Program: 194819
Project: 194819
Buggy source:
@Override public void addOnSubscriptionsChangedListener(String callingPackage,IOnSubscriptionsChangedListener callback){
  int callerUserId=UserHandle.getCallingUserId();
  if (VDBG) {
    log("String_Node_Str" + callingPackage + "String_Node_Str"+ UserHandle.myUserId()+ "String_Node_Str"+ callerUserId+ "String_Node_Str"+ callback+ "String_Node_Str"+ callback.asBinder());
  }
  mContext.enforceCallingOrSelfPermission(android.Manifest.permission.READ_PHONE_STATE,null);
  if (mAppOps.noteOp(AppOpsManager.OP_READ_PHONE_STATE,Binder.getCallingUid(),callingPackage) != AppOpsManager.MODE_ALLOWED) {
    return;
  }
  final Record r;
synchronized (mRecords) {
    find_and_add: {
      IBinder b=callback.asBinder();
      final int N=mRecords.size();
      for (int i=0; i < N; i++) {
        r=mRecords.get(i);
        if (b == r.binder) {
          break find_and_add;
        }
      }
      r=new Record();
      r.binder=b;
      mRecords.add(r);
      if (DBG)       log("String_Node_Str");
    }
    r.onSubscriptionsChangedListenerCallback=callback;
    r.callingPackage=callingPackage;
    r.callerUserId=callerUserId;
    r.events=0;
    r.canReadPhoneState=true;
    if (DBG) {
      log("String_Node_Str" + r);
    }
    if (hasNotifySubscriptionInfoChangedOccurred) {
      try {
        if (VDBG)         log("String_Node_Str" + r);
        r.onSubscriptionsChangedListenerCallback.onSubscriptionsChanged();
        if (VDBG)         log("String_Node_Str" + r);
      }
 catch (      RemoteException e) {
        if (VDBG)         log("String_Node_Str" + r + "String_Node_Str"+ e);
        remove(r.binder);
      }
    }
 else {
      log("String_Node_Str");
    }
  }
}

Fixed version (ground truth):
@Override public void addOnSubscriptionsChangedListener(String callingPackage,IOnSubscriptionsChangedListener callback){
  int callerUserId=UserHandle.getCallingUserId();
  if (VDBG) {
    log("String_Node_Str" + callingPackage + "String_Node_Str"+ UserHandle.myUserId()+ "String_Node_Str"+ callerUserId+ "String_Node_Str"+ callback+ "String_Node_Str"+ callback.asBinder());
  }
  mContext.enforceCallingOrSelfPermission(android.Manifest.permission.READ_PHONE_STATE,null);
  if (mAppOps.noteOp(AppOpsManager.OP_READ_PHONE_STATE,Binder.getCallingUid(),callingPackage) != AppOpsManager.MODE_ALLOWED) {
    return;
  }
  Record r;
synchronized (mRecords) {
    find_and_add: {
      IBinder b=callback.asBinder();
      final int N=mRecords.size();
      for (int i=0; i < N; i++) {
        r=mRecords.get(i);
        if (b == r.binder) {
          break find_and_add;
        }
      }
      r=new Record();
      r.binder=b;
      mRecords.add(r);
      if (DBG)       log("String_Node_Str");
    }
    r.onSubscriptionsChangedListenerCallback=callback;
    r.callingPackage=callingPackage;
    r.callerUserId=callerUserId;
    r.events=0;
    r.canReadPhoneState=true;
    if (DBG) {
      log("String_Node_Str" + r);
    }
    if (hasNotifySubscriptionInfoChangedOccurred) {
      try {
        if (VDBG)         log("String_Node_Str" + r);
        r.onSubscriptionsChangedListenerCallback.onSubscriptionsChanged();
        if (VDBG)         log("String_Node_Str" + r);
      }
 catch (      RemoteException e) {
        if (VDBG)         log("String_Node_Str" + r + "String_Node_Str"+ e);
        remove(r.binder);
      }
    }
 else {
      log("String_Node_Str");
    }
  }
}