Program: 9267
Project: 9267
Buggy source:
/** 
 * If InternalSession is not present, we attempt to recover its state from associated HttpSession. We have to set the session tracking cookie to HttpID which is present in the SessionID object. This will work in the fail over cases. We first get the HttpSession by invoking the GetHttpSession Servlet on the SAME server instance this code is invoked. This should trigger the Web container to perform recovery of the associated Http session <p/> We also pass the SessionID to the servlet to double check the match between the session id and Http session <p/> This is the "client side" of the remote invocation. The servlet will call retrieveSession() to complete the work
 * @param sid Session ID
 */
InternalSession recoverSession(SessionID sid){
  if (!isSessionFailoverEnabled) {
    return null;
  }
  if (getUseInternalRequestRouting()) {
    InternalSession sess=null;
    try {
      String tokenId=tokenIdFactory.toSessionTokenId(sid);
      Token token=getRepository().read(tokenId);
      if (token == null) {
        return sess;
      }
      sess=tokenAdapter.fromToken(token);
      updateSessionMaps(sess);
    }
 catch (    CoreTokenException e) {
      sessionDebug.error("String_Node_Str",e);
    }
    return sess;
  }
 else {
    if (sessionDebug.messageEnabled()) {
      sessionDebug.message("String_Node_Str" + sid);
    }
    DataInputStream in=null;
    InternalSession sess=null;
    try {
      String query="String_Node_Str" + GetHttpSession.OP + "String_Node_Str"+ GetHttpSession.RECOVER_OP;
      URL url=new URL(thisSessionServerProtocol,thisSessionServer,thisSessionServerPort,deploymentURI + "String_Node_Str" + query);
      HttpURLConnection conn=invokeRemote(url,sid,null);
      in=new DataInputStream(conn.getInputStream());
      sess=(InternalSession)sessionTable.get(sid);
      if (sess == null) {
        sess=resolveRestrictedToken(sid,false);
      }
    }
 catch (    Exception ex) {
      sessionDebug.error("String_Node_Str",ex);
    }
 finally {
      closeStream(in);
    }
    return sess;
  }
}

Fixed version (ground truth):
/** 
 * If InternalSession is not present, we attempt to recover its state from associated HttpSession. We have to set the session tracking cookie to HttpID which is present in the SessionID object. This will work in the fail over cases. We first get the HttpSession by invoking the GetHttpSession Servlet on the SAME server instance this code is invoked. This should trigger the Web container to perform recovery of the associated Http session <p/> We also pass the SessionID to the servlet to double check the match between the session id and Http session <p/> This is the "client side" of the remote invocation. The servlet will call retrieveSession() to complete the work
 * @param sid Session ID
 */
InternalSession recoverSession(SessionID sid){
  if (!isSessionFailoverEnabled) {
    return null;
  }
  if (getUseInternalRequestRouting()) {
    InternalSession sess=null;
    try {
      String tokenId=tokenIdFactory.toSessionTokenId(sid);
      Token token=getRepository().read(tokenId);
      if (token == null) {
        return sess;
      }
      sess=tokenAdapter.fromToken(token);
      sess.setDebug(sessionDebug);
      sess.setSessionService(this);
      sess.scheduleExpiry();
      updateSessionMaps(sess);
    }
 catch (    CoreTokenException e) {
      sessionDebug.error("String_Node_Str",e);
    }
    return sess;
  }
 else {
    if (sessionDebug.messageEnabled()) {
      sessionDebug.message("String_Node_Str" + sid);
    }
    DataInputStream in=null;
    InternalSession sess=null;
    try {
      String query="String_Node_Str" + GetHttpSession.OP + "String_Node_Str"+ GetHttpSession.RECOVER_OP;
      URL url=new URL(thisSessionServerProtocol,thisSessionServer,thisSessionServerPort,deploymentURI + "String_Node_Str" + query);
      HttpURLConnection conn=invokeRemote(url,sid,null);
      in=new DataInputStream(conn.getInputStream());
      sess=(InternalSession)sessionTable.get(sid);
      if (sess == null) {
        sess=resolveRestrictedToken(sid,false);
      }
    }
 catch (    Exception ex) {
      sessionDebug.error("String_Node_Str",ex);
    }
 finally {
      closeStream(in);
    }
    return sess;
  }
}