Program: 6306
Project: 6306
Buggy source:
private void doIf(InstructionHandle stmt,FlowEdge edge,Context context,Map<Location,ValueMapping> in,Map<Location,ValueMapping> result){
  for (Iterator<Location> i=in.keySet().iterator(); i.hasNext(); ) {
    Location l=i.next();
    if (l.stackLoc < context.stackPtr - 1) {
      result.put(l,in.get(l));
    }
  }
  for (Iterator<Location> i=in.keySet().iterator(); i.hasNext(); ) {
    Location l=i.next();
    if (l.stackLoc == context.stackPtr - 1 && in.get(l).source != null) {
      ValueMapping m=new ValueMapping(in.get(l),true);
switch (stmt.getInstruction().getOpcode()) {
case Constants.IFEQ:
        if (edge.getType() == FlowEdge.FALSE_EDGE) {
        }
 else         if (edge.getType() == FlowEdge.TRUE_EDGE) {
          m.constrained.setLb(0);
          m.constrained.setUb(0);
        }
      break;
case Constants.IFNE:
    if (edge.getType() == FlowEdge.FALSE_EDGE) {
      m.constrained.setLb(0);
      m.constrained.setUb(0);
    }
 else     if (edge.getType() == FlowEdge.TRUE_EDGE) {
    }
  break;
case Constants.IFLT:
if (edge.getType() == FlowEdge.FALSE_EDGE) {
  m.constrained.setLb(0);
}
 else if (edge.getType() == FlowEdge.TRUE_EDGE) {
  m.constrained.setUb(-1);
}
break;
case Constants.IFGE:
if (edge.getType() == FlowEdge.FALSE_EDGE) {
m.constrained.setUb(-1);
}
 else if (edge.getType() == FlowEdge.TRUE_EDGE) {
m.constrained.setLb(0);
}
break;
case Constants.IFLE:
if (edge.getType() == FlowEdge.FALSE_EDGE) {
m.constrained.setLb(1);
}
 else if (edge.getType() == FlowEdge.TRUE_EDGE) {
m.constrained.setUb(0);
}
break;
case Constants.IFGT:
if (edge.getType() == FlowEdge.FALSE_EDGE) {
m.constrained.setUb(0);
}
 else if (edge.getType() == FlowEdge.TRUE_EDGE) {
m.constrained.setLb(1);
}
break;
}
if (m.assigned.getLb() > m.constrained.getUb() || m.assigned.getUb() < m.constrained.getLb()) {
}
m.assigned.constrain(m.constrained);
recordBound(stmt,context,edge,m);
result.put(in.get(l).source,m);
}
}
}

Fixed version (ground truth):
private void doIf(InstructionHandle stmt,FlowEdge edge,Context context,Map<Location,ValueMapping> in,Map<Location,ValueMapping> result){
  for (Iterator<Location> i=in.keySet().iterator(); i.hasNext(); ) {
    Location l=i.next();
    if (l.stackLoc < context.stackPtr - 1) {
      result.put(l,in.get(l));
    }
  }
  for (Iterator<Location> i=in.keySet().iterator(); i.hasNext(); ) {
    Location l=i.next();
    if (l.stackLoc == context.stackPtr - 1 && in.get(l).source != null) {
      ValueMapping m=new ValueMapping(in.get(l),true);
switch (stmt.getInstruction().getOpcode()) {
case Constants.IFEQ:
        if (edge.getType() == FlowEdge.FALSE_EDGE) {
        }
 else         if (edge.getType() == FlowEdge.TRUE_EDGE) {
          m.constrained.setLb(0);
          m.constrained.setUb(0);
        }
      break;
case Constants.IFNE:
    if (edge.getType() == FlowEdge.FALSE_EDGE) {
      m.constrained.setLb(0);
      m.constrained.setUb(0);
    }
 else     if (edge.getType() == FlowEdge.TRUE_EDGE) {
    }
  break;
case Constants.IFLT:
if (edge.getType() == FlowEdge.FALSE_EDGE) {
  m.constrained.setLb(0);
}
 else if (edge.getType() == FlowEdge.TRUE_EDGE) {
  m.constrained.setUb(-1);
}
break;
case Constants.IFGE:
if (edge.getType() == FlowEdge.FALSE_EDGE) {
m.constrained.setUb(-1);
}
 else if (edge.getType() == FlowEdge.TRUE_EDGE) {
m.constrained.setLb(0);
}
break;
case Constants.IFLE:
if (edge.getType() == FlowEdge.FALSE_EDGE) {
m.constrained.setLb(1);
}
 else if (edge.getType() == FlowEdge.TRUE_EDGE) {
m.constrained.setUb(0);
}
break;
case Constants.IFGT:
if (edge.getType() == FlowEdge.FALSE_EDGE) {
m.constrained.setUb(0);
}
 else if (edge.getType() == FlowEdge.TRUE_EDGE) {
m.constrained.setLb(1);
}
break;
}
if (m.assigned.getLb() > m.constrained.getUb() || m.assigned.getUb() < m.constrained.getLb()) {
}
m.assigned.constrain(m.constrained);
recordBound(stmt,context,edge,new ValueMapping(m,true));
m.softinc=true;
result.put(in.get(l).source,m);
}
}
}