#vulnerable code 
                              private Node fuseIntoOneStatement(Node parent, Node first, Node last) {
    // Nothing to fuse if there is only one statement.
    if (first == last) {
      return first;
    }

    // Step one: Create a comma tree that contains all the statements.
    Node commaTree = first.removeFirstChild();
    Node onePastLast = last.getNext();

    Node next = null;
    for (Node cur = first.getNext(); cur != onePastLast; cur = next) {
      commaTree = fuseExpressionIntoExpression(
          commaTree, cur.removeFirstChild());
      next = cur.getNext();
      parent.removeChild(cur);
    }

    // Step two: The last EXPR_RESULT will now hold the comma tree with all
    // the fused statements.
    first.addChildToBack(commaTree);
    return first;
  } 
                            #location 21 
                            #vulnerability type NULL_DEREFERENCE
#fixed code
                              private Node fuseIntoOneStatement(Node parent, Node first, Node last) {
    // Nothing to fuse if there is only one statement.
    if (first.getNext() == last) {
      return first;
    }

    // Step one: Create a comma tree that contains all the statements.
    Node commaTree = first.removeFirstChild();

    Node next = null;
    for (Node cur = first.getNext(); cur != last; cur = next) {
      commaTree = fuseExpressionIntoExpression(
          commaTree, cur.removeFirstChild());
      next = cur.getNext();
      parent.removeChild(cur);
    }

    // Step two: The last EXPR_RESULT will now hold the comma tree with all
    // the fused statements.
    first.addChildToBack(commaTree);
    return first;
  }