Program: 28791
Project: 28791
Buggy source:
private void handleBeforeEvent(InstanceEvent event,InstanceEvent.EventType eventType){
  Context context=(Context)event.getWrapper().getParent();
  if (!(context instanceof WebModule)) {
    return;
  }
  WebModule wm=(WebModule)context;
  Object instance;
  if (eventType == InstanceEvent.EventType.BEFORE_FILTER_EVENT) {
    instance=event.getFilter();
  }
 else {
    instance=event.getServlet();
  }
  Realm ra=context.getRealm();
  if (ra != null) {
    ServletRequest request=event.getRequest();
    if (request != null && request instanceof HttpServletRequest) {
      HttpServletRequest hreq=(HttpServletRequest)request;
      HttpServletRequest base=hreq;
      Principal prin=hreq.getUserPrincipal();
      Principal basePrincipal=prin;
      boolean wrapped=false;
      while (prin != null) {
        if (base instanceof ServletRequestWrapper) {
          ServletRequest sr=((ServletRequestWrapper)base).getRequest();
          if (sr instanceof HttpServletRequest) {
            base=(HttpServletRequest)sr;
            wrapped=true;
            continue;
          }
        }
        if (wrapped) {
          basePrincipal=base.getUserPrincipal();
        }
 else         if (base instanceof RequestFacade) {
          if (base.getClass() != RequestFacade.class) {
            basePrincipal=((RequestFacade)base).getUnwrappedCoyoteRequest().getUserPrincipal();
          }
        }
 else {
          basePrincipal=base.getUserPrincipal();
        }
        break;
      }
      if (prin != null && prin == basePrincipal && prin.getClass().getName().equals(SecurityConstants.WEB_PRINCIPAL_CLASS)) {
        securityContext.setSecurityContextWithPrincipal(prin);
      }
 else       if (prin != basePrincipal) {
        checkObjectForDoAsPermission(hreq);
        securityContext.setSecurityContextWithPrincipal(prin);
      }
    }
  }
  ComponentInvocation inv=new WebComponentInvocation(wm,instance);
  try {
    im.preInvoke(inv);
    if (eventType == InstanceEvent.EventType.BEFORE_SERVICE_EVENT) {
      wm.beforeServiceEvent(event.getWrapper().getName());
      if (tm != null) {
        tm.enlistComponentResources();
      }
    }
  }
 catch (  Exception ex) {
    im.postInvoke(inv);
    String msg=_rb.getString(EXCEPTION_DURING_HANDLE_EVENT);
    msg=MessageFormat.format(msg,new Object[]{eventType,wm});
    throw new RuntimeException(msg,ex);
  }
}

Fixed version (ground truth):
private void handleBeforeEvent(InstanceEvent event,InstanceEvent.EventType eventType){
  Context context=(Context)event.getWrapper().getParent();
  if (!(context instanceof WebModule)) {
    return;
  }
  WebModule wm=(WebModule)context;
  Object instance;
  if (eventType == InstanceEvent.EventType.BEFORE_FILTER_EVENT) {
    instance=event.getFilter();
  }
 else {
    instance=event.getServlet();
  }
  Realm ra=context.getRealm();
  if (ra != null) {
    ServletRequest request=event.getRequest();
    if (request != null && request instanceof HttpServletRequest) {
      HttpServletRequest hreq=(HttpServletRequest)request;
      HttpServletRequest base=hreq;
      Principal prin=hreq.getUserPrincipal();
      Principal basePrincipal=prin;
      boolean wrapped=false;
      while (prin != null) {
        if (base instanceof ServletRequestWrapper) {
          ServletRequest sr=((ServletRequestWrapper)base).getRequest();
          if (sr instanceof HttpServletRequest) {
            base=(HttpServletRequest)sr;
            wrapped=true;
            continue;
          }
        }
        if (wrapped) {
          basePrincipal=base.getUserPrincipal();
        }
 else         if (base instanceof RequestFacade) {
          if (base.getClass() != RequestFacade.class) {
            basePrincipal=((RequestFacade)base).getUnwrappedCoyoteRequest().getUserPrincipal();
          }
        }
 else {
          basePrincipal=base.getUserPrincipal();
        }
        break;
      }
      if (prin != null && prin == basePrincipal && prin.getClass().getName().equals(SecurityConstants.WEB_PRINCIPAL_CLASS)) {
        securityContext.setSecurityContextWithPrincipal(prin);
      }
 else       if (prin != basePrincipal) {
        checkObjectForDoAsPermission(hreq);
        securityContext.setSecurityContextWithPrincipal(prin);
      }
    }
  }
  ComponentInvocation inv;
  if (eventType == InstanceEvent.EventType.BEFORE_INIT_EVENT) {
    inv=new WebComponentInvocation(wm,instance,event.getWrapper().getName());
  }
 else {
    inv=new WebComponentInvocation(wm,instance);
  }
  try {
    im.preInvoke(inv);
    if (eventType == InstanceEvent.EventType.BEFORE_SERVICE_EVENT) {
      wm.beforeServiceEvent(event.getWrapper().getName());
      if (tm != null) {
        tm.enlistComponentResources();
      }
    }
  }
 catch (  Exception ex) {
    im.postInvoke(inv);
    String msg=_rb.getString(EXCEPTION_DURING_HANDLE_EVENT);
    msg=MessageFormat.format(msg,new Object[]{eventType,wm});
    throw new RuntimeException(msg,ex);
  }
}