Program: 80371
Project: 80371
Buggy source:
/** 
 * 执行一个特殊的Chain(事实上普通Chain也能执行,但不建议使用)
 * @see org.nutz.dao.Chain#addSpecial(String,Object)
 */
@SuppressWarnings({"String_Node_Str"}) public static int updateBySpecialChain(Dao dao,Entity en,String tableName,Chain chain,Condition cnd){
  if (en != null)   tableName=en.getTableName();
  if (tableName == null)   throw Lang.makeThrow(DaoException.class,"String_Node_Str");
  final StringBuilder sql=new StringBuilder("String_Node_Str").append(tableName).append("String_Node_Str");
  Chain head=chain.head();
  final List<Object> values=new ArrayList<Object>();
  final List<ValueAdaptor> adaptors=new ArrayList<ValueAdaptor>();
  while (head != null) {
    MappingField mf=null;
    if (en != null)     mf=en.getField(head.name());
    String colName=head.name();
    if (mf != null)     colName=mf.getColumnName();
    sql.append(colName).append("String_Node_Str");
    if (head.special()) {
      if ("String_Node_Str".equals(head.value()) || "String_Node_Str".equals(head.value())) {
        sql.append(colName);
      }
      sql.append(head.value());
    }
 else {
      sql.append("String_Node_Str");
      values.add(head.value());
      ValueAdaptor adaptor=Jdbcs.getAdaptorBy(head.value());
      if (mf != null && mf.getAdaptor() != null)       adaptor=mf.getAdaptor();
      adaptors.add(adaptor);
    }
    sql.append("String_Node_Str");
    head=head.next();
    if (head != null)     sql.append("String_Node_Str");
  }
  if (cnd != null)   sql.append("String_Node_Str").append(cnd.toSql(en));
  if (log.isDebugEnabled())   log.debug(sql);
  final int[] ints=new int[1];
  dao.run(new ConnCallback(){
    public void invoke(    Connection conn) throws Exception {
      PreparedStatement ps=conn.prepareStatement(sql.toString());
      try {
        for (int i=0; i < values.size(); i++)         adaptors.get(i).set(ps,values.get(i),i + 1);
        ints[0]=ps.executeUpdate();
      }
  finally {
        Daos.safeClose(ps);
      }
    }
  }
);
  return ints[0];
}

Fixed version (ground truth):
/** 
 * 执行一个特殊的Chain(事实上普通Chain也能执行,但不建议使用)
 * @see org.nutz.dao.Chain#addSpecial(String,Object)
 */
@SuppressWarnings({"String_Node_Str"}) public static int updateBySpecialChain(Dao dao,Entity en,String tableName,Chain chain,Condition cnd){
  if (en != null)   tableName=en.getTableName();
  if (tableName == null)   throw Lang.makeThrow(DaoException.class,"String_Node_Str");
  final StringBuilder sql=new StringBuilder("String_Node_Str").append(tableName).append("String_Node_Str");
  Chain head=chain.head();
  final List<Object> values=new ArrayList<Object>();
  final List<ValueAdaptor> adaptors=new ArrayList<ValueAdaptor>();
  while (head != null) {
    MappingField mf=null;
    if (en != null)     mf=en.getField(head.name());
    String colName=head.name();
    if (mf != null)     colName=mf.getColumnName();
    sql.append(colName).append("String_Node_Str");
    if (head.special()) {
      if (head.value() != null && head.value() instanceof String) {
        String str=(String)head.value();
        if (str.length() > 0) {
switch (str.charAt(0)) {
case '+':
case '-':
case '*':
case '/':
case '%':
case '&':
case '^':
case '|':
            sql.append(colName);
          break;
      }
    }
  }
  sql.append(head.value());
}
 else {
  sql.append("String_Node_Str");
  values.add(head.value());
  ValueAdaptor adaptor=Jdbcs.getAdaptorBy(head.value());
  if (mf != null && mf.getAdaptor() != null)   adaptor=mf.getAdaptor();
  adaptors.add(adaptor);
}
sql.append("String_Node_Str");
head=head.next();
if (head != null) sql.append("String_Node_Str");
}
if (cnd != null) sql.append("String_Node_Str").append(cnd.toSql(en));
if (log.isDebugEnabled()) log.debug(sql);
final int[] ints=new int[1];
dao.run(new ConnCallback(){
public void invoke(Connection conn) throws Exception {
  PreparedStatement ps=conn.prepareStatement(sql.toString());
  try {
    for (int i=0; i < values.size(); i++)     adaptors.get(i).set(ps,values.get(i),i + 1);
    ints[0]=ps.executeUpdate();
  }
  finally {
    Daos.safeClose(ps);
  }
}
}
);
return ints[0];
}