Program: 253
Project: 253
Buggy source:
final void killServicesLocked(ProcessRecord app,boolean allowRestart){
  if (false) {
    if (app.services.size() > 0) {
      Iterator<ServiceRecord> it=app.services.iterator();
      while (it.hasNext()) {
        ServiceRecord r=it.next();
        for (int conni=r.connections.size() - 1; conni >= 0; conni--) {
          ArrayList<ConnectionRecord> cl=r.connections.valueAt(conni);
          for (int i=0; i < cl.size(); i++) {
            ConnectionRecord c=cl.get(i);
            if (c.binding.client != app) {
              try {
              }
 catch (              Exception e) {
                Slog.w(TAG,"String_Node_Str" + r.shortName + "String_Node_Str"+ app.processName,e);
              }
            }
          }
        }
      }
    }
  }
  for (int i=app.connections.size() - 1; i >= 0; i--) {
    ConnectionRecord r=app.connections.valueAt(i);
    removeConnectionLocked(r,app,null);
  }
  app.connections.clear();
  for (int i=app.services.size() - 1; i >= 0; i--) {
    ServiceRecord sr=app.services.valueAt(i);
synchronized (sr.stats.getBatteryStats()) {
      sr.stats.stopLaunchedLocked();
    }
    sr.app=null;
    sr.isolatedProc=null;
    sr.executeNesting=0;
    sr.forceClearTracker();
    if (mDestroyingServices.remove(sr)) {
      if (DEBUG_SERVICE)       Slog.v(TAG,"String_Node_Str" + sr);
    }
    final int numClients=sr.bindings.size();
    for (int bindingi=numClients - 1; bindingi >= 0; bindingi--) {
      IntentBindRecord b=sr.bindings.valueAt(bindingi);
      if (DEBUG_SERVICE)       Slog.v(TAG,"String_Node_Str" + b + "String_Node_Str"+ b.hasBound);
      b.binder=null;
      b.requested=b.received=b.hasBound=false;
    }
    if (sr.crashCount >= 2 && (sr.serviceInfo.applicationInfo.flags & ApplicationInfo.FLAG_PERSISTENT) == 0) {
      Slog.w(TAG,"String_Node_Str" + sr.crashCount + "String_Node_Str"+ sr);
      EventLog.writeEvent(EventLogTags.AM_SERVICE_CRASHED_TOO_MUCH,sr.userId,sr.crashCount,sr.shortName,app.pid);
      bringDownServiceLocked(sr);
    }
 else     if (!allowRestart) {
      bringDownServiceLocked(sr);
    }
 else {
      boolean canceled=scheduleServiceRestartLocked(sr,true);
      if (sr.startRequested && (sr.stopIfKilled || canceled)) {
        if (sr.pendingStarts.size() == 0) {
          sr.startRequested=false;
          if (sr.tracker != null) {
            sr.tracker.setStarted(false,mAm.mProcessStats.getMemFactorLocked(),SystemClock.uptimeMillis());
          }
          if (!sr.hasAutoCreateConnections()) {
            bringDownServiceLocked(sr);
          }
        }
      }
    }
  }
  if (!allowRestart) {
    app.services.clear();
  }
  int i=mDestroyingServices.size();
  while (i > 0) {
    i--;
    ServiceRecord sr=mDestroyingServices.get(i);
    if (sr.app == app) {
      sr.forceClearTracker();
      mDestroyingServices.remove(i);
      if (DEBUG_SERVICE)       Slog.v(TAG,"String_Node_Str" + sr);
    }
  }
  app.executingServices.clear();
}

Fixed version (ground truth):
final void killServicesLocked(ProcessRecord app,boolean allowRestart){
  if (false) {
    if (app.services.size() > 0) {
      Iterator<ServiceRecord> it=app.services.iterator();
      while (it.hasNext()) {
        ServiceRecord r=it.next();
        for (int conni=r.connections.size() - 1; conni >= 0; conni--) {
          ArrayList<ConnectionRecord> cl=r.connections.valueAt(conni);
          for (int i=0; i < cl.size(); i++) {
            ConnectionRecord c=cl.get(i);
            if (c.binding.client != app) {
              try {
              }
 catch (              Exception e) {
                Slog.w(TAG,"String_Node_Str" + r.shortName + "String_Node_Str"+ app.processName,e);
              }
            }
          }
        }
      }
    }
  }
  for (int i=app.services.size() - 1; i >= 0; i--) {
    ServiceRecord sr=app.services.valueAt(i);
synchronized (sr.stats.getBatteryStats()) {
      sr.stats.stopLaunchedLocked();
    }
    sr.app=null;
    sr.isolatedProc=null;
    sr.executeNesting=0;
    sr.forceClearTracker();
    if (mDestroyingServices.remove(sr)) {
      if (DEBUG_SERVICE)       Slog.v(TAG,"String_Node_Str" + sr);
    }
    final int numClients=sr.bindings.size();
    for (int bindingi=numClients - 1; bindingi >= 0; bindingi--) {
      IntentBindRecord b=sr.bindings.valueAt(bindingi);
      if (DEBUG_SERVICE)       Slog.v(TAG,"String_Node_Str" + b + "String_Node_Str"+ b.hasBound);
      b.binder=null;
      b.requested=b.received=b.hasBound=false;
    }
  }
  for (int i=app.connections.size() - 1; i >= 0; i--) {
    ConnectionRecord r=app.connections.valueAt(i);
    removeConnectionLocked(r,app,null);
  }
  app.connections.clear();
  for (int i=app.services.size() - 1; i >= 0; i--) {
    ServiceRecord sr=app.services.valueAt(i);
    if (allowRestart && sr.crashCount >= 2 && (sr.serviceInfo.applicationInfo.flags & ApplicationInfo.FLAG_PERSISTENT) == 0) {
      Slog.w(TAG,"String_Node_Str" + sr.crashCount + "String_Node_Str"+ sr);
      EventLog.writeEvent(EventLogTags.AM_SERVICE_CRASHED_TOO_MUCH,sr.userId,sr.crashCount,sr.shortName,app.pid);
      bringDownServiceLocked(sr);
    }
 else     if (!allowRestart) {
      bringDownServiceLocked(sr);
    }
 else {
      boolean canceled=scheduleServiceRestartLocked(sr,true);
      if (sr.startRequested && (sr.stopIfKilled || canceled)) {
        if (sr.pendingStarts.size() == 0) {
          sr.startRequested=false;
          if (sr.tracker != null) {
            sr.tracker.setStarted(false,mAm.mProcessStats.getMemFactorLocked(),SystemClock.uptimeMillis());
          }
          if (!sr.hasAutoCreateConnections()) {
            bringDownServiceLocked(sr);
          }
        }
      }
    }
  }
  if (!allowRestart) {
    app.services.clear();
    for (int i=mRestartingServices.size() - 1; i >= 0; i--) {
      ServiceRecord r=mRestartingServices.get(i);
      if (r.processName.equals(app.processName) && r.serviceInfo.applicationInfo.uid == app.info.uid) {
        mRestartingServices.remove(i);
        r.clearRestarting(mAm.mProcessStats.getMemFactorLocked(),SystemClock.uptimeMillis());
      }
    }
  }
  int i=mDestroyingServices.size();
  while (i > 0) {
    i--;
    ServiceRecord sr=mDestroyingServices.get(i);
    if (sr.app == app) {
      sr.forceClearTracker();
      mDestroyingServices.remove(i);
      if (DEBUG_SERVICE)       Slog.v(TAG,"String_Node_Str" + sr);
    }
  }
  app.executingServices.clear();
}