Program: 36169
Project: 36169
Buggy source:
/** 
 * Replaces the children of the given element with the contents specified as an HTML string. <p>This will be seen as at least two events, n inserts followed by a remove.</p> <p>Consider the following structure (the <code>elem</code> parameter is <b>in bold</b>).</p> <pre> &lt;body&gt; | <b>&lt;div&gt;</b> /  \ &lt;p&gt;   &lt;p&gt; </pre> <p>Invoking <code>setInnerHTML(elem, "&lt;ul&gt;&lt;li&gt;")</code> results in the following structure (new elements are <font style="color: red;">in red</font>).</p> <pre> &lt;body&gt; | <b>&lt;div&gt;</b> \ <font style="color: red;">&lt;ul&gt;</font> \ <font style="color: red;">&lt;li&gt;</font> </pre> <p>Parameter <code>elem</code> must not be a leaf element, otherwise an <code>IllegalArgumentException</code> is thrown. If either <code>elem</code> or <code>htmlText</code> parameter is <code>null</code>, no changes are made to the document.</p> <p>For this to work correctly, the document must have an <code>HTMLEditorKit.Parser</code> set. This will be the case if the document was created from an HTMLEditorKit via the <code>createDefaultDocument</code> method.</p>
 * @param elem the branch element whose children will be replaced
 * @param htmlText the string to be parsed and assigned to <code>elem</code>
 * @throws IllegalArgumentException if <code>elem</code> is a leaf
 * @throws IllegalStateException if an <code>HTMLEditorKit.Parser</code>has not been defined
 * @since 1.3
 */
public void setInnerHTML(Element elem,String htmlText) throws BadLocationException, IOException {
  verifyParser();
  if (elem != null && elem.isLeaf()) {
    throw new IllegalArgumentException("String_Node_Str");
  }
  if (elem != null && htmlText != null) {
    int oldCount=elem.getElementCount();
    int insertPosition=elem.getStartOffset();
    insertHTML(elem,elem.getStartOffset(),htmlText,true);
    if (elem.getElementCount() > oldCount) {
      removeElements(elem,elem.getElementCount() - oldCount,oldCount);
    }
  }
}

Fixed version (ground truth):
/** 
 * Replaces the children of the given element with the contents specified as an HTML string. <p>This will be seen as at least two events, n inserts followed by a remove.</p> <p>Consider the following structure (the <code>elem</code> parameter is <b>in bold</b>).</p> <pre> &lt;body&gt; | <b>&lt;div&gt;</b> /  \ &lt;p&gt;   &lt;p&gt; </pre> <p>Invoking <code>setInnerHTML(elem, "&lt;ul&gt;&lt;li&gt;")</code> results in the following structure (new elements are <font style="color: red;">in red</font>).</p> <pre> &lt;body&gt; | <b>&lt;div&gt;</b> \ <font style="color: red;">&lt;ul&gt;</font> \ <font style="color: red;">&lt;li&gt;</font> </pre> <p>Parameter <code>elem</code> must not be a leaf element, otherwise an <code>IllegalArgumentException</code> is thrown. If either <code>elem</code> or <code>htmlText</code> parameter is <code>null</code>, no changes are made to the document.</p> <p>For this to work correctly, the document must have an <code>HTMLEditorKit.Parser</code> set. This will be the case if the document was created from an HTMLEditorKit via the <code>createDefaultDocument</code> method.</p>
 * @param elem the branch element whose children will be replaced
 * @param htmlText the string to be parsed and assigned to <code>elem</code>
 * @throws IllegalArgumentException if <code>elem</code> is a leaf
 * @throws IllegalStateException if an <code>HTMLEditorKit.Parser</code>has not been defined
 * @throws BadLocationException if replacement is impossible because ofa structural issue
 * @throws IOException if an I/O exception occurs
 * @since 1.3
 */
public void setInnerHTML(Element elem,String htmlText) throws BadLocationException, IOException {
  verifyParser();
  if (elem != null && elem.isLeaf()) {
    throw new IllegalArgumentException("String_Node_Str");
  }
  if (elem != null && htmlText != null) {
    int oldCount=elem.getElementCount();
    int insertPosition=elem.getStartOffset();
    insertHTML(elem,elem.getStartOffset(),htmlText,true);
    if (elem.getElementCount() > oldCount) {
      removeElements(elem,elem.getElementCount() - oldCount,oldCount);
    }
  }
}