Program: 192282
Project: 192282
Buggy source:
ComponentName startServiceLocked(IApplicationThread caller,Intent service,String resolvedType,int callingPid,int callingUid,String callingPackage,final int userId) throws TransactionTooLargeException {
  if (DEBUG_DELAYED_STARTS)   Slog.v(TAG_SERVICE,"String_Node_Str" + service + "String_Node_Str"+ resolvedType+ "String_Node_Str"+ service.getExtras());
  final boolean callerFg;
  if (caller != null) {
    final ProcessRecord callerApp=mAm.getRecordForAppLocked(caller);
    if (callerApp == null) {
      throw new SecurityException("String_Node_Str" + caller + "String_Node_Str"+ Binder.getCallingPid()+ "String_Node_Str"+ service);
    }
    callerFg=callerApp.setSchedGroup != ProcessList.SCHED_GROUP_BACKGROUND;
  }
 else {
    callerFg=true;
  }
  ServiceLookupResult res=retrieveServiceLocked(service,resolvedType,callingPackage,callingPid,callingUid,userId,true,callerFg,false);
  if (res == null) {
    return null;
  }
  if (res.record == null) {
    return new ComponentName("String_Node_Str",res.permission != null ? res.permission : "String_Node_Str");
  }
  ServiceRecord r=res.record;
  if (!mAm.mUserController.exists(r.userId)) {
    Slog.w(TAG,"String_Node_Str" + r.userId);
    return null;
  }
  NeededUriGrants neededGrants=mAm.checkGrantUriPermissionFromIntentLocked(callingUid,r.packageName,service,service.getFlags(),null,r.userId);
  if (Build.PERMISSIONS_REVIEW_REQUIRED) {
    if (!requestStartTargetPermissionsReviewIfNeededLocked(r,callingPackage,callingUid,service,callerFg,userId)) {
      return null;
    }
  }
  if (unscheduleServiceRestartLocked(r,callingUid,false)) {
    if (DEBUG_SERVICE)     Slog.v(TAG_SERVICE,"String_Node_Str" + r);
  }
  r.lastActivity=SystemClock.uptimeMillis();
  r.startRequested=true;
  r.delayedStop=false;
  r.pendingStarts.add(new ServiceRecord.StartItem(r,false,r.makeNextStartId(),service,neededGrants));
  final ServiceMap smap=getServiceMap(r.userId);
  boolean addToStarting=false;
  if (!callerFg && r.app == null && mAm.mUserController.hasStartedUserState(r.userId)) {
    ProcessRecord proc=mAm.getProcessRecordLocked(r.processName,r.appInfo.uid,false);
    if (proc == null || proc.curProcState > ActivityManager.PROCESS_STATE_RECEIVER) {
      if (DEBUG_DELAYED_SERVICE)       Slog.v(TAG_SERVICE,"String_Node_Str" + r + "String_Node_Str"+ proc);
      if (r.delayed) {
        if (DEBUG_DELAYED_STARTS)         Slog.v(TAG_SERVICE,"String_Node_Str" + r);
        return r.name;
      }
      if (smap.mStartingBackground.size() >= mMaxStartingBackground) {
        Slog.i(TAG_SERVICE,"String_Node_Str" + r);
        smap.mDelayedStartList.add(r);
        r.delayed=true;
        return r.name;
      }
      if (DEBUG_DELAYED_STARTS)       Slog.v(TAG_SERVICE,"String_Node_Str" + r);
      addToStarting=true;
    }
 else     if (proc.curProcState >= ActivityManager.PROCESS_STATE_SERVICE) {
      addToStarting=true;
      if (DEBUG_DELAYED_STARTS)       Slog.v(TAG_SERVICE,"String_Node_Str" + r);
    }
 else     if (DEBUG_DELAYED_STARTS) {
      StringBuilder sb=new StringBuilder(128);
      sb.append("String_Node_Str").append(proc.curProcState).append(' ').append(proc.adjType);
      String reason=proc.makeAdjReason();
      if (reason != null) {
        sb.append(' ');
        sb.append(reason);
      }
      sb.append("String_Node_Str");
      sb.append(r.toString());
      Slog.v(TAG_SERVICE,sb.toString());
    }
  }
 else   if (DEBUG_DELAYED_STARTS) {
    if (callerFg) {
      Slog.v(TAG_SERVICE,"String_Node_Str" + callerFg + "String_Node_Str"+ callingUid+ "String_Node_Str"+ callingPid+ "String_Node_Str"+ r);
    }
 else     if (r.app != null) {
      Slog.v(TAG_SERVICE,"String_Node_Str" + r.app + "String_Node_Str"+ r);
    }
 else {
      Slog.v(TAG_SERVICE,"String_Node_Str" + r.userId + "String_Node_Str"+ r);
    }
  }
  return startServiceInnerLocked(smap,service,r,callerFg,addToStarting);
}

Fixed version (ground truth):
ComponentName startServiceLocked(IApplicationThread caller,Intent service,String resolvedType,int callingPid,int callingUid,String callingPackage,final int userId) throws TransactionTooLargeException {
  if (DEBUG_DELAYED_STARTS)   Slog.v(TAG_SERVICE,"String_Node_Str" + service + "String_Node_Str"+ resolvedType+ "String_Node_Str"+ service.getExtras());
  final boolean callerFg;
  if (caller != null) {
    final ProcessRecord callerApp=mAm.getRecordForAppLocked(caller);
    if (callerApp == null) {
      throw new SecurityException("String_Node_Str" + caller + "String_Node_Str"+ Binder.getCallingPid()+ "String_Node_Str"+ service);
    }
    callerFg=callerApp.setSchedGroup != ProcessList.SCHED_GROUP_BACKGROUND;
  }
 else {
    callerFg=true;
  }
  ServiceLookupResult res=retrieveServiceLocked(service,resolvedType,callingPackage,callingPid,callingUid,userId,true,callerFg,false);
  if (res == null) {
    return null;
  }
  if (res.record == null) {
    return new ComponentName("String_Node_Str",res.permission != null ? res.permission : "String_Node_Str");
  }
  ServiceRecord r=res.record;
  if (!mAm.mUserController.exists(r.userId)) {
    Slog.w(TAG,"String_Node_Str" + r.userId);
    return null;
  }
  if (!r.startRequested) {
    final long token=Binder.clearCallingIdentity();
    try {
      final int allowed=mAm.checkAllowBackgroundLocked(r.appInfo.uid,r.packageName,callingPid,true);
      if (allowed != ActivityManager.APP_START_MODE_NORMAL) {
        Slog.w(TAG,"String_Node_Str" + service + "String_Node_Str"+ r.name.flattenToShortString()+ "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid+ "String_Node_Str"+ callingPackage);
        return null;
      }
    }
  finally {
      Binder.restoreCallingIdentity(token);
    }
  }
  NeededUriGrants neededGrants=mAm.checkGrantUriPermissionFromIntentLocked(callingUid,r.packageName,service,service.getFlags(),null,r.userId);
  if (Build.PERMISSIONS_REVIEW_REQUIRED) {
    if (!requestStartTargetPermissionsReviewIfNeededLocked(r,callingPackage,callingUid,service,callerFg,userId)) {
      return null;
    }
  }
  if (unscheduleServiceRestartLocked(r,callingUid,false)) {
    if (DEBUG_SERVICE)     Slog.v(TAG_SERVICE,"String_Node_Str" + r);
  }
  r.lastActivity=SystemClock.uptimeMillis();
  r.startRequested=true;
  r.delayedStop=false;
  r.pendingStarts.add(new ServiceRecord.StartItem(r,false,r.makeNextStartId(),service,neededGrants));
  final ServiceMap smap=getServiceMap(r.userId);
  boolean addToStarting=false;
  if (!callerFg && r.app == null && mAm.mUserController.hasStartedUserState(r.userId)) {
    ProcessRecord proc=mAm.getProcessRecordLocked(r.processName,r.appInfo.uid,false);
    if (proc == null || proc.curProcState > ActivityManager.PROCESS_STATE_RECEIVER) {
      if (DEBUG_DELAYED_SERVICE)       Slog.v(TAG_SERVICE,"String_Node_Str" + r + "String_Node_Str"+ proc);
      if (r.delayed) {
        if (DEBUG_DELAYED_STARTS)         Slog.v(TAG_SERVICE,"String_Node_Str" + r);
        return r.name;
      }
      if (smap.mStartingBackground.size() >= mMaxStartingBackground) {
        Slog.i(TAG_SERVICE,"String_Node_Str" + r);
        smap.mDelayedStartList.add(r);
        r.delayed=true;
        return r.name;
      }
      if (DEBUG_DELAYED_STARTS)       Slog.v(TAG_SERVICE,"String_Node_Str" + r);
      addToStarting=true;
    }
 else     if (proc.curProcState >= ActivityManager.PROCESS_STATE_SERVICE) {
      addToStarting=true;
      if (DEBUG_DELAYED_STARTS)       Slog.v(TAG_SERVICE,"String_Node_Str" + r);
    }
 else     if (DEBUG_DELAYED_STARTS) {
      StringBuilder sb=new StringBuilder(128);
      sb.append("String_Node_Str").append(proc.curProcState).append(' ').append(proc.adjType);
      String reason=proc.makeAdjReason();
      if (reason != null) {
        sb.append(' ');
        sb.append(reason);
      }
      sb.append("String_Node_Str");
      sb.append(r.toString());
      Slog.v(TAG_SERVICE,sb.toString());
    }
  }
 else   if (DEBUG_DELAYED_STARTS) {
    if (callerFg) {
      Slog.v(TAG_SERVICE,"String_Node_Str" + callerFg + "String_Node_Str"+ callingUid+ "String_Node_Str"+ callingPid+ "String_Node_Str"+ r);
    }
 else     if (r.app != null) {
      Slog.v(TAG_SERVICE,"String_Node_Str" + r.app + "String_Node_Str"+ r);
    }
 else {
      Slog.v(TAG_SERVICE,"String_Node_Str" + r.userId + "String_Node_Str"+ r);
    }
  }
  return startServiceInnerLocked(smap,service,r,callerFg,addToStarting);
}