Program: 22256
Project: 22256
Buggy source:
private void replaceNonSystemPackageLI(PackageParser.Package deletedPackage,PackageParser.Package pkg,int parseFlags,int scanMode,String installerPackageName,PackageInstalledInfo res){
  PackageParser.Package newPackage=null;
  String pkgName=deletedPackage.packageName;
  boolean deletedPkg=true;
  boolean updatedSettings=false;
  String oldInstallerPackageName=null;
synchronized (mPackages) {
    oldInstallerPackageName=mSettings.getInstallerPackageName(pkgName);
  }
  if (!deletePackageLI(pkgName,true,PackageManager.DONT_DELETE_DATA,res.removedInfo)) {
    res.returnCode=PackageManager.INSTALL_FAILED_REPLACE_COULDNT_DELETE;
    deletedPkg=false;
  }
 else {
    mLastScanError=PackageManager.INSTALL_SUCCEEDED;
    newPackage=scanPackageLI(pkg,parseFlags,scanMode);
    if (newPackage == null) {
      Slog.w(TAG,"String_Node_Str" + pkg.mPath);
      if ((res.returnCode=mLastScanError) == PackageManager.INSTALL_SUCCEEDED) {
        res.returnCode=PackageManager.INSTALL_FAILED_INVALID_APK;
      }
    }
 else {
      updateSettingsLI(newPackage,installerPackageName,res);
      updatedSettings=true;
    }
  }
  if (res.returnCode != PackageManager.INSTALL_SUCCEEDED) {
    if (updatedSettings) {
      deletePackageLI(pkgName,true,PackageManager.DONT_DELETE_DATA,res.removedInfo);
    }
    if (deletedPkg) {
      File restoreFile=new File(deletedPackage.mPath);
      if (restoreFile == null) {
        Slog.e(TAG,"String_Node_Str" + pkgName);
        return;
      }
      boolean oldOnSd=isExternal(deletedPackage);
      int oldParseFlags=mDefParseFlags | PackageParser.PARSE_CHATTY | (isForwardLocked(deletedPackage) ? PackageParser.PARSE_FORWARD_LOCK : 0)| (oldOnSd ? PackageParser.PARSE_ON_SDCARD : 0);
      int oldScanMode=(oldOnSd ? 0 : SCAN_MONITOR) | SCAN_UPDATE_SIGNATURE;
      if (scanPackageLI(restoreFile,oldParseFlags,oldScanMode) == null) {
        Slog.e(TAG,"String_Node_Str" + pkgName + "String_Node_Str");
        return;
      }
synchronized (mPackages) {
        updatePermissionsLP(deletedPackage.packageName,deletedPackage,true,false);
        mSettings.writeLP();
      }
      Slog.i(TAG,"String_Node_Str" + pkgName + "String_Node_Str");
    }
  }
}

Fixed version (ground truth):
private void replaceNonSystemPackageLI(PackageParser.Package deletedPackage,PackageParser.Package pkg,int parseFlags,int scanMode,String installerPackageName,PackageInstalledInfo res){
  PackageParser.Package newPackage=null;
  String pkgName=deletedPackage.packageName;
  boolean deletedPkg=true;
  boolean updatedSettings=false;
  String oldInstallerPackageName=null;
synchronized (mPackages) {
    oldInstallerPackageName=mSettings.getInstallerPackageName(pkgName);
  }
  if (!deletePackageLI(pkgName,true,PackageManager.DONT_DELETE_DATA,res.removedInfo)) {
    res.returnCode=PackageManager.INSTALL_FAILED_REPLACE_COULDNT_DELETE;
    deletedPkg=false;
  }
 else {
    mLastScanError=PackageManager.INSTALL_SUCCEEDED;
    newPackage=scanPackageLI(pkg,parseFlags,scanMode);
    if (newPackage == null) {
      Slog.w(TAG,"String_Node_Str" + pkg.mPath);
      if ((res.returnCode=mLastScanError) == PackageManager.INSTALL_SUCCEEDED) {
        res.returnCode=PackageManager.INSTALL_FAILED_INVALID_APK;
      }
    }
 else {
      updateSettingsLI(newPackage,installerPackageName,res);
      updatedSettings=true;
    }
  }
  if (res.returnCode != PackageManager.INSTALL_SUCCEEDED) {
    if (updatedSettings) {
      deletePackageLI(pkgName,true,PackageManager.DONT_DELETE_DATA,res.removedInfo);
    }
    if (deletedPkg) {
      File restoreFile=new File(deletedPackage.mPath);
      if (restoreFile == null) {
        Slog.e(TAG,"String_Node_Str" + pkgName);
        return;
      }
      boolean oldOnSd=isExternal(deletedPackage);
      int oldParseFlags=mDefParseFlags | PackageParser.PARSE_CHATTY | (isForwardLocked(deletedPackage) ? PackageParser.PARSE_FORWARD_LOCK : 0)| (oldOnSd ? PackageParser.PARSE_ON_SDCARD : 0);
      int oldScanMode=(oldOnSd ? 0 : SCAN_MONITOR) | SCAN_UPDATE_SIGNATURE;
      if (scanPackageLI(restoreFile,oldParseFlags,oldScanMode) == null) {
        Slog.e(TAG,"String_Node_Str" + pkgName + "String_Node_Str");
        return;
      }
synchronized (mPackages) {
        updatePermissionsLP(deletedPackage.packageName,deletedPackage,true,false,false);
        mSettings.writeLP();
      }
      Slog.i(TAG,"String_Node_Str" + pkgName + "String_Node_Str");
    }
  }
}