Program: 22635
Project: 22635
Buggy source:
void reclaimSomeSurfaceMemoryLocked(WindowState win,String operation){
  final Surface surface=win.mSurface;
  EventLog.writeEvent(EventLogTags.WM_NO_SURFACE_MEMORY,win.toString(),win.mSession.mPid,operation);
  if (mForceRemoves == null) {
    mForceRemoves=new ArrayList<WindowState>();
  }
  long callingIdentity=Binder.clearCallingIdentity();
  try {
    int N=mWindows.size();
    boolean leakedSurface=false;
    Slog.i(TAG,"String_Node_Str");
    for (int i=0; i < N; i++) {
      WindowState ws=(WindowState)mWindows.get(i);
      if (ws.mSurface != null) {
        if (!mSessions.contains(ws.mSession)) {
          Slog.w(TAG,"String_Node_Str" + ws + "String_Node_Str"+ ws.mSurface+ "String_Node_Str"+ win.mToken+ "String_Node_Str"+ ws.mSession.mPid+ "String_Node_Str"+ ws.mSession.mUid);
          ws.mSurface.destroy();
          ws.mSurface=null;
          mForceRemoves.add(ws);
          i--;
          N--;
          leakedSurface=true;
        }
 else         if (win.mAppToken != null && win.mAppToken.clientHidden) {
          Slog.w(TAG,"String_Node_Str" + ws + "String_Node_Str"+ ws.mSurface+ "String_Node_Str"+ win.mAppToken);
          ws.mSurface.destroy();
          ws.mSurface=null;
          leakedSurface=true;
        }
      }
    }
    boolean killedApps=false;
    if (!leakedSurface) {
      Slog.w(TAG,"String_Node_Str");
      SparseIntArray pidCandidates=new SparseIntArray();
      for (int i=0; i < N; i++) {
        WindowState ws=(WindowState)mWindows.get(i);
        if (ws.mSurface != null) {
          pidCandidates.append(ws.mSession.mPid,ws.mSession.mPid);
        }
      }
      if (pidCandidates.size() > 0) {
        int[] pids=new int[pidCandidates.size()];
        for (int i=0; i < pids.length; i++) {
          pids[i]=pidCandidates.keyAt(i);
        }
        try {
          if (mActivityManager.killPids(pids,"String_Node_Str")) {
            killedApps=true;
          }
        }
 catch (        RemoteException e) {
        }
      }
    }
    if (leakedSurface || killedApps) {
      Slog.w(TAG,"String_Node_Str");
      if (surface != null) {
        surface.destroy();
        win.mSurface=null;
      }
      try {
        win.mClient.dispatchGetNewSurface();
      }
 catch (      RemoteException e) {
      }
    }
  }
  finally {
    Binder.restoreCallingIdentity(callingIdentity);
  }
}

Fixed version (ground truth):
void reclaimSomeSurfaceMemoryLocked(WindowState win,String operation){
  final Surface surface=win.mSurface;
  EventLog.writeEvent(EventLogTags.WM_NO_SURFACE_MEMORY,win.toString(),win.mSession.mPid,operation);
  if (mForceRemoves == null) {
    mForceRemoves=new ArrayList<WindowState>();
  }
  long callingIdentity=Binder.clearCallingIdentity();
  try {
    int N=mWindows.size();
    boolean leakedSurface=false;
    Slog.i(TAG,"String_Node_Str");
    for (int i=0; i < N; i++) {
      WindowState ws=(WindowState)mWindows.get(i);
      if (ws.mSurface != null) {
        if (!mSessions.contains(ws.mSession)) {
          Slog.w(TAG,"String_Node_Str" + ws + "String_Node_Str"+ ws.mSurface+ "String_Node_Str"+ win.mToken+ "String_Node_Str"+ ws.mSession.mPid+ "String_Node_Str"+ ws.mSession.mUid);
          ws.mSurface.destroy();
          ws.mSurfaceShown=false;
          ws.mSurface=null;
          mForceRemoves.add(ws);
          i--;
          N--;
          leakedSurface=true;
        }
 else         if (win.mAppToken != null && win.mAppToken.clientHidden) {
          Slog.w(TAG,"String_Node_Str" + ws + "String_Node_Str"+ ws.mSurface+ "String_Node_Str"+ win.mAppToken);
          ws.mSurface.destroy();
          ws.mSurfaceShown=false;
          ws.mSurface=null;
          leakedSurface=true;
        }
      }
    }
    boolean killedApps=false;
    if (!leakedSurface) {
      Slog.w(TAG,"String_Node_Str");
      SparseIntArray pidCandidates=new SparseIntArray();
      for (int i=0; i < N; i++) {
        WindowState ws=(WindowState)mWindows.get(i);
        if (ws.mSurface != null) {
          pidCandidates.append(ws.mSession.mPid,ws.mSession.mPid);
        }
      }
      if (pidCandidates.size() > 0) {
        int[] pids=new int[pidCandidates.size()];
        for (int i=0; i < pids.length; i++) {
          pids[i]=pidCandidates.keyAt(i);
        }
        try {
          if (mActivityManager.killPids(pids,"String_Node_Str")) {
            killedApps=true;
          }
        }
 catch (        RemoteException e) {
        }
      }
    }
    if (leakedSurface || killedApps) {
      Slog.w(TAG,"String_Node_Str");
      if (surface != null) {
        surface.destroy();
        win.mSurfaceShown=false;
        win.mSurface=null;
      }
      try {
        win.mClient.dispatchGetNewSurface();
      }
 catch (      RemoteException e) {
      }
    }
  }
  finally {
    Binder.restoreCallingIdentity(callingIdentity);
  }
}