Program: 193786
Project: 193786
Buggy source:
@Override public void grantRuntimePermission(String packageName,String name,final int userId){
  if (!sUserManager.exists(userId)) {
    Log.e(TAG,"String_Node_Str" + userId);
    return;
  }
  mContext.enforceCallingOrSelfPermission(android.Manifest.permission.GRANT_RUNTIME_PERMISSIONS,"String_Node_Str");
  enforceCrossUserPermission(Binder.getCallingUid(),userId,true,false,"String_Node_Str");
  final int uid;
  final SettingBase sb;
synchronized (mPackages) {
    final PackageParser.Package pkg=mPackages.get(packageName);
    if (pkg == null) {
      throw new IllegalArgumentException("String_Node_Str" + packageName);
    }
    final BasePermission bp=mSettings.mPermissions.get(name);
    if (bp == null) {
      throw new IllegalArgumentException("String_Node_Str" + name);
    }
    enforceDeclaredAsUsedAndRuntimePermission(pkg,bp);
    uid=UserHandle.getUid(userId,pkg.applicationInfo.uid);
    sb=(SettingBase)pkg.mExtras;
    if (sb == null) {
      throw new IllegalArgumentException("String_Node_Str" + packageName);
    }
    final PermissionsState permissionsState=sb.getPermissionsState();
    final int flags=permissionsState.getPermissionFlags(name,userId);
    if ((flags & PackageManager.FLAG_PERMISSION_SYSTEM_FIXED) != 0) {
      throw new SecurityException("String_Node_Str" + name + "String_Node_Str"+ packageName);
    }
    final int result=permissionsState.grantRuntimePermission(bp,userId);
switch (result) {
case PermissionsState.PERMISSION_OPERATION_FAILURE:
{
        return;
      }
case PermissionsState.PERMISSION_OPERATION_SUCCESS_GIDS_CHANGED:
{
      final int appId=UserHandle.getAppId(pkg.applicationInfo.uid);
      mHandler.post(new Runnable(){
        @Override public void run(){
          killUid(appId,userId,KILL_APP_REASON_GIDS_CHANGED);
        }
      }
);
    }
  break;
}
mOnPermissionChangeListeners.onPermissionsChanged(uid);
mSettings.writeRuntimePermissionsForUserLPr(userId,false);
}
if (READ_EXTERNAL_STORAGE.equals(name) || WRITE_EXTERNAL_STORAGE.equals(name)) {
final long token=Binder.clearCallingIdentity();
try {
if (sUserManager.isInitialized(userId)) {
  MountServiceInternal mountServiceInternal=LocalServices.getService(MountServiceInternal.class);
  mountServiceInternal.onExternalStoragePolicyChanged(uid,packageName);
}
}
  finally {
Binder.restoreCallingIdentity(token);
}
}
}

Fixed version (ground truth):
@Override public void grantRuntimePermission(String packageName,String name,final int userId){
  if (!sUserManager.exists(userId)) {
    Log.e(TAG,"String_Node_Str" + userId);
    return;
  }
  mContext.enforceCallingOrSelfPermission(android.Manifest.permission.GRANT_RUNTIME_PERMISSIONS,"String_Node_Str");
  enforceCrossUserPermission(Binder.getCallingUid(),userId,true,false,"String_Node_Str");
  final int uid;
  final SettingBase sb;
synchronized (mPackages) {
    final PackageParser.Package pkg=mPackages.get(packageName);
    if (pkg == null) {
      throw new IllegalArgumentException("String_Node_Str" + packageName);
    }
    final BasePermission bp=mSettings.mPermissions.get(name);
    if (bp == null) {
      throw new IllegalArgumentException("String_Node_Str" + name);
    }
    enforceDeclaredAsUsedAndRuntimeOrDevelopmentPermission(pkg,bp);
    uid=UserHandle.getUid(userId,pkg.applicationInfo.uid);
    sb=(SettingBase)pkg.mExtras;
    if (sb == null) {
      throw new IllegalArgumentException("String_Node_Str" + packageName);
    }
    final PermissionsState permissionsState=sb.getPermissionsState();
    final int flags=permissionsState.getPermissionFlags(name,userId);
    if ((flags & PackageManager.FLAG_PERMISSION_SYSTEM_FIXED) != 0) {
      throw new SecurityException("String_Node_Str" + name + "String_Node_Str"+ packageName);
    }
    if (bp.isDevelopment()) {
      if (permissionsState.grantInstallPermission(bp) != PermissionsState.PERMISSION_OPERATION_FAILURE) {
        scheduleWriteSettingsLocked();
      }
      return;
    }
    final int result=permissionsState.grantRuntimePermission(bp,userId);
switch (result) {
case PermissionsState.PERMISSION_OPERATION_FAILURE:
{
        return;
      }
case PermissionsState.PERMISSION_OPERATION_SUCCESS_GIDS_CHANGED:
{
      final int appId=UserHandle.getAppId(pkg.applicationInfo.uid);
      mHandler.post(new Runnable(){
        @Override public void run(){
          killUid(appId,userId,KILL_APP_REASON_GIDS_CHANGED);
        }
      }
);
    }
  break;
}
mOnPermissionChangeListeners.onPermissionsChanged(uid);
mSettings.writeRuntimePermissionsForUserLPr(userId,false);
}
if (READ_EXTERNAL_STORAGE.equals(name) || WRITE_EXTERNAL_STORAGE.equals(name)) {
final long token=Binder.clearCallingIdentity();
try {
if (sUserManager.isInitialized(userId)) {
  MountServiceInternal mountServiceInternal=LocalServices.getService(MountServiceInternal.class);
  mountServiceInternal.onExternalStoragePolicyChanged(uid,packageName);
}
}
  finally {
Binder.restoreCallingIdentity(token);
}
}
}