Program: 197149
Project: 197149
Buggy source:
final boolean navigateUpToLocked(IBinder token,Intent destIntent,int resultCode,Intent resultData){
  final ActivityRecord srec=ActivityRecord.forToken(token);
  final TaskRecord task=srec.task;
  final ArrayList<ActivityRecord> activities=task.mActivities;
  final int start=activities.indexOf(srec);
  if (!mTaskHistory.contains(task) || (start < 0)) {
    return false;
  }
  int finishTo=start - 1;
  ActivityRecord parent=finishTo < 0 ? null : activities.get(finishTo);
  boolean foundParentInTask=false;
  final ComponentName dest=destIntent.getComponent();
  if (start > 0 && dest != null) {
    for (int i=finishTo; i >= 0; i--) {
      ActivityRecord r=activities.get(i);
      if (r.info.packageName.equals(dest.getPackageName()) && r.info.name.equals(dest.getClassName())) {
        finishTo=i;
        parent=r;
        foundParentInTask=true;
        break;
      }
    }
  }
  IActivityController controller=mService.mController;
  if (controller != null) {
    ActivityRecord next=topRunningActivityLocked(srec.appToken,0);
    if (next != null) {
      boolean resumeOK=true;
      try {
        resumeOK=controller.activityResuming(next.packageName);
      }
 catch (      RemoteException e) {
        mService.mController=null;
        Watchdog.getInstance().setActivityController(null);
      }
      if (!resumeOK) {
        return false;
      }
    }
  }
  final long origId=Binder.clearCallingIdentity();
  for (int i=start; i > finishTo; i--) {
    ActivityRecord r=activities.get(i);
    requestFinishActivityLocked(r.appToken,resultCode,resultData,"String_Node_Str",true);
    resultCode=Activity.RESULT_CANCELED;
    resultData=null;
  }
  if (parent != null && foundParentInTask) {
    final int parentLaunchMode=parent.info.launchMode;
    final int destIntentFlags=destIntent.getFlags();
    if (parentLaunchMode == ActivityInfo.LAUNCH_SINGLE_INSTANCE || parentLaunchMode == ActivityInfo.LAUNCH_SINGLE_TASK || parentLaunchMode == ActivityInfo.LAUNCH_SINGLE_TOP || (destIntentFlags & Intent.FLAG_ACTIVITY_CLEAR_TOP) != 0) {
      parent.deliverNewIntentLocked(srec.info.applicationInfo.uid,destIntent);
    }
 else {
      try {
        ActivityInfo aInfo=AppGlobals.getPackageManager().getActivityInfo(destIntent.getComponent(),0,srec.userId);
        int res=mStackSupervisor.startActivityLocked(srec.app.thread,destIntent,null,aInfo,null,null,parent.appToken,null,0,-1,parent.launchedFromUid,parent.launchedFromPackage,0,null,true,null,null,null);
        foundParentInTask=res == ActivityManager.START_SUCCESS;
      }
 catch (      RemoteException e) {
        foundParentInTask=false;
      }
      requestFinishActivityLocked(parent.appToken,resultCode,resultData,"String_Node_Str",true);
    }
  }
  Binder.restoreCallingIdentity(origId);
  return foundParentInTask;
}

Fixed version (ground truth):
final boolean navigateUpToLocked(IBinder token,Intent destIntent,int resultCode,Intent resultData){
  final ActivityRecord srec=ActivityRecord.forToken(token);
  final TaskRecord task=srec.task;
  final ArrayList<ActivityRecord> activities=task.mActivities;
  final int start=activities.indexOf(srec);
  if (!mTaskHistory.contains(task) || (start < 0)) {
    return false;
  }
  int finishTo=start - 1;
  ActivityRecord parent=finishTo < 0 ? null : activities.get(finishTo);
  boolean foundParentInTask=false;
  final ComponentName dest=destIntent.getComponent();
  if (start > 0 && dest != null) {
    for (int i=finishTo; i >= 0; i--) {
      ActivityRecord r=activities.get(i);
      if (r.info.packageName.equals(dest.getPackageName()) && r.info.name.equals(dest.getClassName())) {
        finishTo=i;
        parent=r;
        foundParentInTask=true;
        break;
      }
    }
  }
  IActivityController controller=mService.mController;
  if (controller != null) {
    ActivityRecord next=topRunningActivityLocked(srec.appToken,0);
    if (next != null) {
      boolean resumeOK=true;
      try {
        resumeOK=controller.activityResuming(next.packageName);
      }
 catch (      RemoteException e) {
        mService.mController=null;
        Watchdog.getInstance().setActivityController(null);
      }
      if (!resumeOK) {
        return false;
      }
    }
  }
  final long origId=Binder.clearCallingIdentity();
  for (int i=start; i > finishTo; i--) {
    ActivityRecord r=activities.get(i);
    requestFinishActivityLocked(r.appToken,resultCode,resultData,"String_Node_Str",true);
    resultCode=Activity.RESULT_CANCELED;
    resultData=null;
  }
  if (parent != null && foundParentInTask) {
    final int parentLaunchMode=parent.info.launchMode;
    final int destIntentFlags=destIntent.getFlags();
    if (parentLaunchMode == ActivityInfo.LAUNCH_SINGLE_INSTANCE || parentLaunchMode == ActivityInfo.LAUNCH_SINGLE_TASK || parentLaunchMode == ActivityInfo.LAUNCH_SINGLE_TOP || (destIntentFlags & Intent.FLAG_ACTIVITY_CLEAR_TOP) != 0) {
      parent.deliverNewIntentLocked(srec.info.applicationInfo.uid,destIntent);
    }
 else {
      try {
        ActivityInfo aInfo=AppGlobals.getPackageManager().getActivityInfo(destIntent.getComponent(),0,srec.userId);
        int res=mStackSupervisor.startActivityLocked(srec.app.thread,destIntent,null,aInfo,null,null,parent.appToken,null,0,-1,parent.launchedFromUid,parent.launchedFromPackage,-1,parent.launchedFromUid,0,null,true,null,null,null);
        foundParentInTask=res == ActivityManager.START_SUCCESS;
      }
 catch (      RemoteException e) {
        foundParentInTask=false;
      }
      requestFinishActivityLocked(parent.appToken,resultCode,resultData,"String_Node_Str",true);
    }
  }
  Binder.restoreCallingIdentity(origId);
  return foundParentInTask;
}