Program: 196088
Project: 196088
Buggy source:
@Override public boolean clearApplicationUserData(final String packageName,final IPackageDataObserver observer,int userId){
  enforceNotIsolatedCaller("String_Node_Str");
  int uid=Binder.getCallingUid();
  int pid=Binder.getCallingPid();
  userId=handleIncomingUser(pid,uid,userId,false,ALLOW_FULL_ONLY,"String_Node_Str",null);
  long callingId=Binder.clearCallingIdentity();
  try {
    IPackageManager pm=AppGlobals.getPackageManager();
    int pkgUid=-1;
synchronized (this) {
      try {
        pkgUid=pm.getPackageUid(packageName,userId);
      }
 catch (      RemoteException e) {
      }
      if (pkgUid == -1) {
        Slog.w(TAG,"String_Node_Str" + packageName);
        if (observer != null) {
          try {
            observer.onRemoveCompleted(packageName,false);
          }
 catch (          RemoteException e) {
            Slog.i(TAG,"String_Node_Str");
          }
        }
        return false;
      }
      if (uid == pkgUid || checkComponentPermission(android.Manifest.permission.CLEAR_APP_USER_DATA,pid,uid,-1,true) == PackageManager.PERMISSION_GRANTED) {
        forceStopPackageLocked(packageName,pkgUid,"String_Node_Str");
      }
 else {
        throw new SecurityException("String_Node_Str" + pid + "String_Node_Str"+ android.Manifest.permission.CLEAR_APP_USER_DATA+ "String_Node_Str"+ "String_Node_Str"+ packageName);
      }
      for (int i=mRecentTasks.size() - 1; i >= 0; i--) {
        final TaskRecord tr=mRecentTasks.get(i);
        final String taskPackageName=tr.getBaseIntent().getComponent().getPackageName();
        if (tr.userId != userId)         continue;
        if (!taskPackageName.equals(packageName))         continue;
        removeTaskByIdLocked(tr.taskId,0);
      }
    }
    try {
      pm.clearApplicationUserData(packageName,observer,userId);
synchronized (this) {
        removeUriPermissionsForPackageLocked(packageName,userId,true);
      }
      Intent intent=new Intent(Intent.ACTION_PACKAGE_DATA_CLEARED,Uri.fromParts("String_Node_Str",packageName,null));
      intent.putExtra(Intent.EXTRA_UID,pkgUid);
      broadcastIntentInPackage("String_Node_Str",Process.SYSTEM_UID,intent,null,null,0,null,null,null,false,false,userId);
    }
 catch (    RemoteException e) {
    }
  }
  finally {
    Binder.restoreCallingIdentity(callingId);
  }
  return true;
}

Fixed version (ground truth):
@Override public boolean clearApplicationUserData(final String packageName,final IPackageDataObserver observer,int userId){
  enforceNotIsolatedCaller("String_Node_Str");
  int uid=Binder.getCallingUid();
  int pid=Binder.getCallingPid();
  userId=handleIncomingUser(pid,uid,userId,false,ALLOW_FULL_ONLY,"String_Node_Str",null);
  long callingId=Binder.clearCallingIdentity();
  try {
    IPackageManager pm=AppGlobals.getPackageManager();
    int pkgUid=-1;
synchronized (this) {
      try {
        pkgUid=pm.getPackageUid(packageName,userId);
      }
 catch (      RemoteException e) {
      }
      if (pkgUid == -1) {
        Slog.w(TAG,"String_Node_Str" + packageName);
        if (observer != null) {
          try {
            observer.onRemoveCompleted(packageName,false);
          }
 catch (          RemoteException e) {
            Slog.i(TAG,"String_Node_Str");
          }
        }
        return false;
      }
      if (uid == pkgUid || checkComponentPermission(android.Manifest.permission.CLEAR_APP_USER_DATA,pid,uid,-1,true) == PackageManager.PERMISSION_GRANTED) {
        forceStopPackageLocked(packageName,pkgUid,"String_Node_Str");
      }
 else {
        throw new SecurityException("String_Node_Str" + pid + "String_Node_Str"+ android.Manifest.permission.CLEAR_APP_USER_DATA+ "String_Node_Str"+ "String_Node_Str"+ packageName);
      }
      for (int i=mRecentTasks.size() - 1; i >= 0; i--) {
        final TaskRecord tr=mRecentTasks.get(i);
        final String taskPackageName=tr.getBaseIntent().getComponent().getPackageName();
        if (tr.userId != userId)         continue;
        if (!taskPackageName.equals(packageName))         continue;
        removeTaskByIdLocked(tr.taskId,false);
      }
    }
    try {
      pm.clearApplicationUserData(packageName,observer,userId);
synchronized (this) {
        removeUriPermissionsForPackageLocked(packageName,userId,true);
      }
      Intent intent=new Intent(Intent.ACTION_PACKAGE_DATA_CLEARED,Uri.fromParts("String_Node_Str",packageName,null));
      intent.putExtra(Intent.EXTRA_UID,pkgUid);
      broadcastIntentInPackage("String_Node_Str",Process.SYSTEM_UID,intent,null,null,0,null,null,null,false,false,userId);
    }
 catch (    RemoteException e) {
    }
  }
  finally {
    Binder.restoreCallingIdentity(callingId);
  }
  return true;
}