Program: 186868
Project: 186868
Buggy source:
private void doInvoke(String methodName,InstructionHandle stmt,Context context,ContextMap<CallString,SymbolicAddressMap> input,Interpreter<CallString,SymbolicAddressMap> interpreter,Map<InstructionHandle,ContextMap<CallString,SymbolicAddressMap>> state,ContextMap<CallString,SymbolicAddressMap> retval){
  DFATool p=interpreter.getProgram();
  MethodInfo method=p.getMethod(methodName);
  methodName=method.getSignature().toString();
  if (method.isNative()) {
    handleNative(method,context,input,retval);
  }
 else {
    int varPtr=context.stackPtr - MethodHelper.getArgSize(method);
    Context c=new Context(context);
    c.stackPtr=method.getCode().getMaxLocals();
    c.constPool=method.getClassInfo().getConstantPoolGen();
    if (method.isSynchronized()) {
      c.syncLevel=context.syncLevel + 1;
    }
    c.method=methodName;
    c.callString=c.callString.push(p.getMethod(context.method),stmt,callStringLength);
    SymbolicAddressMap in=input.get(context.callString);
    SymbolicAddressMap out=in.cloneInvoke(varPtr);
    HashMap<CallString,SymbolicAddressMap> initialMap=new HashMap<CallString,SymbolicAddressMap>();
    ContextMap<CallString,SymbolicAddressMap> tmpresult=new ContextMap<CallString,SymbolicAddressMap>(c,initialMap);
    tmpresult.put(c.callString,out);
    InstructionHandle entry=method.getCode().getInstructionList().getStart();
    state.put(entry,join(state.get(entry),tmpresult));
    if (DEBUG_PRINT) {
      System.out.println("String_Node_Str" + method.getSignature());
      System.out.println(String.format("String_Node_Str",context.stackPtr,varPtr,MethodHelper.getArgSize(method)));
    }
    Map<InstructionHandle,ContextMap<CallString,SymbolicAddressMap>> r=interpreter.interpret(c,entry,state,false);
    SymbolicAddressMap ctxInfo=retval.get(context.callString);
    InstructionHandle exit=method.getCode().getInstructionList().getEnd();
    if (r.get(exit) != null) {
      SymbolicAddressMap returned=r.get(exit).get(c.callString);
      if (returned != null) {
        ctxInfo.joinReturned(returned,varPtr);
      }
 else {
        System.err.println("String_Node_Str");
      }
    }
 else {
      System.err.println("String_Node_Str" + methodName + "String_Node_Str");
    }
    ctxInfo.addStackUpto(in,context.stackPtr - MethodHelper.getArgSize(method));
    if (DEBUG_PRINT) {
      System.out.println("String_Node_Str" + method.getSignature());
      System.out.println(String.format("String_Node_Str",context.stackPtr,varPtr,MethodHelper.getArgSize(method)));
    }
  }
}

Fixed version (ground truth):
private void doInvoke(String methodName,InstructionHandle stmt,Context context,ContextMap<CallString,SymbolicAddressMap> input,Interpreter<CallString,SymbolicAddressMap> interpreter,Map<InstructionHandle,ContextMap<CallString,SymbolicAddressMap>> state,ContextMap<CallString,SymbolicAddressMap> retval){
  DFATool p=interpreter.getProgram();
  MethodInfo method=p.getMethod(methodName);
  if (method.isNative()) {
    handleNative(method,context,input,retval);
  }
 else {
    int varPtr=context.stackPtr - MethodHelper.getArgSize(method);
    Context c=new Context(context);
    c.stackPtr=method.getCode().getMaxLocals();
    c.constPool=method.getClassInfo().getConstantPoolGen();
    if (method.isSynchronized()) {
      c.syncLevel=context.syncLevel + 1;
    }
    c.method=method.getMethodRef();
    c.callString=c.callString.push(method,stmt,callStringLength);
    SymbolicAddressMap in=input.get(context.callString);
    SymbolicAddressMap out=in.cloneInvoke(varPtr);
    HashMap<CallString,SymbolicAddressMap> initialMap=new HashMap<CallString,SymbolicAddressMap>();
    ContextMap<CallString,SymbolicAddressMap> tmpresult=new ContextMap<CallString,SymbolicAddressMap>(c,initialMap);
    tmpresult.put(c.callString,out);
    InstructionHandle entry=method.getCode().getInstructionList().getStart();
    state.put(entry,join(state.get(entry),tmpresult));
    if (DEBUG_PRINT) {
      System.out.println("String_Node_Str" + method.getSignature());
      System.out.println(String.format("String_Node_Str",context.stackPtr,varPtr,MethodHelper.getArgSize(method)));
    }
    Map<InstructionHandle,ContextMap<CallString,SymbolicAddressMap>> r=interpreter.interpret(c,entry,state,false);
    SymbolicAddressMap ctxInfo=retval.get(context.callString);
    InstructionHandle exit=method.getCode().getInstructionList().getEnd();
    if (r.get(exit) != null) {
      SymbolicAddressMap returned=r.get(exit).get(c.callString);
      if (returned != null) {
        ctxInfo.joinReturned(returned,varPtr);
      }
 else {
        System.err.println("String_Node_Str");
      }
    }
 else {
      System.err.println("String_Node_Str" + methodName + "String_Node_Str");
    }
    ctxInfo.addStackUpto(in,context.stackPtr - MethodHelper.getArgSize(method));
    if (DEBUG_PRINT) {
      System.out.println("String_Node_Str" + method.getSignature());
      System.out.println(String.format("String_Node_Str",context.stackPtr,varPtr,MethodHelper.getArgSize(method)));
    }
  }
}