Program: 197514
Project: 197514
Buggy source:
@Override public void handleMessage(Message msg){
switch (msg.what) {
case COLLECT_PSS_BG_MSG:
{
      long start=SystemClock.uptimeMillis();
      MemInfoReader memInfo=null;
synchronized (ActivityManagerService.this) {
        if (mFullPssPending) {
          mFullPssPending=false;
          memInfo=new MemInfoReader();
        }
      }
      if (memInfo != null) {
        updateCpuStatsNow();
        long nativeTotalPss=0;
synchronized (mProcessCpuThread) {
          final int N=mProcessCpuTracker.countStats();
          for (int j=0; j < N; j++) {
            ProcessCpuTracker.Stats st=mProcessCpuTracker.getStats(j);
            if (st.vsize <= 0 || st.uid >= Process.FIRST_APPLICATION_UID) {
              continue;
            }
synchronized (mPidsSelfLocked) {
              if (mPidsSelfLocked.indexOfKey(st.pid) >= 0) {
                continue;
              }
            }
            nativeTotalPss+=Debug.getPss(st.pid,null);
          }
        }
        memInfo.readMemInfo();
synchronized (this) {
          if (DEBUG_PSS)           Slog.d(TAG,"String_Node_Str" + (SystemClock.uptimeMillis() - start) + "String_Node_Str");
          mProcessStats.addSysMemUsageLocked(memInfo.getCachedSizeKb(),memInfo.getFreeSizeKb(),memInfo.getZramTotalSizeKb(),memInfo.getBuffersSizeKb() + memInfo.getShmemSizeKb() + memInfo.getSlabSizeKb(),nativeTotalPss);
        }
      }
      int i=0, num=0;
      long[] tmp=new long[1];
      do {
        ProcessRecord proc;
        int procState;
        int pid;
synchronized (ActivityManagerService.this) {
          if (i >= mPendingPssProcesses.size()) {
            if (DEBUG_PSS)             Slog.d(TAG,"String_Node_Str" + num + "String_Node_Str"+ i+ "String_Node_Str"+ (SystemClock.uptimeMillis() - start)+ "String_Node_Str");
            mPendingPssProcesses.clear();
            return;
          }
          proc=mPendingPssProcesses.get(i);
          procState=proc.pssProcState;
          if (proc.thread != null && procState == proc.setProcState) {
            pid=proc.pid;
          }
 else {
            proc=null;
            pid=0;
          }
          i++;
        }
        if (proc != null) {
          long pss=Debug.getPss(pid,tmp);
synchronized (ActivityManagerService.this) {
            if (proc.thread != null && proc.setProcState == procState && proc.pid == pid) {
              num++;
              proc.lastPssTime=SystemClock.uptimeMillis();
              proc.baseProcessTracker.addPss(pss,tmp[0],true,proc.pkgList);
              if (DEBUG_PSS)               Slog.d(TAG,"String_Node_Str" + proc.toShortString() + "String_Node_Str"+ pss+ "String_Node_Str"+ proc.lastPss+ "String_Node_Str"+ ProcessList.makeProcStateString(procState));
              if (proc.initialIdlePss == 0) {
                proc.initialIdlePss=pss;
              }
              proc.lastPss=pss;
              if (procState >= ActivityManager.PROCESS_STATE_HOME) {
                proc.lastCachedPss=pss;
              }
            }
          }
        }
      }
 while (true);
    }
}
}

Fixed version (ground truth):
@Override public void handleMessage(Message msg){
switch (msg.what) {
case COLLECT_PSS_BG_MSG:
{
      long start=SystemClock.uptimeMillis();
      MemInfoReader memInfo=null;
synchronized (ActivityManagerService.this) {
        if (mFullPssPending) {
          mFullPssPending=false;
          memInfo=new MemInfoReader();
        }
      }
      if (memInfo != null) {
        updateCpuStatsNow();
        long nativeTotalPss=0;
synchronized (mProcessCpuTracker) {
          final int N=mProcessCpuTracker.countStats();
          for (int j=0; j < N; j++) {
            ProcessCpuTracker.Stats st=mProcessCpuTracker.getStats(j);
            if (st.vsize <= 0 || st.uid >= Process.FIRST_APPLICATION_UID) {
              continue;
            }
synchronized (mPidsSelfLocked) {
              if (mPidsSelfLocked.indexOfKey(st.pid) >= 0) {
                continue;
              }
            }
            nativeTotalPss+=Debug.getPss(st.pid,null);
          }
        }
        memInfo.readMemInfo();
synchronized (ActivityManagerService.this) {
          if (DEBUG_PSS)           Slog.d(TAG,"String_Node_Str" + (SystemClock.uptimeMillis() - start) + "String_Node_Str");
          mProcessStats.addSysMemUsageLocked(memInfo.getCachedSizeKb(),memInfo.getFreeSizeKb(),memInfo.getZramTotalSizeKb(),memInfo.getBuffersSizeKb() + memInfo.getShmemSizeKb() + memInfo.getSlabSizeKb(),nativeTotalPss);
        }
      }
      int i=0, num=0;
      long[] tmp=new long[1];
      do {
        ProcessRecord proc;
        int procState;
        int pid;
synchronized (ActivityManagerService.this) {
          if (i >= mPendingPssProcesses.size()) {
            if (DEBUG_PSS)             Slog.d(TAG,"String_Node_Str" + num + "String_Node_Str"+ i+ "String_Node_Str"+ (SystemClock.uptimeMillis() - start)+ "String_Node_Str");
            mPendingPssProcesses.clear();
            return;
          }
          proc=mPendingPssProcesses.get(i);
          procState=proc.pssProcState;
          if (proc.thread != null && procState == proc.setProcState) {
            pid=proc.pid;
          }
 else {
            proc=null;
            pid=0;
          }
          i++;
        }
        if (proc != null) {
          long pss=Debug.getPss(pid,tmp);
synchronized (ActivityManagerService.this) {
            if (proc.thread != null && proc.setProcState == procState && proc.pid == pid) {
              num++;
              proc.lastPssTime=SystemClock.uptimeMillis();
              proc.baseProcessTracker.addPss(pss,tmp[0],true,proc.pkgList);
              if (DEBUG_PSS)               Slog.d(TAG,"String_Node_Str" + proc.toShortString() + "String_Node_Str"+ pss+ "String_Node_Str"+ proc.lastPss+ "String_Node_Str"+ ProcessList.makeProcStateString(procState));
              if (proc.initialIdlePss == 0) {
                proc.initialIdlePss=pss;
              }
              proc.lastPss=pss;
              if (procState >= ActivityManager.PROCESS_STATE_HOME) {
                proc.lastCachedPss=pss;
              }
            }
          }
        }
      }
 while (true);
    }
}
}