Program: 65935
Project: 65935
Buggy source:
/** 
 * Replace the value of the nodes matching <code>xpathString</code> with <code>value</code>. This method handles elements, indexed elements, and attributes.
 * @param xmlField Field containing XPath query string
 * @param parent Parent element
 * @param value New value for the node
 * @return <code>NodeList</code> containing the nodes that were replaced.
 */
public NodeList replaceValue(XMLField xmlField,Node parent,Object value,AbstractSession session) throws XMLMarshalException {
  NodeList nodes=unmarshalXPathEngine.selectNodes(parent,xmlField,getNamespaceResolverForField(xmlField));
  int numberOfNodes=nodes.getLength();
  XMLNodeList createdElements=new XMLNodeList();
  for (int i=0; i < numberOfNodes; i++) {
    Node node=nodes.item(i);
    if (node.getNodeType() != Node.ELEMENT_NODE) {
      if (((node.getNodeType() == Node.TEXT_NODE) || (node.getNodeType() == Node.CDATA_SECTION_NODE)) && (value == null)) {
        Node parentNode=node.getParentNode();
        Node grandParentNode=parentNode.getParentNode();
        grandParentNode.removeChild(parentNode);
      }
 else {
        node.setNodeValue((String)((XMLConversionManager)session.getDatasourcePlatform().getConversionManager()).convertObject(value,ClassConstants.STRING));
      }
    }
 else {
      Element element=(Element)node;
      Node parentNode=element.getParentNode();
      if (value == null) {
        parentNode.removeChild(element);
      }
 else {
        String elementName=element.getTagName();
        Element newElement=null;
        Object valueToWrite=getValueToWrite(value,xmlField,session);
        XPathFragment childFrag=new XPathFragment(elementName);
        childFrag.setNamespaceURI(element.getNamespaceURI());
        newElement=(Element)createElement(parentNode,childFrag,xmlField,valueToWrite,session);
        createdElements.add(newElement);
        if (newElement != element) {
          parentNode.replaceChild(newElement,element);
        }
      }
    }
  }
  if (xmlField.isTypedTextField()) {
    addTypeAttributes(createdElements,xmlField,value,resolveNamespacePrefixForURI(XMLConstants.SCHEMA_INSTANCE_URL,getNamespaceResolverForField(xmlField)));
  }
  return nodes;
}

Fixed version (ground truth):
/** 
 * Replace the value of the nodes matching <code>xpathString</code> with <code>value</code>. This method handles elements, indexed elements, and attributes.
 * @param xmlField Field containing XPath query string
 * @param parent Parent element
 * @param value New value for the node
 * @return <code>NodeList</code> containing the nodes that were replaced.
 */
public NodeList replaceValue(XMLField xmlField,Node parent,Object value,AbstractSession session) throws XMLMarshalException {
  NodeList nodes=unmarshalXPathEngine.selectNodes(parent,xmlField,getNamespaceResolverForField(xmlField));
  int numberOfNodes=nodes.getLength();
  XMLNodeList createdElements=new XMLNodeList();
  for (int i=0; i < numberOfNodes; i++) {
    Node node=nodes.item(i);
    if (node.getNodeType() != Node.ELEMENT_NODE) {
      if (((node.getNodeType() == Node.TEXT_NODE) || (node.getNodeType() == Node.CDATA_SECTION_NODE)) && (value == null)) {
        Node parentNode=node.getParentNode();
        Node grandParentNode=parentNode.getParentNode();
        grandParentNode.removeChild(parentNode);
      }
 else {
        if (value == null) {
          ((Attr)node).getOwnerElement().removeAttributeNode((Attr)node);
        }
 else {
          node.setNodeValue((String)((XMLConversionManager)session.getDatasourcePlatform().getConversionManager()).convertObject(value,ClassConstants.STRING));
        }
      }
    }
 else {
      Element element=(Element)node;
      Node parentNode=element.getParentNode();
      if (value == null) {
        parentNode.removeChild(element);
      }
 else {
        String elementName=element.getTagName();
        Element newElement=null;
        Object valueToWrite=getValueToWrite(value,xmlField,session);
        XPathFragment childFrag=new XPathFragment(elementName);
        childFrag.setNamespaceURI(element.getNamespaceURI());
        newElement=(Element)createElement(parentNode,childFrag,xmlField,valueToWrite,session);
        createdElements.add(newElement);
        if (newElement != element) {
          parentNode.replaceChild(newElement,element);
        }
      }
    }
  }
  if (xmlField.isTypedTextField()) {
    addTypeAttributes(createdElements,xmlField,value,resolveNamespacePrefixForURI(XMLConstants.SCHEMA_INSTANCE_URL,getNamespaceResolverForField(xmlField)));
  }
  return nodes;
}