Program: 28162
Project: 28162
Buggy source:
/** 
 * Write a serialized version of this session object to the specified object output stream. <p> <b>IMPLEMENTATION NOTE</b>:  The owning Manager will not be stored in the serialized representation of this Session.  After calling <code>readObject()</code>, you must set the associated Manager explicitly. <p> <b>IMPLEMENTATION NOTE</b>:  Any attribute that is not Serializable will be unbound from the session, with appropriate actions if it implements HttpSessionBindingListener.  If you do not want any such attributes, be sure the <code>distributable</code> property of the associated Manager is set to <code>true</code>.
 * @param stream The output stream to write to
 * @exception IOException if an input/output error occurs
 */
private void writeObject(ObjectOutputStream stream) throws IOException {
  stream.writeObject(SERIALIZED_FORM_VERSION);
  stream.writeObject(Long.valueOf(creationTime));
  stream.writeObject(Long.valueOf(lastAccessedTime));
  stream.writeObject(Integer.valueOf(maxInactiveInterval));
  stream.writeObject(Boolean.valueOf(isNew));
  stream.writeObject(Boolean.valueOf(isValid));
  stream.writeObject(Long.valueOf(thisAccessedTime));
  boolean serialPrincipal=false;
  if (principal instanceof java.io.Serializable) {
    serialPrincipal=true;
    stream.writeObject(principal);
  }
  stream.writeObject(id);
  if (debug >= 2)   log("String_Node_Str" + id);
  if (serialPrincipal && authType != null) {
    stream.writeObject(authType);
  }
  String keys[]=keys();
  ArrayList<String> saveNames=new ArrayList<String>();
  ArrayList<Object> saveValues=new ArrayList<Object>();
  for (int i=0; i < keys.length; i++) {
    Object value=attributes.get(keys[i]);
    if (value == null) {
      continue;
    }
 else     if (isSerializable(value)) {
      saveNames.add(keys[i]);
      saveValues.add(value);
    }
 else {
      removeAttribute(keys[i],true,true);
    }
  }
  int n=saveNames.size();
  stream.writeObject(Integer.valueOf(n));
  for (int i=0; i < n; i++) {
    stream.writeObject(saveNames.get(i));
    Object val=saveValues.get(i);
    Boolean serSuccess=checkedSerializableObjects.getIfPresent(val);
    try {
      if (serSuccess == null) {
        ManagerBase mgr=(ManagerBase)getManager();
        ByteArrayOutputStream baos=new ByteArrayOutputStream();
        try (ObjectOutputStream oos=mgr.createObjectOutputStream(baos)){
          checkedSerializableObjects.put(val,false);
          oos.writeObject(val);
          oos.flush();
          stream.writeObject(SEPARATE_BUFFER_SERIALIZATION);
          stream.writeObject(baos.toByteArray());
        }
         checkedSerializableObjects.put(val,true);
      }
 else       if (serSuccess == true) {
        stream.writeObject(val);
      }
 else {
        stream.writeObject(NOT_SERIALIZED);
      }
      if (debug >= 2)       log("String_Node_Str" + saveNames.get(i) + "String_Node_Str"+ saveValues.get(i)+ "String_Node_Str");
    }
 catch (    IOException e) {
      if ((e instanceof NotSerializableException) || (e.getCause() instanceof NotSerializableException) && (serSuccess != true)) {
        String msg=MessageFormat.format(rb.getString(CANNOT_SERIALIZE_SESSION_EXCEPTION),new Object[]{saveNames.get(i),id});
        log(msg,Level.WARNING);
        stream.writeObject(NOT_SERIALIZED);
        if (debug >= 2)         log("String_Node_Str" + saveNames.get(i) + "String_Node_Str");
      }
 else {
        throw e;
      }
    }
  }
  stream.writeObject(sipAppSessionId);
  stream.writeObject(beKey);
}

Fixed version (ground truth):
/** 
 * Write a serialized version of this session object to the specified object output stream. <p> <b>IMPLEMENTATION NOTE</b>:  The owning Manager will not be stored in the serialized representation of this Session.  After calling <code>readObject()</code>, you must set the associated Manager explicitly. <p> <b>IMPLEMENTATION NOTE</b>:  Any attribute that is not Serializable will be unbound from the session, with appropriate actions if it implements HttpSessionBindingListener.  If you do not want any such attributes, be sure the <code>distributable</code> property of the associated Manager is set to <code>true</code>.
 * @param stream The output stream to write to
 * @exception IOException if an input/output error occurs
 */
private void writeObject(ObjectOutputStream stream) throws IOException {
  stream.writeObject(SERIALIZED_FORM_VERSION);
  stream.writeObject(Long.valueOf(creationTime));
  stream.writeObject(Long.valueOf(lastAccessedTime));
  stream.writeObject(Integer.valueOf(maxInactiveInterval));
  stream.writeObject(Boolean.valueOf(isNew));
  stream.writeObject(Boolean.valueOf(isValid));
  stream.writeObject(Long.valueOf(thisAccessedTime));
  boolean serialPrincipal=false;
  if (principal instanceof java.io.Serializable) {
    serialPrincipal=true;
    stream.writeObject(principal);
  }
  stream.writeObject(id);
  if (debug >= 2)   log("String_Node_Str" + id);
  if (serialPrincipal && authType != null) {
    stream.writeObject(authType);
  }
  String keys[]=keys();
  ArrayList<String> saveNames=new ArrayList<String>();
  ArrayList<Object> saveValues=new ArrayList<Object>();
  for (int i=0; i < keys.length; i++) {
    Object value=attributes.get(keys[i]);
    if (value == null) {
      continue;
    }
 else     if (isSerializable(value)) {
      saveNames.add(keys[i]);
      saveValues.add(value);
    }
 else {
      removeAttribute(keys[i],true,true);
    }
  }
  int n=saveNames.size();
  stream.writeObject(Integer.valueOf(n));
  for (int i=0; i < n; i++) {
    stream.writeObject(saveNames.get(i));
    Object val=saveValues.get(i);
    Boolean serSuccess=checkedSerializableObjects.getIfPresent(val);
    try {
      if (serSuccess == null) {
        ManagerBase mgr=(ManagerBase)getManager();
        ByteArrayOutputStream baos=new ByteArrayOutputStream();
        try (ObjectOutputStream oos=mgr.createObjectOutputStream(baos)){
          checkedSerializableObjects.put(val,false);
          oos.writeObject(val);
          oos.flush();
          stream.writeObject(SEPARATE_BUFFER_SERIALIZATION);
          stream.writeObject(baos.toByteArray());
        }
         checkedSerializableObjects.put(val,true);
      }
 else       if (serSuccess == true) {
        stream.writeObject(val);
      }
 else {
        stream.writeObject(NOT_SERIALIZED);
      }
      if (debug >= 2)       log("String_Node_Str" + saveNames.get(i) + "String_Node_Str"+ saveValues.get(i)+ "String_Node_Str");
    }
 catch (    IOException e) {
      if ((e instanceof NotSerializableException || e.getCause() instanceof NotSerializableException) && serSuccess != true) {
        String msg=MessageFormat.format(rb.getString(CANNOT_SERIALIZE_SESSION_EXCEPTION),new Object[]{saveNames.get(i),id});
        log(msg,Level.WARNING);
        stream.writeObject(NOT_SERIALIZED);
        if (debug >= 2)         log("String_Node_Str" + saveNames.get(i) + "String_Node_Str");
      }
 else {
        throw e;
      }
    }
  }
  stream.writeObject(sipAppSessionId);
  stream.writeObject(beKey);
}