Program: 660
Project: 660
Buggy source:
public Intent registerReceiver(IApplicationThread caller,String callerPackage,IIntentReceiver receiver,IntentFilter filter,String permission,int userId){
  enforceNotIsolatedCaller("String_Node_Str");
  int callingUid;
  int callingPid;
synchronized (this) {
    ProcessRecord callerApp=null;
    if (caller != null) {
      callerApp=getRecordForAppLocked(caller);
      if (callerApp == null) {
        throw new SecurityException("String_Node_Str" + caller + "String_Node_Str"+ Binder.getCallingPid()+ "String_Node_Str"+ receiver);
      }
      if (callerApp.info.uid != Process.SYSTEM_UID && !callerApp.pkgList.containsKey(callerPackage)) {
        throw new SecurityException("String_Node_Str" + callerPackage + "String_Node_Str"+ callerApp);
      }
      callingUid=callerApp.info.uid;
      callingPid=callerApp.pid;
    }
 else {
      callerPackage=null;
      callingUid=Binder.getCallingUid();
      callingPid=Binder.getCallingPid();
    }
    userId=this.handleIncomingUser(callingPid,callingUid,userId,true,true,"String_Node_Str",callerPackage);
    List allSticky=null;
    Iterator actions=filter.actionsIterator();
    if (actions != null) {
      while (actions.hasNext()) {
        String action=(String)actions.next();
        allSticky=getStickiesLocked(action,filter,allSticky,UserHandle.USER_ALL);
        allSticky=getStickiesLocked(action,filter,allSticky,UserHandle.getUserId(callingUid));
      }
    }
 else {
      allSticky=getStickiesLocked(null,filter,allSticky,UserHandle.USER_ALL);
      allSticky=getStickiesLocked(null,filter,allSticky,UserHandle.getUserId(callingUid));
    }
    Intent sticky=allSticky != null ? (Intent)allSticky.get(0) : null;
    if (DEBUG_BROADCAST)     Slog.v(TAG,"String_Node_Str" + filter + "String_Node_Str"+ sticky);
    if (receiver == null) {
      return sticky;
    }
    ReceiverList rl=(ReceiverList)mRegisteredReceivers.get(receiver.asBinder());
    if (rl == null) {
      rl=new ReceiverList(this,callerApp,callingPid,callingUid,userId,receiver);
      if (rl.app != null) {
        rl.app.receivers.add(rl);
      }
 else {
        try {
          receiver.asBinder().linkToDeath(rl,0);
        }
 catch (        RemoteException e) {
          return sticky;
        }
        rl.linkedToDeath=true;
      }
      mRegisteredReceivers.put(receiver.asBinder(),rl);
    }
 else     if (rl.uid != callingUid) {
      throw new IllegalArgumentException("String_Node_Str" + callingUid + "String_Node_Str"+ rl.uid);
    }
 else     if (rl.pid != callingPid) {
      throw new IllegalArgumentException("String_Node_Str" + callingPid + "String_Node_Str"+ rl.pid);
    }
 else     if (rl.userId != userId) {
      throw new IllegalArgumentException("String_Node_Str" + userId + "String_Node_Str"+ rl.userId);
    }
    BroadcastFilter bf=new BroadcastFilter(filter,rl,callerPackage,permission,callingUid,userId);
    rl.add(bf);
    if (!bf.debugCheck()) {
      Slog.w(TAG,"String_Node_Str");
    }
    mReceiverResolver.addFilter(bf);
    if (allSticky != null) {
      ArrayList receivers=new ArrayList();
      receivers.add(bf);
      int N=allSticky.size();
      for (int i=0; i < N; i++) {
        Intent intent=(Intent)allSticky.get(i);
        BroadcastQueue queue=broadcastQueueForIntent(intent);
        BroadcastRecord r=new BroadcastRecord(queue,intent,null,null,-1,-1,null,null,AppOpsManager.OP_NONE,receivers,null,0,null,null,false,true,true,-1);
        queue.enqueueParallelBroadcastLocked(r);
        queue.scheduleBroadcastsLocked();
      }
    }
    return sticky;
  }
}

Fixed version (ground truth):
public Intent registerReceiver(IApplicationThread caller,String callerPackage,IIntentReceiver receiver,IntentFilter filter,String permission,int userId){
  enforceNotIsolatedCaller("String_Node_Str");
  int callingUid;
  int callingPid;
synchronized (this) {
    ProcessRecord callerApp=null;
    if (caller != null) {
      callerApp=getRecordForAppLocked(caller);
      if (callerApp == null) {
        throw new SecurityException("String_Node_Str" + caller + "String_Node_Str"+ Binder.getCallingPid()+ "String_Node_Str"+ receiver);
      }
      if (callerApp.info.uid != Process.SYSTEM_UID && !callerApp.pkgList.containsKey(callerPackage) && !"String_Node_Str".equals(callerPackage)) {
        throw new SecurityException("String_Node_Str" + callerPackage + "String_Node_Str"+ callerApp);
      }
      callingUid=callerApp.info.uid;
      callingPid=callerApp.pid;
    }
 else {
      callerPackage=null;
      callingUid=Binder.getCallingUid();
      callingPid=Binder.getCallingPid();
    }
    userId=this.handleIncomingUser(callingPid,callingUid,userId,true,true,"String_Node_Str",callerPackage);
    List allSticky=null;
    Iterator actions=filter.actionsIterator();
    if (actions != null) {
      while (actions.hasNext()) {
        String action=(String)actions.next();
        allSticky=getStickiesLocked(action,filter,allSticky,UserHandle.USER_ALL);
        allSticky=getStickiesLocked(action,filter,allSticky,UserHandle.getUserId(callingUid));
      }
    }
 else {
      allSticky=getStickiesLocked(null,filter,allSticky,UserHandle.USER_ALL);
      allSticky=getStickiesLocked(null,filter,allSticky,UserHandle.getUserId(callingUid));
    }
    Intent sticky=allSticky != null ? (Intent)allSticky.get(0) : null;
    if (DEBUG_BROADCAST)     Slog.v(TAG,"String_Node_Str" + filter + "String_Node_Str"+ sticky);
    if (receiver == null) {
      return sticky;
    }
    ReceiverList rl=(ReceiverList)mRegisteredReceivers.get(receiver.asBinder());
    if (rl == null) {
      rl=new ReceiverList(this,callerApp,callingPid,callingUid,userId,receiver);
      if (rl.app != null) {
        rl.app.receivers.add(rl);
      }
 else {
        try {
          receiver.asBinder().linkToDeath(rl,0);
        }
 catch (        RemoteException e) {
          return sticky;
        }
        rl.linkedToDeath=true;
      }
      mRegisteredReceivers.put(receiver.asBinder(),rl);
    }
 else     if (rl.uid != callingUid) {
      throw new IllegalArgumentException("String_Node_Str" + callingUid + "String_Node_Str"+ rl.uid);
    }
 else     if (rl.pid != callingPid) {
      throw new IllegalArgumentException("String_Node_Str" + callingPid + "String_Node_Str"+ rl.pid);
    }
 else     if (rl.userId != userId) {
      throw new IllegalArgumentException("String_Node_Str" + userId + "String_Node_Str"+ rl.userId);
    }
    BroadcastFilter bf=new BroadcastFilter(filter,rl,callerPackage,permission,callingUid,userId);
    rl.add(bf);
    if (!bf.debugCheck()) {
      Slog.w(TAG,"String_Node_Str");
    }
    mReceiverResolver.addFilter(bf);
    if (allSticky != null) {
      ArrayList receivers=new ArrayList();
      receivers.add(bf);
      int N=allSticky.size();
      for (int i=0; i < N; i++) {
        Intent intent=(Intent)allSticky.get(i);
        BroadcastQueue queue=broadcastQueueForIntent(intent);
        BroadcastRecord r=new BroadcastRecord(queue,intent,null,null,-1,-1,null,null,AppOpsManager.OP_NONE,receivers,null,0,null,null,false,true,true,-1);
        queue.enqueueParallelBroadcastLocked(r);
        queue.scheduleBroadcastsLocked();
      }
    }
    return sticky;
  }
}