Program: 1790
Project: 1790
Buggy source:
int bindServiceLocked(IApplicationThread caller,IBinder token,Intent service,String resolvedType,IServiceConnection connection,int flags,int userId){
  if (DEBUG_SERVICE)   Slog.v(TAG,"String_Node_Str" + service + "String_Node_Str"+ resolvedType+ "String_Node_Str"+ connection.asBinder()+ "String_Node_Str"+ Integer.toHexString(flags));
  final ProcessRecord callerApp=mAm.getRecordForAppLocked(caller);
  if (callerApp == null) {
    throw new SecurityException("String_Node_Str" + caller + "String_Node_Str"+ Binder.getCallingPid()+ "String_Node_Str"+ service);
  }
  ActivityRecord activity=null;
  if (token != null) {
    activity=ActivityRecord.isInStackLocked(token);
    if (activity == null) {
      Slog.w(TAG,"String_Node_Str" + token);
      return 0;
    }
  }
  int clientLabel=0;
  PendingIntent clientIntent=null;
  if (callerApp.info.uid == Process.SYSTEM_UID) {
    try {
      clientIntent=(PendingIntent)service.getParcelableExtra(Intent.EXTRA_CLIENT_INTENT);
    }
 catch (    RuntimeException e) {
    }
    if (clientIntent != null) {
      clientLabel=service.getIntExtra(Intent.EXTRA_CLIENT_LABEL,0);
      if (clientLabel != 0) {
        service=service.cloneFilter();
      }
    }
  }
  ServiceLookupResult res=retrieveServiceLocked(service,resolvedType,Binder.getCallingPid(),Binder.getCallingUid(),userId,true);
  if (res == null) {
    return 0;
  }
  if (res.record == null) {
    return -1;
  }
  ServiceRecord s=res.record;
  final long origId=Binder.clearCallingIdentity();
  try {
    if (unscheduleServiceRestartLocked(s)) {
      if (DEBUG_SERVICE)       Slog.v(TAG,"String_Node_Str" + s);
    }
    if ((flags & Context.BIND_AUTO_CREATE) != 0) {
      s.lastActivity=SystemClock.uptimeMillis();
      if (!s.hasAutoCreateConnections()) {
        if (s.tracker != null) {
          s.tracker.setBound(true,mAm.mProcessTracker.getMemFactorLocked(),s.lastActivity);
        }
      }
    }
    AppBindRecord b=s.retrieveAppBindingLocked(service,callerApp);
    ConnectionRecord c=new ConnectionRecord(b,activity,connection,flags,clientLabel,clientIntent);
    IBinder binder=connection.asBinder();
    ArrayList<ConnectionRecord> clist=s.connections.get(binder);
    if (clist == null) {
      clist=new ArrayList<ConnectionRecord>();
      s.connections.put(binder,clist);
    }
    clist.add(c);
    b.connections.add(c);
    if (activity != null) {
      if (activity.connections == null) {
        activity.connections=new HashSet<ConnectionRecord>();
      }
      activity.connections.add(c);
    }
    b.client.connections.add(c);
    if ((c.flags & Context.BIND_ABOVE_CLIENT) != 0) {
      b.client.hasAboveClient=true;
    }
    clist=mServiceConnections.get(binder);
    if (clist == null) {
      clist=new ArrayList<ConnectionRecord>();
      mServiceConnections.put(binder,clist);
    }
    clist.add(c);
    if ((flags & Context.BIND_AUTO_CREATE) != 0) {
      s.lastActivity=SystemClock.uptimeMillis();
      if (bringUpServiceLocked(s,service.getFlags(),false) != null) {
        return 0;
      }
    }
    if (s.app != null) {
      mAm.updateOomAdjLocked(s.app);
    }
    if (DEBUG_SERVICE)     Slog.v(TAG,"String_Node_Str" + s + "String_Node_Str"+ b+ "String_Node_Str"+ b.intent.received+ "String_Node_Str"+ b.intent.apps.size()+ "String_Node_Str"+ b.intent.doRebind);
    if (s.app != null && b.intent.received) {
      try {
        c.conn.connected(s.name,b.intent.binder);
      }
 catch (      Exception e) {
        Slog.w(TAG,"String_Node_Str" + s.shortName + "String_Node_Str"+ c.conn.asBinder()+ "String_Node_Str"+ c.binding.client.processName+ "String_Node_Str",e);
      }
      if (b.intent.apps.size() == 1 && b.intent.doRebind) {
        requestServiceBindingLocked(s,b.intent,true);
      }
    }
 else     if (!b.intent.requested) {
      requestServiceBindingLocked(s,b.intent,false);
    }
  }
  finally {
    Binder.restoreCallingIdentity(origId);
  }
  return 1;
}

Fixed version (ground truth):
int bindServiceLocked(IApplicationThread caller,IBinder token,Intent service,String resolvedType,IServiceConnection connection,int flags,int userId){
  if (DEBUG_SERVICE)   Slog.v(TAG,"String_Node_Str" + service + "String_Node_Str"+ resolvedType+ "String_Node_Str"+ connection.asBinder()+ "String_Node_Str"+ Integer.toHexString(flags));
  final ProcessRecord callerApp=mAm.getRecordForAppLocked(caller);
  if (callerApp == null) {
    throw new SecurityException("String_Node_Str" + caller + "String_Node_Str"+ Binder.getCallingPid()+ "String_Node_Str"+ service);
  }
  ActivityRecord activity=null;
  if (token != null) {
    activity=ActivityRecord.isInStackLocked(token);
    if (activity == null) {
      Slog.w(TAG,"String_Node_Str" + token);
      return 0;
    }
  }
  int clientLabel=0;
  PendingIntent clientIntent=null;
  if (callerApp.info.uid == Process.SYSTEM_UID) {
    try {
      clientIntent=(PendingIntent)service.getParcelableExtra(Intent.EXTRA_CLIENT_INTENT);
    }
 catch (    RuntimeException e) {
    }
    if (clientIntent != null) {
      clientLabel=service.getIntExtra(Intent.EXTRA_CLIENT_LABEL,0);
      if (clientLabel != 0) {
        service=service.cloneFilter();
      }
    }
  }
  ServiceLookupResult res=retrieveServiceLocked(service,resolvedType,Binder.getCallingPid(),Binder.getCallingUid(),userId,true);
  if (res == null) {
    return 0;
  }
  if (res.record == null) {
    return -1;
  }
  ServiceRecord s=res.record;
  final long origId=Binder.clearCallingIdentity();
  try {
    if (unscheduleServiceRestartLocked(s)) {
      if (DEBUG_SERVICE)       Slog.v(TAG,"String_Node_Str" + s);
    }
    if ((flags & Context.BIND_AUTO_CREATE) != 0) {
      s.lastActivity=SystemClock.uptimeMillis();
      if (!s.hasAutoCreateConnections()) {
        ProcessTracker.ServiceState stracker=s.getTracker();
        if (stracker != null) {
          stracker.setBound(true,mAm.mProcessTracker.getMemFactorLocked(),s.lastActivity);
        }
      }
    }
    AppBindRecord b=s.retrieveAppBindingLocked(service,callerApp);
    ConnectionRecord c=new ConnectionRecord(b,activity,connection,flags,clientLabel,clientIntent);
    IBinder binder=connection.asBinder();
    ArrayList<ConnectionRecord> clist=s.connections.get(binder);
    if (clist == null) {
      clist=new ArrayList<ConnectionRecord>();
      s.connections.put(binder,clist);
    }
    clist.add(c);
    b.connections.add(c);
    if (activity != null) {
      if (activity.connections == null) {
        activity.connections=new HashSet<ConnectionRecord>();
      }
      activity.connections.add(c);
    }
    b.client.connections.add(c);
    if ((c.flags & Context.BIND_ABOVE_CLIENT) != 0) {
      b.client.hasAboveClient=true;
    }
    clist=mServiceConnections.get(binder);
    if (clist == null) {
      clist=new ArrayList<ConnectionRecord>();
      mServiceConnections.put(binder,clist);
    }
    clist.add(c);
    if ((flags & Context.BIND_AUTO_CREATE) != 0) {
      s.lastActivity=SystemClock.uptimeMillis();
      if (bringUpServiceLocked(s,service.getFlags(),false) != null) {
        return 0;
      }
    }
    if (s.app != null) {
      mAm.updateOomAdjLocked(s.app);
    }
    if (DEBUG_SERVICE)     Slog.v(TAG,"String_Node_Str" + s + "String_Node_Str"+ b+ "String_Node_Str"+ b.intent.received+ "String_Node_Str"+ b.intent.apps.size()+ "String_Node_Str"+ b.intent.doRebind);
    if (s.app != null && b.intent.received) {
      try {
        c.conn.connected(s.name,b.intent.binder);
      }
 catch (      Exception e) {
        Slog.w(TAG,"String_Node_Str" + s.shortName + "String_Node_Str"+ c.conn.asBinder()+ "String_Node_Str"+ c.binding.client.processName+ "String_Node_Str",e);
      }
      if (b.intent.apps.size() == 1 && b.intent.doRebind) {
        requestServiceBindingLocked(s,b.intent,true);
      }
    }
 else     if (!b.intent.requested) {
      requestServiceBindingLocked(s,b.intent,false);
    }
  }
  finally {
    Binder.restoreCallingIdentity(origId);
  }
  return 1;
}