Program: 197518
Project: 197518
Buggy source:
private void revokeUriPermissionLocked(int callingUid,GrantUri grantUri,final int modeFlags){
  if (DEBUG_URI_PERMISSION)   Slog.v(TAG,"String_Node_Str" + grantUri);
  final IPackageManager pm=AppGlobals.getPackageManager();
  final String authority=grantUri.uri.getAuthority();
  final ProviderInfo pi=getProviderInfoLocked(authority,grantUri.sourceUserId);
  if (pi == null) {
    Slog.w(TAG,"String_Node_Str" + grantUri.toSafeString());
    return;
  }
  if (!checkHoldingPermissionsLocked(pm,pi,grantUri,callingUid,modeFlags)) {
    throw new SecurityException("String_Node_Str" + callingUid + "String_Node_Str"+ grantUri);
  }
  boolean persistChanged=false;
  int N=mGrantedUriPermissions.size();
  for (int i=0; i < N; i++) {
    final int targetUid=mGrantedUriPermissions.keyAt(i);
    final ArrayMap<GrantUri,UriPermission> perms=mGrantedUriPermissions.valueAt(i);
    for (Iterator<UriPermission> it=perms.values().iterator(); it.hasNext(); ) {
      final UriPermission perm=it.next();
      if (perm.uri.sourceUserId == grantUri.sourceUserId && perm.uri.uri.isPathPrefixMatch(grantUri.uri)) {
        if (DEBUG_URI_PERMISSION)         Slog.v(TAG,"String_Node_Str" + perm.targetUid + "String_Node_Str"+ perm.uri);
        persistChanged|=perm.revokeModes(modeFlags | Intent.FLAG_GRANT_PERSISTABLE_URI_PERMISSION);
        if (perm.modeFlags == 0) {
          it.remove();
        }
      }
    }
    if (perms.isEmpty()) {
      mGrantedUriPermissions.remove(targetUid);
      N--;
      i--;
    }
  }
  if (persistChanged) {
    schedulePersistUriGrants();
  }
}

Fixed version (ground truth):
private void revokeUriPermissionLocked(int callingUid,GrantUri grantUri,final int modeFlags){
  if (DEBUG_URI_PERMISSION)   Slog.v(TAG,"String_Node_Str" + grantUri);
  final IPackageManager pm=AppGlobals.getPackageManager();
  final String authority=grantUri.uri.getAuthority();
  final ProviderInfo pi=getProviderInfoLocked(authority,grantUri.sourceUserId);
  if (pi == null) {
    Slog.w(TAG,"String_Node_Str" + grantUri.toSafeString());
    return;
  }
  if (!checkHoldingPermissionsLocked(pm,pi,grantUri,callingUid,modeFlags)) {
    final ArrayMap<GrantUri,UriPermission> perms=mGrantedUriPermissions.get(callingUid);
    if (perms != null) {
      boolean persistChanged=false;
      for (Iterator<UriPermission> it=perms.values().iterator(); it.hasNext(); ) {
        final UriPermission perm=it.next();
        if (perm.uri.sourceUserId == grantUri.sourceUserId && perm.uri.uri.isPathPrefixMatch(grantUri.uri)) {
          if (DEBUG_URI_PERMISSION)           Slog.v(TAG,"String_Node_Str" + perm.targetUid + "String_Node_Str"+ perm.uri);
          persistChanged|=perm.revokeModes(modeFlags | Intent.FLAG_GRANT_PERSISTABLE_URI_PERMISSION);
          if (perm.modeFlags == 0) {
            it.remove();
          }
        }
      }
      if (perms.isEmpty()) {
        mGrantedUriPermissions.remove(callingUid);
      }
      if (persistChanged) {
        schedulePersistUriGrants();
      }
    }
    return;
  }
  boolean persistChanged=false;
  int N=mGrantedUriPermissions.size();
  for (int i=0; i < N; i++) {
    final int targetUid=mGrantedUriPermissions.keyAt(i);
    final ArrayMap<GrantUri,UriPermission> perms=mGrantedUriPermissions.valueAt(i);
    for (Iterator<UriPermission> it=perms.values().iterator(); it.hasNext(); ) {
      final UriPermission perm=it.next();
      if (perm.uri.sourceUserId == grantUri.sourceUserId && perm.uri.uri.isPathPrefixMatch(grantUri.uri)) {
        if (DEBUG_URI_PERMISSION)         Slog.v(TAG,"String_Node_Str" + perm.targetUid + "String_Node_Str"+ perm.uri);
        persistChanged|=perm.revokeModes(modeFlags | Intent.FLAG_GRANT_PERSISTABLE_URI_PERMISSION);
        if (perm.modeFlags == 0) {
          it.remove();
        }
      }
    }
    if (perms.isEmpty()) {
      mGrantedUriPermissions.remove(targetUid);
      N--;
      i--;
    }
  }
  if (persistChanged) {
    schedulePersistUriGrants();
  }
}