Program: 92450
Project: 92450
Buggy source:
private void handleData(DataBlock dataBlock,int state){
  boolean tailLock;
  DataBlock freeDataBlock=null;
  handleDataLoop:   for (; ; ) {
    ByteBuffer rw=dataBlock.rw;
    final int bytesReady=(state & LENGTH_MASK);
    int bytesRemaining=bytesReady;
    int pos=rw.position();
    for (; ; ) {
      int bb=(m_blockSize - pos);
      if (bytesRemaining <= bb) {
        int limit=pos + bytesRemaining;
        rw.limit(limit);
        m_sessionListener.onDataReceived(rw);
        rw.position(limit);
        break;
      }
      bytesRemaining-=bb;
      rw.limit(m_blockSize);
      m_sessionListener.onDataReceived(rw);
      DataBlock next=dataBlock.next;
      dataBlock.reset();
      if (freeDataBlock == null) {
        dataBlock.next=null;
        freeDataBlock=dataBlock;
      }
 else {
        dataBlock.next=freeDataBlock;
        freeDataBlock=null;
        m_dataBlockCache.put(dataBlock);
      }
      dataBlock=next;
      rw=dataBlock.rw;
      pos=0;
    }
    for (; ; ) {
      int newState=state;
      newState-=bytesReady;
      if ((newState & LENGTH_MASK) == 0) {
        if ((newState & TAIL_LOCK) == 0) {
          newState|=TAIL_LOCK;
          tailLock=true;
        }
 else         tailLock=false;
        if (m_state.compareAndSet(state,newState)) {
          if ((state & LENGTH_MASK) > m_maxSize) {
            assert((newState & LENGTH_MASK) <= m_maxSize);
            assert((newState & CLOSED) == 0);
            m_speculativeRead=true;
            m_collider.executeInThreadPool(this);
          }
          state=newState;
          if (freeDataBlock != null) {
            assert(freeDataBlock.next == null);
            m_dataBlockCache.put(freeDataBlock);
          }
          break handleDataLoop;
        }
      }
 else {
        if (m_state.compareAndSet(state,newState)) {
          if ((state & LENGTH_MASK) > m_maxSize) {
            assert((newState & LENGTH_MASK) <= m_maxSize);
            assert((newState & CLOSED) == 0);
            m_speculativeRead=true;
            m_collider.executeInThreadPool(this);
          }
          state=newState;
          break;
        }
      }
      state=m_state.get();
    }
    if (rw.limit() == rw.capacity()) {
      DataBlock next=dataBlock.next;
      dataBlock.next=null;
      dataBlock.reset();
      m_dataBlockCache.put(dataBlock);
      dataBlock=next;
    }
  }
  if (tailLock) {
    assert(dataBlock == m_tail);
    DataBlock tail=m_tail;
    m_tail=null;
    for (; ; ) {
      assert((state & TAIL_LOCK) != 0);
      int newState=(state - TAIL_LOCK);
      if (m_state.compareAndSet(state,newState)) {
        state=newState;
        break;
      }
      state=m_state.get();
    }
    assert(tail.next == null);
    m_dataBlockCache.put(tail.reset());
  }
  if ((state & CLOSED) != 0) {
    m_sessionListener.onConnectionClosed();
    printStats();
  }
}

Fixed version (ground truth):
private void handleData(DataBlock dataBlock,int state){
  boolean tailLock;
  DataBlock freeDataBlock=null;
  handleDataLoop:   for (; ; ) {
    ByteBuffer rw=dataBlock.rw;
    final int bytesReady=(state & LENGTH_MASK);
    int bytesRemaining=bytesReady;
    int pos=rw.position();
    for (; ; ) {
      int bb=(m_blockSize - pos);
      if (bytesRemaining <= bb) {
        int limit=pos + bytesRemaining;
        rw.limit(limit);
        m_sessionListener.onDataReceived(rw);
        rw.position(limit);
        break;
      }
      bytesRemaining-=bb;
      rw.limit(m_blockSize);
      m_sessionListener.onDataReceived(rw);
      DataBlock next=dataBlock.next;
      dataBlock.reset();
      if (freeDataBlock == null) {
        dataBlock.next=null;
        freeDataBlock=dataBlock;
      }
 else {
        dataBlock.next=freeDataBlock;
        freeDataBlock=null;
        m_dataBlockCache.put(dataBlock);
      }
      dataBlock=next;
      rw=dataBlock.rw;
      pos=0;
    }
    for (; ; ) {
      int newState=state;
      newState-=bytesReady;
      if ((newState & LENGTH_MASK) == 0) {
        if ((newState & TAIL_LOCK) == 0) {
          newState|=TAIL_LOCK;
          tailLock=true;
        }
 else         tailLock=false;
        if (m_state.compareAndSet(state,newState)) {
          if ((state & LENGTH_MASK) > m_maxSize) {
            assert((newState & LENGTH_MASK) <= m_maxSize);
            assert((newState & CLOSED) == 0);
            m_speculativeRead=true;
            m_collider.executeInThreadPool(this);
          }
          state=newState;
          if (freeDataBlock != null) {
            assert(freeDataBlock.next == null);
            m_dataBlockCache.put(freeDataBlock);
          }
          break handleDataLoop;
        }
      }
 else {
        if (m_state.compareAndSet(state,newState)) {
          if (((state & LENGTH_MASK) > m_maxSize) && ((newState & LENGTH_MASK) <= m_maxSize)) {
            assert((newState & CLOSED) == 0);
            m_speculativeRead=true;
            m_collider.executeInThreadPool(this);
          }
          state=newState;
          break;
        }
      }
      state=m_state.get();
    }
    if (rw.limit() == rw.capacity()) {
      DataBlock next=dataBlock.next;
      dataBlock.next=null;
      dataBlock.reset();
      m_dataBlockCache.put(dataBlock);
      dataBlock=next;
    }
  }
  if (tailLock) {
    assert(dataBlock == m_tail);
    DataBlock tail=m_tail;
    m_tail=null;
    for (; ; ) {
      assert((state & TAIL_LOCK) != 0);
      int newState=(state - TAIL_LOCK);
      if (m_state.compareAndSet(state,newState)) {
        state=newState;
        break;
      }
      state=m_state.get();
    }
    assert(tail.next == null);
    m_dataBlockCache.put(tail.reset());
  }
  if ((state & CLOSED) != 0) {
    m_sessionListener.onConnectionClosed();
    printStats();
  }
}