Program: 198563
Project: 198563
Buggy source:
private boolean startUser(final int userId,boolean foreground){
  if (checkCallingPermission(INTERACT_ACROSS_USERS_FULL) != PackageManager.PERMISSION_GRANTED) {
    String msg="String_Node_Str" + Binder.getCallingPid() + "String_Node_Str"+ Binder.getCallingUid()+ "String_Node_Str"+ INTERACT_ACROSS_USERS_FULL;
    Slog.w(TAG,msg);
    throw new SecurityException(msg);
  }
  if (DEBUG_MU)   Slog.i(TAG_MU,"String_Node_Str" + userId + "String_Node_Str"+ foreground);
  final long ident=Binder.clearCallingIdentity();
  try {
synchronized (this) {
      final int oldUserId=mCurrentUserId;
      if (oldUserId == userId) {
        return true;
      }
      mStackSupervisor.setLockTaskModeLocked(null,false);
      final UserInfo userInfo=getUserManagerLocked().getUserInfo(userId);
      if (userInfo == null) {
        Slog.w(TAG,"String_Node_Str" + userId);
        return false;
      }
      if (foreground && userInfo.isManagedProfile()) {
        Slog.w(TAG,"String_Node_Str" + userId + "String_Node_Str");
        return false;
      }
      if (foreground) {
        mWindowManager.startFreezingScreen(R.anim.screen_user_exit,R.anim.screen_user_enter);
      }
      boolean needStart=false;
      if (mStartedUsers.get(userId) == null) {
        mStartedUsers.put(userId,new UserStartedState(new UserHandle(userId),false));
        updateStartedUserArrayLocked();
        needStart=true;
      }
      final Integer userIdInt=Integer.valueOf(userId);
      mUserLru.remove(userIdInt);
      mUserLru.add(userIdInt);
      if (foreground) {
        mCurrentUserId=userId;
        updateCurrentProfileIdsLocked();
        mWindowManager.setCurrentUser(userId,mCurrentProfileIds);
        mWindowManager.lockNow(null);
      }
 else {
        final Integer currentUserIdInt=Integer.valueOf(mCurrentUserId);
        updateCurrentProfileIdsLocked();
        mWindowManager.setCurrentProfileIds(mCurrentProfileIds);
        mUserLru.remove(currentUserIdInt);
        mUserLru.add(currentUserIdInt);
      }
      final UserStartedState uss=mStartedUsers.get(userId);
      if (uss.mState == UserStartedState.STATE_STOPPING) {
        uss.mState=UserStartedState.STATE_RUNNING;
        updateStartedUserArrayLocked();
        needStart=true;
      }
 else       if (uss.mState == UserStartedState.STATE_SHUTDOWN) {
        uss.mState=UserStartedState.STATE_BOOTING;
        updateStartedUserArrayLocked();
        needStart=true;
      }
      if (uss.mState == UserStartedState.STATE_BOOTING) {
        mHandler.sendMessage(mHandler.obtainMessage(SYSTEM_USER_START_MSG,userId));
      }
      if (foreground) {
        mHandler.sendMessage(mHandler.obtainMessage(SYSTEM_USER_CURRENT_MSG,userId,oldUserId));
        mHandler.removeMessages(REPORT_USER_SWITCH_MSG);
        mHandler.removeMessages(USER_SWITCH_TIMEOUT_MSG);
        mHandler.sendMessage(mHandler.obtainMessage(REPORT_USER_SWITCH_MSG,oldUserId,userId,uss));
        mHandler.sendMessageDelayed(mHandler.obtainMessage(USER_SWITCH_TIMEOUT_MSG,oldUserId,userId,uss),USER_SWITCH_TIMEOUT);
      }
      if (needStart) {
        Intent intent=new Intent(Intent.ACTION_USER_STARTED);
        intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY | Intent.FLAG_RECEIVER_FOREGROUND);
        intent.putExtra(Intent.EXTRA_USER_HANDLE,userId);
        broadcastIntentLocked(null,null,intent,null,null,0,null,null,null,AppOpsManager.OP_NONE,false,false,MY_PID,Process.SYSTEM_UID,userId);
      }
      if ((userInfo.flags & UserInfo.FLAG_INITIALIZED) == 0) {
        if (userId != UserHandle.USER_OWNER) {
          Intent intent=new Intent(Intent.ACTION_USER_INITIALIZE);
          intent.addFlags(Intent.FLAG_RECEIVER_FOREGROUND);
          broadcastIntentLocked(null,null,intent,null,new IIntentReceiver.Stub(){
            public void performReceive(            Intent intent,            int resultCode,            String data,            Bundle extras,            boolean ordered,            boolean sticky,            int sendingUser){
              userInitialized(uss,userId);
            }
          }
,0,null,null,null,AppOpsManager.OP_NONE,true,false,MY_PID,Process.SYSTEM_UID,userId);
          uss.initializing=true;
        }
 else {
          getUserManagerLocked().makeInitialized(userInfo.id);
        }
      }
      if (foreground) {
        boolean homeInFront=mStackSupervisor.switchUserLocked(userId,uss);
        if (homeInFront) {
          startHomeActivityLocked(userId);
        }
 else {
          mStackSupervisor.resumeTopActivitiesLocked();
        }
        EventLogTags.writeAmSwitchUser(userId);
        getUserManagerLocked().userForeground(userId);
        sendUserSwitchBroadcastsLocked(oldUserId,userId);
      }
 else {
        mStackSupervisor.startBackgroundUserLocked(userId,uss);
      }
      if (needStart) {
        Intent intent=new Intent(Intent.ACTION_USER_STARTING);
        intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY);
        intent.putExtra(Intent.EXTRA_USER_HANDLE,userId);
        broadcastIntentLocked(null,null,intent,null,new IIntentReceiver.Stub(){
          @Override public void performReceive(          Intent intent,          int resultCode,          String data,          Bundle extras,          boolean ordered,          boolean sticky,          int sendingUser) throws RemoteException {
          }
        }
,0,null,null,INTERACT_ACROSS_USERS,AppOpsManager.OP_NONE,true,false,MY_PID,Process.SYSTEM_UID,UserHandle.USER_ALL);
      }
    }
  }
  finally {
    Binder.restoreCallingIdentity(ident);
  }
  return true;
}

Fixed version (ground truth):
private boolean startUser(final int userId,boolean foreground){
  if (checkCallingPermission(INTERACT_ACROSS_USERS_FULL) != PackageManager.PERMISSION_GRANTED) {
    String msg="String_Node_Str" + Binder.getCallingPid() + "String_Node_Str"+ Binder.getCallingUid()+ "String_Node_Str"+ INTERACT_ACROSS_USERS_FULL;
    Slog.w(TAG,msg);
    throw new SecurityException(msg);
  }
  if (DEBUG_MU)   Slog.i(TAG_MU,"String_Node_Str" + userId + "String_Node_Str"+ foreground);
  final long ident=Binder.clearCallingIdentity();
  try {
synchronized (this) {
      final int oldUserId=mCurrentUserId;
      if (oldUserId == userId) {
        return true;
      }
      mStackSupervisor.setLockTaskModeLocked(null,false);
      final UserInfo userInfo=getUserManagerLocked().getUserInfo(userId);
      if (userInfo == null) {
        Slog.w(TAG,"String_Node_Str" + userId);
        return false;
      }
      if (foreground && userInfo.isManagedProfile()) {
        Slog.w(TAG,"String_Node_Str" + userId + "String_Node_Str");
        return false;
      }
      if (foreground) {
        mWindowManager.startFreezingScreen(R.anim.screen_user_exit,R.anim.screen_user_enter);
      }
      boolean needStart=false;
      if (mStartedUsers.get(userId) == null) {
        mStartedUsers.put(userId,new UserStartedState(new UserHandle(userId),false));
        updateStartedUserArrayLocked();
        needStart=true;
      }
      final Integer userIdInt=Integer.valueOf(userId);
      mUserLru.remove(userIdInt);
      mUserLru.add(userIdInt);
      if (foreground) {
        mCurrentUserId=userId;
        updateCurrentProfileIdsLocked();
        mWindowManager.setCurrentUser(userId,mCurrentProfileIds);
        mWindowManager.lockNow(null);
      }
 else {
        final Integer currentUserIdInt=Integer.valueOf(mCurrentUserId);
        updateCurrentProfileIdsLocked();
        mWindowManager.setCurrentProfileIds(mCurrentProfileIds);
        mUserLru.remove(currentUserIdInt);
        mUserLru.add(currentUserIdInt);
      }
      final UserStartedState uss=mStartedUsers.get(userId);
      if (uss.mState == UserStartedState.STATE_STOPPING) {
        uss.mState=UserStartedState.STATE_RUNNING;
        updateStartedUserArrayLocked();
        needStart=true;
      }
 else       if (uss.mState == UserStartedState.STATE_SHUTDOWN) {
        uss.mState=UserStartedState.STATE_BOOTING;
        updateStartedUserArrayLocked();
        needStart=true;
      }
      if (uss.mState == UserStartedState.STATE_BOOTING) {
        mHandler.sendMessage(mHandler.obtainMessage(SYSTEM_USER_START_MSG,userId,0));
      }
      if (foreground) {
        mHandler.sendMessage(mHandler.obtainMessage(SYSTEM_USER_CURRENT_MSG,userId,oldUserId));
        mHandler.removeMessages(REPORT_USER_SWITCH_MSG);
        mHandler.removeMessages(USER_SWITCH_TIMEOUT_MSG);
        mHandler.sendMessage(mHandler.obtainMessage(REPORT_USER_SWITCH_MSG,oldUserId,userId,uss));
        mHandler.sendMessageDelayed(mHandler.obtainMessage(USER_SWITCH_TIMEOUT_MSG,oldUserId,userId,uss),USER_SWITCH_TIMEOUT);
      }
      if (needStart) {
        Intent intent=new Intent(Intent.ACTION_USER_STARTED);
        intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY | Intent.FLAG_RECEIVER_FOREGROUND);
        intent.putExtra(Intent.EXTRA_USER_HANDLE,userId);
        broadcastIntentLocked(null,null,intent,null,null,0,null,null,null,AppOpsManager.OP_NONE,false,false,MY_PID,Process.SYSTEM_UID,userId);
      }
      if ((userInfo.flags & UserInfo.FLAG_INITIALIZED) == 0) {
        if (userId != UserHandle.USER_OWNER) {
          Intent intent=new Intent(Intent.ACTION_USER_INITIALIZE);
          intent.addFlags(Intent.FLAG_RECEIVER_FOREGROUND);
          broadcastIntentLocked(null,null,intent,null,new IIntentReceiver.Stub(){
            public void performReceive(            Intent intent,            int resultCode,            String data,            Bundle extras,            boolean ordered,            boolean sticky,            int sendingUser){
              userInitialized(uss,userId);
            }
          }
,0,null,null,null,AppOpsManager.OP_NONE,true,false,MY_PID,Process.SYSTEM_UID,userId);
          uss.initializing=true;
        }
 else {
          getUserManagerLocked().makeInitialized(userInfo.id);
        }
      }
      if (foreground) {
        boolean homeInFront=mStackSupervisor.switchUserLocked(userId,uss);
        if (homeInFront) {
          startHomeActivityLocked(userId);
        }
 else {
          mStackSupervisor.resumeTopActivitiesLocked();
        }
        EventLogTags.writeAmSwitchUser(userId);
        getUserManagerLocked().userForeground(userId);
        sendUserSwitchBroadcastsLocked(oldUserId,userId);
      }
 else {
        mStackSupervisor.startBackgroundUserLocked(userId,uss);
      }
      if (needStart) {
        Intent intent=new Intent(Intent.ACTION_USER_STARTING);
        intent.addFlags(Intent.FLAG_RECEIVER_REGISTERED_ONLY);
        intent.putExtra(Intent.EXTRA_USER_HANDLE,userId);
        broadcastIntentLocked(null,null,intent,null,new IIntentReceiver.Stub(){
          @Override public void performReceive(          Intent intent,          int resultCode,          String data,          Bundle extras,          boolean ordered,          boolean sticky,          int sendingUser) throws RemoteException {
          }
        }
,0,null,null,INTERACT_ACROSS_USERS,AppOpsManager.OP_NONE,true,false,MY_PID,Process.SYSTEM_UID,UserHandle.USER_ALL);
      }
    }
  }
  finally {
    Binder.restoreCallingIdentity(ident);
  }
  return true;
}