Program: 197021
Project: 197021
Buggy source:
final int startActivityMayWait(IApplicationThread caller,int callingUid,String callingPackage,Intent intent,String resolvedType,IVoiceInteractionSession voiceSession,IVoiceInteractor voiceInteractor,IBinder resultTo,String resultWho,int requestCode,int startFlags,ProfilerInfo profilerInfo,WaitResult outResult,Configuration config,Bundle options,int userId,IActivityContainer iContainer,TaskRecord inTask){
  if (intent != null && intent.hasFileDescriptors()) {
    throw new IllegalArgumentException("String_Node_Str");
  }
  boolean componentSpecified=intent.getComponent() != null;
  intent=new Intent(intent);
  ActivityInfo aInfo=resolveActivity(intent,resolvedType,startFlags,profilerInfo,userId);
  ActivityContainer container=(ActivityContainer)iContainer;
synchronized (mService) {
    final int realCallingPid=Binder.getCallingPid();
    final int realCallingUid=Binder.getCallingUid();
    int callingPid;
    if (callingUid >= 0) {
      callingPid=-1;
    }
 else     if (caller == null) {
      callingPid=realCallingPid;
      callingUid=realCallingUid;
    }
 else {
      callingPid=callingUid=-1;
    }
    final ActivityStack stack;
    if (container == null || container.mStack.isOnHomeDisplay()) {
      stack=getFocusedStack();
    }
 else {
      stack=container.mStack;
    }
    stack.mConfigWillChange=config != null && mService.mConfiguration.diff(config) != 0;
    if (DEBUG_CONFIGURATION)     Slog.v(TAG,"String_Node_Str" + stack.mConfigWillChange);
    final long origId=Binder.clearCallingIdentity();
    if (aInfo != null && (aInfo.applicationInfo.flags & ApplicationInfo.FLAG_CANT_SAVE_STATE) != 0) {
      if (aInfo.processName.equals(aInfo.applicationInfo.packageName)) {
        if (mService.mHeavyWeightProcess != null && (mService.mHeavyWeightProcess.info.uid != aInfo.applicationInfo.uid || !mService.mHeavyWeightProcess.processName.equals(aInfo.processName))) {
          int appCallingUid=callingUid;
          if (caller != null) {
            ProcessRecord callerApp=mService.getRecordForAppLocked(caller);
            if (callerApp != null) {
              appCallingUid=callerApp.info.uid;
            }
 else {
              Slog.w(TAG,"String_Node_Str" + caller + "String_Node_Str"+ callingPid+ "String_Node_Str"+ intent.toString());
              ActivityOptions.abort(options);
              return ActivityManager.START_PERMISSION_DENIED;
            }
          }
          IIntentSender target=mService.getIntentSenderLocked(ActivityManager.INTENT_SENDER_ACTIVITY,"String_Node_Str",appCallingUid,userId,null,null,0,new Intent[]{intent},new String[]{resolvedType},PendingIntent.FLAG_CANCEL_CURRENT | PendingIntent.FLAG_ONE_SHOT,null);
          Intent newIntent=new Intent();
          if (requestCode >= 0) {
            newIntent.putExtra(HeavyWeightSwitcherActivity.KEY_HAS_RESULT,true);
          }
          newIntent.putExtra(HeavyWeightSwitcherActivity.KEY_INTENT,new IntentSender(target));
          if (mService.mHeavyWeightProcess.activities.size() > 0) {
            ActivityRecord hist=mService.mHeavyWeightProcess.activities.get(0);
            newIntent.putExtra(HeavyWeightSwitcherActivity.KEY_CUR_APP,hist.packageName);
            newIntent.putExtra(HeavyWeightSwitcherActivity.KEY_CUR_TASK,hist.task.taskId);
          }
          newIntent.putExtra(HeavyWeightSwitcherActivity.KEY_NEW_APP,aInfo.packageName);
          newIntent.setFlags(intent.getFlags());
          newIntent.setClassName("String_Node_Str",HeavyWeightSwitcherActivity.class.getName());
          intent=newIntent;
          resolvedType=null;
          caller=null;
          callingUid=Binder.getCallingUid();
          callingPid=Binder.getCallingPid();
          componentSpecified=true;
          try {
            ResolveInfo rInfo=AppGlobals.getPackageManager().resolveIntent(intent,null,PackageManager.MATCH_DEFAULT_ONLY | ActivityManagerService.STOCK_PM_FLAGS,userId);
            aInfo=rInfo != null ? rInfo.activityInfo : null;
            aInfo=mService.getActivityInfoForUser(aInfo,userId);
          }
 catch (          RemoteException e) {
            aInfo=null;
          }
        }
      }
    }
    int res=startActivityLocked(caller,intent,resolvedType,aInfo,voiceSession,voiceInteractor,resultTo,resultWho,requestCode,callingPid,callingUid,callingPackage,realCallingPid,realCallingUid,startFlags,options,componentSpecified,null,container,inTask);
    Binder.restoreCallingIdentity(origId);
    if (stack.mConfigWillChange) {
      mService.enforceCallingPermission(android.Manifest.permission.CHANGE_CONFIGURATION,"String_Node_Str");
      stack.mConfigWillChange=false;
      if (DEBUG_CONFIGURATION)       Slog.v(TAG,"String_Node_Str");
      mService.updateConfigurationLocked(config,null,false,false);
    }
    if (outResult != null) {
      outResult.result=res;
      if (res == ActivityManager.START_SUCCESS) {
        mWaitingActivityLaunched.add(outResult);
        do {
          try {
            mService.wait();
          }
 catch (          InterruptedException e) {
          }
        }
 while (!outResult.timeout && outResult.who == null);
      }
 else       if (res == ActivityManager.START_TASK_TO_FRONT) {
        ActivityRecord r=stack.topRunningActivityLocked(null);
        if (r.nowVisible) {
          outResult.timeout=false;
          outResult.who=new ComponentName(r.info.packageName,r.info.name);
          outResult.totalTime=0;
          outResult.thisTime=0;
        }
 else {
          outResult.thisTime=SystemClock.uptimeMillis();
          mWaitingActivityVisible.add(outResult);
          do {
            try {
              mService.wait();
            }
 catch (            InterruptedException e) {
            }
          }
 while (!outResult.timeout && outResult.who == null);
        }
      }
    }
    return res;
  }
}

Fixed version (ground truth):
final int startActivityMayWait(IApplicationThread caller,int callingUid,String callingPackage,Intent intent,String resolvedType,IVoiceInteractionSession voiceSession,IVoiceInteractor voiceInteractor,IBinder resultTo,String resultWho,int requestCode,int startFlags,ProfilerInfo profilerInfo,WaitResult outResult,Configuration config,Bundle options,int userId,IActivityContainer iContainer,TaskRecord inTask){
  if (intent != null && intent.hasFileDescriptors()) {
    throw new IllegalArgumentException("String_Node_Str");
  }
  boolean componentSpecified=intent.getComponent() != null;
  intent=new Intent(intent);
  ActivityInfo aInfo=resolveActivity(intent,resolvedType,startFlags,profilerInfo,userId);
  ActivityContainer container=(ActivityContainer)iContainer;
synchronized (mService) {
    final int realCallingPid=Binder.getCallingPid();
    final int realCallingUid=Binder.getCallingUid();
    int callingPid;
    if (callingUid >= 0) {
      callingPid=-1;
    }
 else     if (caller == null) {
      callingPid=realCallingPid;
      callingUid=realCallingUid;
    }
 else {
      callingPid=callingUid=-1;
    }
    final ActivityStack stack;
    if (container == null || container.mStack.isOnHomeDisplay()) {
      stack=getFocusedStack();
    }
 else {
      stack=container.mStack;
    }
    stack.mConfigWillChange=config != null && mService.mConfiguration.diff(config) != 0;
    if (DEBUG_CONFIGURATION)     Slog.v(TAG,"String_Node_Str" + stack.mConfigWillChange);
    final long origId=Binder.clearCallingIdentity();
    if (aInfo != null && (aInfo.applicationInfo.flags & ApplicationInfo.FLAG_CANT_SAVE_STATE) != 0) {
      if (aInfo.processName.equals(aInfo.applicationInfo.packageName)) {
        if (mService.mHeavyWeightProcess != null && (mService.mHeavyWeightProcess.info.uid != aInfo.applicationInfo.uid || !mService.mHeavyWeightProcess.processName.equals(aInfo.processName))) {
          int appCallingUid=callingUid;
          if (caller != null) {
            ProcessRecord callerApp=mService.getRecordForAppLocked(caller);
            if (callerApp != null) {
              appCallingUid=callerApp.info.uid;
            }
 else {
              Slog.w(TAG,"String_Node_Str" + caller + "String_Node_Str"+ callingPid+ "String_Node_Str"+ intent.toString());
              ActivityOptions.abort(options);
              return ActivityManager.START_PERMISSION_DENIED;
            }
          }
          IIntentSender target=mService.getIntentSenderLocked(ActivityManager.INTENT_SENDER_ACTIVITY,"String_Node_Str",appCallingUid,userId,null,null,0,new Intent[]{intent},new String[]{resolvedType},PendingIntent.FLAG_CANCEL_CURRENT | PendingIntent.FLAG_ONE_SHOT,null);
          Intent newIntent=new Intent();
          if (requestCode >= 0) {
            newIntent.putExtra(HeavyWeightSwitcherActivity.KEY_HAS_RESULT,true);
          }
          newIntent.putExtra(HeavyWeightSwitcherActivity.KEY_INTENT,new IntentSender(target));
          if (mService.mHeavyWeightProcess.activities.size() > 0) {
            ActivityRecord hist=mService.mHeavyWeightProcess.activities.get(0);
            newIntent.putExtra(HeavyWeightSwitcherActivity.KEY_CUR_APP,hist.packageName);
            newIntent.putExtra(HeavyWeightSwitcherActivity.KEY_CUR_TASK,hist.task.taskId);
          }
          newIntent.putExtra(HeavyWeightSwitcherActivity.KEY_NEW_APP,aInfo.packageName);
          newIntent.setFlags(intent.getFlags());
          newIntent.setClassName("String_Node_Str",HeavyWeightSwitcherActivity.class.getName());
          intent=newIntent;
          resolvedType=null;
          caller=null;
          callingUid=Binder.getCallingUid();
          callingPid=Binder.getCallingPid();
          componentSpecified=true;
          try {
            ResolveInfo rInfo=AppGlobals.getPackageManager().resolveIntent(intent,null,PackageManager.MATCH_DEFAULT_ONLY | ActivityManagerService.STOCK_PM_FLAGS,userId);
            aInfo=rInfo != null ? rInfo.activityInfo : null;
            aInfo=mService.getActivityInfoForUser(aInfo,userId);
          }
 catch (          RemoteException e) {
            aInfo=null;
          }
        }
      }
    }
    int res=startActivityLocked(caller,intent,resolvedType,aInfo,voiceSession,voiceInteractor,resultTo,resultWho,requestCode,callingPid,callingUid,callingPackage,realCallingPid,realCallingUid,startFlags,options,componentSpecified,null,container,inTask);
    Binder.restoreCallingIdentity(origId);
    if (stack.mConfigWillChange) {
      mService.enforceCallingPermission(android.Manifest.permission.CHANGE_CONFIGURATION,"String_Node_Str");
      stack.mConfigWillChange=false;
      if (DEBUG_CONFIGURATION)       Slog.v(TAG,"String_Node_Str");
      mService.updateConfigurationLocked(config,null,false,false);
    }
    if (outResult != null) {
      outResult.result=res;
      if (res == ActivityManager.START_SUCCESS) {
        mWaitingActivityLaunched.add(outResult);
        do {
          try {
            mService.wait();
          }
 catch (          InterruptedException e) {
          }
        }
 while (!outResult.timeout && outResult.who == null);
      }
 else       if (res == ActivityManager.START_TASK_TO_FRONT) {
        ActivityRecord r=stack.topRunningActivityLocked(null);
        if (r.nowVisible && r.state == ActivityState.RESUMED) {
          outResult.timeout=false;
          outResult.who=new ComponentName(r.info.packageName,r.info.name);
          outResult.totalTime=0;
          outResult.thisTime=0;
        }
 else {
          outResult.thisTime=SystemClock.uptimeMillis();
          mWaitingActivityVisible.add(outResult);
          do {
            try {
              mService.wait();
            }
 catch (            InterruptedException e) {
            }
          }
 while (!outResult.timeout && outResult.who == null);
        }
      }
    }
    return res;
  }
}