Program: 40604
Project: 40604
Buggy source:
/** 
 * handle flow from actuals to formals, and from returned values to variables at the caller
 * @param curPk
 * @param handler
 */
private void handleForwInterproc(final PointerKeyAndState curPkAndState,final CopyHandler handler){
  PointerKey curPk=curPkAndState.getPointerKey();
  if (curPk instanceof LocalPointerKey) {
    final LocalPointerKey localPk=(LocalPointerKey)curPk;
    if (g.isParam(localPk)) {
      final CGNode callee=localPk.getNode();
      final int paramPos=localPk.getValueNumber() - 1;
      for (      final CallSiteAndCGNode callSiteAndCGNode : g.getPotentialCallers(localPk)) {
        final CGNode caller=callSiteAndCGNode.getCGNode();
        final CallSiteReference call=callSiteAndCGNode.getCallSiteReference();
        final IR ir=getIR(caller);
        final ParamLabel paramLabel=ParamLabel.make(callSiteAndCGNode);
        doTransition(curPkAndState.getState(),paramLabel,new Function<State,Object>(){
          private void propagateToCallee(){
            if (caller.getIR() == null) {
              return;
            }
            g.addSubgraphForNode(caller);
            SSAAbstractInvokeInstruction[] callInstrs=ir.getCalls(call);
            for (int i=0; i < callInstrs.length; i++) {
              SSAAbstractInvokeInstruction callInstr=callInstrs[i];
              PointerKey actualPk=heapModel.getPointerKeyForLocal(caller,callInstr.getUse(paramPos));
              if (Assertions.verifyAssertions) {
                Assertions._assert(g.containsNode(actualPk));
                Assertions._assert(g.containsNode(localPk));
              }
              handler.handle(curPkAndState,actualPk,paramLabel);
            }
          }
          public Object apply(          State callerState){
            Set<CGNode> possibleTargets=g.getPossibleTargets(caller,call);
            if (noOnTheFlyNeeded(callSiteAndCGNode,possibleTargets)) {
              propagateToCallee();
            }
 else {
              if (callToOTFTargets.get(callSiteAndCGNode).contains(callee.getMethod())) {
                propagateToCallee();
              }
 else {
                queryCallTargets(callSiteAndCGNode,ir,callerState);
              }
            }
            return null;
          }
        }
);
      }
    }
    SSAInvokeInstruction callInstr=g.getInstrReturningTo(localPk);
    if (callInstr != null) {
      CGNode caller=localPk.getNode();
      boolean isExceptional=localPk.getValueNumber() == callInstr.getException();
      CallSiteReference callSiteRef=callInstr.getCallSite();
      CallSiteAndCGNode callSiteAndCGNode=new CallSiteAndCGNode(callSiteRef,caller);
      Set<CGNode> possibleCallees=g.getPossibleTargets(caller,callSiteRef);
      if (noOnTheFlyNeeded(callSiteAndCGNode,possibleCallees)) {
        for (        CGNode callee : possibleCallees) {
          if (callee.getIR() == null) {
            continue;
          }
          g.addSubgraphForNode(callee);
          PointerKey retVal=isExceptional ? heapModel.getPointerKeyForExceptionalReturnValue(callee) : heapModel.getPointerKeyForReturnValue(callee);
          if (Assertions.verifyAssertions) {
            Assertions._assert(g.containsNode(retVal));
          }
          handler.handle(curPkAndState,retVal,ReturnLabel.make(callSiteAndCGNode));
        }
      }
 else {
        if (callToOTFTargets.containsKey(callSiteAndCGNode)) {
          Set<IMethod> targetMethods=callToOTFTargets.get(callSiteAndCGNode);
          for (          CGNode callee : possibleCallees) {
            if (targetMethods.contains(callee.getMethod())) {
              if (callee.getIR() == null) {
                continue;
              }
              g.addSubgraphForNode(callee);
              PointerKey retVal=isExceptional ? heapModel.getPointerKeyForExceptionalReturnValue(callee) : heapModel.getPointerKeyForReturnValue(callee);
              if (Assertions.verifyAssertions) {
                Assertions._assert(g.containsNode(retVal));
              }
              handler.handle(curPkAndState,retVal,ReturnLabel.make(callSiteAndCGNode));
            }
          }
        }
 else {
          queryCallTargets(callSiteAndCGNode,getIR(caller),curPkAndState.getState());
        }
      }
    }
  }
}

Fixed version (ground truth):
/** 
 * handle flow from actuals to formals, and from returned values to variables at the caller
 * @param curPk
 * @param handler
 */
private void handleForwInterproc(final PointerKeyAndState curPkAndState,final CopyHandler handler){
  PointerKey curPk=curPkAndState.getPointerKey();
  if (curPk instanceof LocalPointerKey) {
    final LocalPointerKey localPk=(LocalPointerKey)curPk;
    if (g.isParam(localPk)) {
      final CGNode callee=localPk.getNode();
      final int paramPos=localPk.getValueNumber() - 1;
      for (      final CallSiteAndCGNode callSiteAndCGNode : g.getPotentialCallers(localPk)) {
        final CGNode caller=callSiteAndCGNode.getCGNode();
        final CallSiteReference call=callSiteAndCGNode.getCallSiteReference();
        final IR ir=getIR(caller);
        if (ir == null)         continue;
        final ParamLabel paramLabel=ParamLabel.make(callSiteAndCGNode);
        doTransition(curPkAndState.getState(),paramLabel,new Function<State,Object>(){
          private void propagateToCallee(){
            g.addSubgraphForNode(caller);
            SSAAbstractInvokeInstruction[] callInstrs=ir.getCalls(call);
            for (int i=0; i < callInstrs.length; i++) {
              SSAAbstractInvokeInstruction callInstr=callInstrs[i];
              PointerKey actualPk=heapModel.getPointerKeyForLocal(caller,callInstr.getUse(paramPos));
              if (Assertions.verifyAssertions) {
                Assertions._assert(g.containsNode(actualPk));
                Assertions._assert(g.containsNode(localPk));
              }
              handler.handle(curPkAndState,actualPk,paramLabel);
            }
          }
          public Object apply(          State callerState){
            SSAAbstractInvokeInstruction callInstr=ir.getCalls(call)[0];
            PointerKey actualPk=heapModel.getPointerKeyForLocal(caller,callInstr.getUse(paramPos));
            Set<CGNode> possibleTargets=g.getPossibleTargets(caller,call,(LocalPointerKey)actualPk);
            if (noOnTheFlyNeeded(callSiteAndCGNode,possibleTargets)) {
              propagateToCallee();
            }
 else {
              if (callToOTFTargets.get(callSiteAndCGNode).contains(callee.getMethod())) {
                propagateToCallee();
              }
 else {
                queryCallTargets(callSiteAndCGNode,ir,callerState);
              }
            }
            return null;
          }
        }
);
      }
    }
    SSAInvokeInstruction callInstr=g.getInstrReturningTo(localPk);
    if (callInstr != null) {
      CGNode caller=localPk.getNode();
      boolean isExceptional=localPk.getValueNumber() == callInstr.getException();
      CallSiteReference callSiteRef=callInstr.getCallSite();
      CallSiteAndCGNode callSiteAndCGNode=new CallSiteAndCGNode(callSiteRef,caller);
      Set<CGNode> possibleCallees=g.getPossibleTargets(caller,callSiteRef,localPk);
      if (noOnTheFlyNeeded(callSiteAndCGNode,possibleCallees)) {
        for (        CGNode callee : possibleCallees) {
          if (callee.getIR() == null) {
            continue;
          }
          g.addSubgraphForNode(callee);
          PointerKey retVal=isExceptional ? heapModel.getPointerKeyForExceptionalReturnValue(callee) : heapModel.getPointerKeyForReturnValue(callee);
          if (Assertions.verifyAssertions) {
            Assertions._assert(g.containsNode(retVal));
          }
          handler.handle(curPkAndState,retVal,ReturnLabel.make(callSiteAndCGNode));
        }
      }
 else {
        if (callToOTFTargets.containsKey(callSiteAndCGNode)) {
          Set<IMethod> targetMethods=callToOTFTargets.get(callSiteAndCGNode);
          for (          CGNode callee : possibleCallees) {
            if (targetMethods.contains(callee.getMethod())) {
              if (callee.getIR() == null) {
                continue;
              }
              g.addSubgraphForNode(callee);
              PointerKey retVal=isExceptional ? heapModel.getPointerKeyForExceptionalReturnValue(callee) : heapModel.getPointerKeyForReturnValue(callee);
              if (Assertions.verifyAssertions) {
                Assertions._assert(g.containsNode(retVal));
              }
              handler.handle(curPkAndState,retVal,ReturnLabel.make(callSiteAndCGNode));
            }
          }
        }
 else {
          queryCallTargets(callSiteAndCGNode,getIR(caller),curPkAndState.getState());
        }
      }
    }
  }
}