Program: 196503
Project: 196503
Buggy source:
private final void bringDownServiceLocked(ServiceRecord r){
  for (int conni=r.connections.size() - 1; conni >= 0; conni--) {
    ArrayList<ConnectionRecord> c=r.connections.valueAt(conni);
    for (int i=0; i < c.size(); i++) {
      ConnectionRecord cr=c.get(i);
      cr.serviceDead=true;
      try {
        cr.conn.connected(r.name,null);
      }
 catch (      Exception e) {
        Slog.w(TAG,"String_Node_Str" + r.name + "String_Node_Str"+ c.get(i).conn.asBinder()+ "String_Node_Str"+ c.get(i).binding.client.processName+ "String_Node_Str",e);
      }
    }
  }
  if (r.app != null && r.app.thread != null) {
    for (int i=r.bindings.size() - 1; i >= 0; i--) {
      IntentBindRecord ibr=r.bindings.valueAt(i);
      if (DEBUG_SERVICE)       Slog.v(TAG,"String_Node_Str" + ibr + "String_Node_Str"+ ibr.hasBound);
      if (ibr.hasBound) {
        try {
          bumpServiceExecutingLocked(r,false,"String_Node_Str");
          mAm.updateOomAdjLocked(r.app);
          ibr.hasBound=false;
          r.app.thread.scheduleUnbindService(r,ibr.intent.getIntent());
        }
 catch (        Exception e) {
          Slog.w(TAG,"String_Node_Str" + r.shortName,e);
          serviceProcessGoneLocked(r);
        }
      }
    }
  }
  if (DEBUG_SERVICE)   Slog.v(TAG,"String_Node_Str" + r + "String_Node_Str"+ r.intent);
  EventLogTags.writeAmDestroyService(r.userId,System.identityHashCode(r),(r.app != null) ? r.app.pid : -1);
  final ServiceMap smap=getServiceMap(r.userId);
  smap.mServicesByName.remove(r.name);
  smap.mServicesByIntent.remove(r.intent);
  r.totalRestartCount=0;
  unscheduleServiceRestartLocked(r,0,true);
  for (int i=mPendingServices.size() - 1; i >= 0; i--) {
    if (mPendingServices.get(i) == r) {
      mPendingServices.remove(i);
      if (DEBUG_SERVICE)       Slog.v(TAG,"String_Node_Str" + r);
    }
  }
  r.cancelNotification();
  r.isForeground=false;
  r.foregroundId=0;
  r.foregroundNoti=null;
  r.clearDeliveredStartsLocked();
  r.pendingStarts.clear();
  if (r.app != null) {
synchronized (r.stats.getBatteryStats()) {
      r.stats.stopLaunchedLocked();
    }
    r.app.services.remove(r);
    if (r.app.thread != null) {
      updateServiceForegroundLocked(r.app,false);
      try {
        bumpServiceExecutingLocked(r,false,"String_Node_Str");
        mDestroyingServices.add(r);
        mAm.updateOomAdjLocked(r.app);
        r.app.thread.scheduleStopService(r);
      }
 catch (      Exception e) {
        Slog.w(TAG,"String_Node_Str" + r.shortName,e);
        serviceProcessGoneLocked(r);
      }
    }
 else {
      if (DEBUG_SERVICE)       Slog.v(TAG,"String_Node_Str" + r);
    }
  }
 else {
    if (DEBUG_SERVICE)     Slog.v(TAG,"String_Node_Str" + r);
  }
  if (r.bindings.size() > 0) {
    r.bindings.clear();
  }
  if (r.restarter instanceof ServiceRestarter) {
    ((ServiceRestarter)r.restarter).setService(null);
  }
  int memFactor=mAm.mProcessStats.getMemFactorLocked();
  long now=SystemClock.uptimeMillis();
  if (r.tracker != null) {
    r.tracker.setStarted(false,memFactor,now);
    r.tracker.setBound(false,memFactor,now);
    if (r.executeNesting == 0) {
      r.tracker.clearCurrentOwner(r,false);
      r.tracker=null;
    }
  }
  smap.ensureNotStartingBackground(r);
}

Fixed version (ground truth):
private final void bringDownServiceLocked(ServiceRecord r){
  for (int conni=r.connections.size() - 1; conni >= 0; conni--) {
    ArrayList<ConnectionRecord> c=r.connections.valueAt(conni);
    for (int i=0; i < c.size(); i++) {
      ConnectionRecord cr=c.get(i);
      cr.serviceDead=true;
      try {
        cr.conn.connected(r.name,null);
      }
 catch (      Exception e) {
        Slog.w(TAG,"String_Node_Str" + r.name + "String_Node_Str"+ c.get(i).conn.asBinder()+ "String_Node_Str"+ c.get(i).binding.client.processName+ "String_Node_Str",e);
      }
    }
  }
  if (r.app != null && r.app.thread != null) {
    for (int i=r.bindings.size() - 1; i >= 0; i--) {
      IntentBindRecord ibr=r.bindings.valueAt(i);
      if (DEBUG_SERVICE)       Slog.v(TAG,"String_Node_Str" + ibr + "String_Node_Str"+ ibr.hasBound);
      if (ibr.hasBound) {
        try {
          bumpServiceExecutingLocked(r,false,"String_Node_Str");
          mAm.updateOomAdjLocked(r.app);
          ibr.hasBound=false;
          r.app.thread.scheduleUnbindService(r,ibr.intent.getIntent());
        }
 catch (        Exception e) {
          Slog.w(TAG,"String_Node_Str" + r.shortName,e);
          serviceProcessGoneLocked(r);
        }
      }
    }
  }
  if (DEBUG_SERVICE)   Slog.v(TAG,"String_Node_Str" + r + "String_Node_Str"+ r.intent);
  if (LOG_SERVICE_START_STOP) {
    EventLogTags.writeAmDestroyService(r.userId,System.identityHashCode(r),(r.app != null) ? r.app.pid : -1);
  }
  final ServiceMap smap=getServiceMap(r.userId);
  smap.mServicesByName.remove(r.name);
  smap.mServicesByIntent.remove(r.intent);
  r.totalRestartCount=0;
  unscheduleServiceRestartLocked(r,0,true);
  for (int i=mPendingServices.size() - 1; i >= 0; i--) {
    if (mPendingServices.get(i) == r) {
      mPendingServices.remove(i);
      if (DEBUG_SERVICE)       Slog.v(TAG,"String_Node_Str" + r);
    }
  }
  r.cancelNotification();
  r.isForeground=false;
  r.foregroundId=0;
  r.foregroundNoti=null;
  r.clearDeliveredStartsLocked();
  r.pendingStarts.clear();
  if (r.app != null) {
synchronized (r.stats.getBatteryStats()) {
      r.stats.stopLaunchedLocked();
    }
    r.app.services.remove(r);
    if (r.app.thread != null) {
      updateServiceForegroundLocked(r.app,false);
      try {
        bumpServiceExecutingLocked(r,false,"String_Node_Str");
        mDestroyingServices.add(r);
        mAm.updateOomAdjLocked(r.app);
        r.app.thread.scheduleStopService(r);
      }
 catch (      Exception e) {
        Slog.w(TAG,"String_Node_Str" + r.shortName,e);
        serviceProcessGoneLocked(r);
      }
    }
 else {
      if (DEBUG_SERVICE)       Slog.v(TAG,"String_Node_Str" + r);
    }
  }
 else {
    if (DEBUG_SERVICE)     Slog.v(TAG,"String_Node_Str" + r);
  }
  if (r.bindings.size() > 0) {
    r.bindings.clear();
  }
  if (r.restarter instanceof ServiceRestarter) {
    ((ServiceRestarter)r.restarter).setService(null);
  }
  int memFactor=mAm.mProcessStats.getMemFactorLocked();
  long now=SystemClock.uptimeMillis();
  if (r.tracker != null) {
    r.tracker.setStarted(false,memFactor,now);
    r.tracker.setBound(false,memFactor,now);
    if (r.executeNesting == 0) {
      r.tracker.clearCurrentOwner(r,false);
      r.tracker=null;
    }
  }
  smap.ensureNotStartingBackground(r);
}