProgramCounter();
  S.addStatement(insts.ReturnInstruction(S.getNumberOfStatements(),nargs + 7,false));
  S.getNextProgramCounter();
  S.addStatement(insts.ReturnInstruction(S.getNumberOfStatements(),nargs + 5,false));
  S.getNextProgramCounter();
  return record(key,new JavaScriptConstructor(ref,S,cls,cls));
}

Fixed version (ground truth):
private IMethod makeFunctionObjectConstructor(IClass cls,int nargs){
  JSInstructionFactory insts=(JSInstructionFactory)cls.getClassLoader().getInstructionFactory();
  Object key=Pair.make(cls,new Integer(nargs));
  if (constructors.containsKey(key))   return constructors.get(key);
  MethodReference ref=JavaScriptMethods.makeCtorReference(cls.getReference());
  JavaScriptSummary S=new JavaScriptSummary(ref,nargs + 1);
  S.addStatement(insts.GetInstruction(S.getNumberOfStatements(),nargs + 4,1,"String_Node_Str"));
  S.getNextProgramCounter();
  S.addStatement(insts.NewInstruction(S.getNumberOfStatements(),nargs + 5,NewSiteReference.make(S.getNextProgramCounter(),JavaScriptTypes.Object)));
  S.addStatement(insts.SetPrototype(S.getNumberOfStatements(),nargs + 5,nargs + 4));
  S.getNextProgramCounter();
  CallSiteReference cs=new JSCallSiteReference(S.getNextProgramCounter());
  int[] args=new int[nargs + 1];
  args[0]=nargs + 5;
  for (int i=0; i < nargs; i++)   args[i + 1]=i + 2;
  S.addStatement(insts.Invoke(S.getNumberOfStatements(),1,nargs + 7,args,nargs + 8,cs));
  int pc=S.getNextProgramCounter();
  S.addConstant(nargs + 9,null);
  S.addStatement(insts.ConditionalBranchInstruction(S.getNumberOfStatements(),Operator.EQ,JavaScriptTypes.Root,nargs + 7,nargs + 9,pc + 2));
  S.getNextProgramCounter();
  S.addStatement(insts.ReturnInstruction(S.getNumberOfStatements(),nargs + 7,false));
  S.getNextProgramCounter();
  S.addStatement(insts.ReturnInstruction(S.getNumberOfStatements(),nargs + 5,false));
  S.getNextProgramCounter();
  return record(key,new JavaScriptConstructor(ref,S,cls,cls));
}