Program: 183256
Project: 183256
Buggy source:
private final void bringDownServiceLocked(ServiceRecord r,boolean force){
  if (!force && r.startRequested) {
    return;
  }
  if (r.connections.size() > 0) {
    if (!force) {
      Iterator<ConnectionRecord> it=r.connections.values().iterator();
      while (it.hasNext()) {
        ConnectionRecord cr=it.next();
        if ((cr.flags & Context.BIND_AUTO_CREATE) != 0) {
          return;
        }
      }
    }
    Iterator<ConnectionRecord> it=r.connections.values().iterator();
    while (it.hasNext()) {
      ConnectionRecord c=it.next();
      try {
        c.conn.connected(r.name,null);
      }
 catch (      Exception e) {
        Log.w(TAG,"String_Node_Str" + r.name + "String_Node_Str"+ c.conn.asBinder()+ "String_Node_Str"+ c.binding.client.processName+ "String_Node_Str",e);
      }
    }
  }
  if (r.bindings.size() > 0 && r.app != null && r.app.thread != null) {
    Iterator<IntentBindRecord> it=r.bindings.values().iterator();
    while (it.hasNext()) {
      IntentBindRecord ibr=it.next();
      if (DEBUG_SERVICE)       Log.v(TAG,"String_Node_Str" + ibr + "String_Node_Str"+ ibr.hasBound);
      if (r.app != null && r.app.thread != null && ibr.hasBound) {
        try {
          bumpServiceExecutingLocked(r);
          updateOomAdjLocked(r.app);
          ibr.hasBound=false;
          r.app.thread.scheduleUnbindService(r,ibr.intent.getIntent());
        }
 catch (        Exception e) {
          Log.w(TAG,"String_Node_Str" + r.shortName,e);
          serviceDoneExecutingLocked(r,true);
        }
      }
    }
  }
  if (DEBUG_SERVICE)   Log.v(TAG,"String_Node_Str" + r.name + "String_Node_Str"+ r.intent);
  EventLog.writeEvent(LOG_AM_DESTROY_SERVICE,System.identityHashCode(r),r.shortName,(r.app != null) ? r.app.pid : -1);
  mServices.remove(r.name);
  mServicesByIntent.remove(r.intent);
  if (localLOGV)   Log.v(TAG,"String_Node_Str" + r.shortName);
  r.totalRestartCount=0;
  unscheduleServiceRestartLocked(r);
  int N=mPendingServices.size();
  for (int i=0; i < N; i++) {
    if (mPendingServices.get(i) == r) {
      mPendingServices.remove(i);
      if (DEBUG_SERVICE)       Log.v(TAG,"String_Node_Str" + r.shortName);
      i--;
      N--;
    }
  }
  r.cancelNotification();
  r.isForeground=false;
  r.foregroundId=0;
  r.foregroundNoti=null;
  r.deliveredStarts.clear();
  r.pendingStarts.clear();
  if (r.app != null) {
synchronized (r.stats.getBatteryStats()) {
      r.stats.stopLaunchedLocked();
    }
    r.app.services.remove(r);
    if (r.app.thread != null) {
      try {
        Log.i(TAG,"String_Node_Str" + r.shortName);
        bumpServiceExecutingLocked(r);
        mStoppingServices.add(r);
        updateOomAdjLocked(r.app);
        r.app.thread.scheduleStopService(r);
      }
 catch (      Exception e) {
        Log.w(TAG,"String_Node_Str" + r.shortName,e);
        serviceDoneExecutingLocked(r,true);
      }
      updateServiceForegroundLocked(r.app,false);
    }
 else {
      if (DEBUG_SERVICE)       Log.v(TAG,"String_Node_Str" + r.shortName);
    }
  }
 else {
    if (DEBUG_SERVICE)     Log.v(TAG,"String_Node_Str" + r.shortName);
  }
}

Fixed version (ground truth):
private final void bringDownServiceLocked(ServiceRecord r,boolean force){
  if (!force && r.startRequested) {
    return;
  }
  if (r.connections.size() > 0) {
    if (!force) {
      Iterator<ConnectionRecord> it=r.connections.values().iterator();
      while (it.hasNext()) {
        ConnectionRecord cr=it.next();
        if ((cr.flags & Context.BIND_AUTO_CREATE) != 0) {
          return;
        }
      }
    }
    Iterator<ConnectionRecord> it=r.connections.values().iterator();
    while (it.hasNext()) {
      ConnectionRecord c=it.next();
      try {
        c.conn.connected(r.name,null);
      }
 catch (      Exception e) {
        Log.w(TAG,"String_Node_Str" + r.name + "String_Node_Str"+ c.conn.asBinder()+ "String_Node_Str"+ c.binding.client.processName+ "String_Node_Str",e);
      }
    }
  }
  if (r.bindings.size() > 0 && r.app != null && r.app.thread != null) {
    Iterator<IntentBindRecord> it=r.bindings.values().iterator();
    while (it.hasNext()) {
      IntentBindRecord ibr=it.next();
      if (DEBUG_SERVICE)       Log.v(TAG,"String_Node_Str" + ibr + "String_Node_Str"+ ibr.hasBound);
      if (r.app != null && r.app.thread != null && ibr.hasBound) {
        try {
          bumpServiceExecutingLocked(r);
          updateOomAdjLocked(r.app);
          ibr.hasBound=false;
          r.app.thread.scheduleUnbindService(r,ibr.intent.getIntent());
        }
 catch (        Exception e) {
          Log.w(TAG,"String_Node_Str" + r.shortName,e);
          serviceDoneExecutingLocked(r,true);
        }
      }
    }
  }
  if (DEBUG_SERVICE)   Log.v(TAG,"String_Node_Str" + r.name + "String_Node_Str"+ r.intent);
  EventLog.writeEvent(LOG_AM_DESTROY_SERVICE,System.identityHashCode(r),r.shortName,(r.app != null) ? r.app.pid : -1);
  mServices.remove(r.name);
  mServicesByIntent.remove(r.intent);
  if (localLOGV)   Log.v(TAG,"String_Node_Str" + r.shortName);
  r.totalRestartCount=0;
  unscheduleServiceRestartLocked(r);
  int N=mPendingServices.size();
  for (int i=0; i < N; i++) {
    if (mPendingServices.get(i) == r) {
      mPendingServices.remove(i);
      if (DEBUG_SERVICE)       Log.v(TAG,"String_Node_Str" + r.shortName);
      i--;
      N--;
    }
  }
  r.cancelNotification();
  r.isForeground=false;
  r.foregroundId=0;
  r.foregroundNoti=null;
  r.deliveredStarts.clear();
  r.pendingStarts.clear();
  if (r.app != null) {
synchronized (r.stats.getBatteryStats()) {
      r.stats.stopLaunchedLocked();
    }
    r.app.services.remove(r);
    if (r.app.thread != null) {
      try {
        if (DEBUG_SERVICE)         Log.v(TAG,"String_Node_Str" + r.shortName);
        bumpServiceExecutingLocked(r);
        mStoppingServices.add(r);
        updateOomAdjLocked(r.app);
        r.app.thread.scheduleStopService(r);
      }
 catch (      Exception e) {
        Log.w(TAG,"String_Node_Str" + r.shortName,e);
        serviceDoneExecutingLocked(r,true);
      }
      updateServiceForegroundLocked(r.app,false);
    }
 else {
      if (DEBUG_SERVICE)       Log.v(TAG,"String_Node_Str" + r.shortName);
    }
  }
 else {
    if (DEBUG_SERVICE)     Log.v(TAG,"String_Node_Str" + r.shortName);
  }
}