Program: 99
Project: 99
Buggy source:
final void finishBooting(){
  IntentFilter pkgFilter=new IntentFilter();
  pkgFilter.addAction(Intent.ACTION_QUERY_PACKAGE_RESTART);
  pkgFilter.addDataScheme("String_Node_Str");
  mContext.registerReceiver(new BroadcastReceiver(){
    @Override public void onReceive(    Context context,    Intent intent){
      String[] pkgs=intent.getStringArrayExtra(Intent.EXTRA_PACKAGES);
      if (pkgs != null) {
        for (        String pkg : pkgs) {
synchronized (ActivityManagerService.this) {
            if (forceStopPackageLocked(pkg,-1,false,false,false,false,0,"String_Node_Str")) {
              setResultCode(Activity.RESULT_OK);
              return;
            }
          }
        }
      }
    }
  }
,pkgFilter);
synchronized (this) {
    final int NP=mProcessesOnHold.size();
    if (NP > 0) {
      ArrayList<ProcessRecord> procs=new ArrayList<ProcessRecord>(mProcessesOnHold);
      for (int ip=0; ip < NP; ip++) {
        if (DEBUG_PROCESSES)         Slog.v(TAG,"String_Node_Str" + procs.get(ip));
        startProcessLocked(procs.get(ip),"String_Node_Str",null);
      }
    }
    if (mFactoryTest != SystemServer.FACTORY_TEST_LOW_LEVEL) {
      Message nmsg=mHandler.obtainMessage(CHECK_EXCESSIVE_WAKE_LOCKS_MSG);
      mHandler.sendMessageDelayed(nmsg,POWER_CHECK_DELAY);
      SystemProperties.set("String_Node_Str","String_Node_Str");
      SystemProperties.set("String_Node_Str","String_Node_Str");
      for (int i=0; i < mStartedUsers.size(); i++) {
        UserStartedState uss=mStartedUsers.valueAt(i);
        if (uss.mState == UserStartedState.STATE_BOOTING) {
          uss.mState=UserStartedState.STATE_RUNNING;
          final int userId=mStartedUsers.keyAt(i);
          Intent intent=new Intent(Intent.ACTION_BOOT_COMPLETED,null);
          intent.putExtra(Intent.EXTRA_USER_HANDLE,userId);
          intent.addFlags(Intent.FLAG_RECEIVER_NO_ABORT);
          broadcastIntentLocked(null,null,intent,null,new IIntentReceiver.Stub(){
            @Override public void performReceive(            Intent intent,            int resultCode,            String data,            Bundle extras,            boolean ordered,            boolean sticky,            int sendingUser){
synchronized (ActivityManagerService.this) {
                requestPssAllProcsLocked(SystemClock.uptimeMillis(),true,false);
              }
            }
          }
,0,null,null,android.Manifest.permission.RECEIVE_BOOT_COMPLETED,AppOpsManager.OP_NONE,true,false,MY_PID,Process.SYSTEM_UID,userId);
        }
      }
    }
  }
}

Fixed version (ground truth):
final void finishBooting(){
  IntentFilter pkgFilter=new IntentFilter();
  pkgFilter.addAction(Intent.ACTION_QUERY_PACKAGE_RESTART);
  pkgFilter.addDataScheme("String_Node_Str");
  mContext.registerReceiver(new BroadcastReceiver(){
    @Override public void onReceive(    Context context,    Intent intent){
      String[] pkgs=intent.getStringArrayExtra(Intent.EXTRA_PACKAGES);
      if (pkgs != null) {
        for (        String pkg : pkgs) {
synchronized (ActivityManagerService.this) {
            if (forceStopPackageLocked(pkg,-1,false,false,false,false,false,0,"String_Node_Str")) {
              setResultCode(Activity.RESULT_OK);
              return;
            }
          }
        }
      }
    }
  }
,pkgFilter);
synchronized (this) {
    final int NP=mProcessesOnHold.size();
    if (NP > 0) {
      ArrayList<ProcessRecord> procs=new ArrayList<ProcessRecord>(mProcessesOnHold);
      for (int ip=0; ip < NP; ip++) {
        if (DEBUG_PROCESSES)         Slog.v(TAG,"String_Node_Str" + procs.get(ip));
        startProcessLocked(procs.get(ip),"String_Node_Str",null);
      }
    }
    if (mFactoryTest != SystemServer.FACTORY_TEST_LOW_LEVEL) {
      Message nmsg=mHandler.obtainMessage(CHECK_EXCESSIVE_WAKE_LOCKS_MSG);
      mHandler.sendMessageDelayed(nmsg,POWER_CHECK_DELAY);
      SystemProperties.set("String_Node_Str","String_Node_Str");
      SystemProperties.set("String_Node_Str","String_Node_Str");
      for (int i=0; i < mStartedUsers.size(); i++) {
        UserStartedState uss=mStartedUsers.valueAt(i);
        if (uss.mState == UserStartedState.STATE_BOOTING) {
          uss.mState=UserStartedState.STATE_RUNNING;
          final int userId=mStartedUsers.keyAt(i);
          Intent intent=new Intent(Intent.ACTION_BOOT_COMPLETED,null);
          intent.putExtra(Intent.EXTRA_USER_HANDLE,userId);
          intent.addFlags(Intent.FLAG_RECEIVER_NO_ABORT);
          broadcastIntentLocked(null,null,intent,null,new IIntentReceiver.Stub(){
            @Override public void performReceive(            Intent intent,            int resultCode,            String data,            Bundle extras,            boolean ordered,            boolean sticky,            int sendingUser){
synchronized (ActivityManagerService.this) {
                requestPssAllProcsLocked(SystemClock.uptimeMillis(),true,false);
              }
            }
          }
,0,null,null,android.Manifest.permission.RECEIVE_BOOT_COMPLETED,AppOpsManager.OP_NONE,true,false,MY_PID,Process.SYSTEM_UID,userId);
        }
      }
    }
  }
}