Program: 24135
Project: 24135
Buggy source:
private final int startActivityLocked(IApplicationThread caller,Intent intent,String resolvedType,Uri[] grantedUriPermissions,int grantedMode,ActivityInfo aInfo,IBinder resultTo,String resultWho,int requestCode,int callingPid,int callingUid,boolean onlyIfNeeded,boolean componentSpecified){
  Log.i(TAG,"String_Node_Str" + intent);
  HistoryRecord sourceRecord=null;
  HistoryRecord resultRecord=null;
  if (resultTo != null) {
    int index=indexOfTokenLocked(resultTo,false);
    if (DEBUG_RESULTS)     Log.v(TAG,"String_Node_Str" + resultTo + "String_Node_Str"+ index+ "String_Node_Str");
    if (index >= 0) {
      sourceRecord=(HistoryRecord)mHistory.get(index);
      if (requestCode >= 0 && !sourceRecord.finishing) {
        resultRecord=sourceRecord;
      }
    }
  }
  int launchFlags=intent.getFlags();
  if ((launchFlags & Intent.FLAG_ACTIVITY_FORWARD_RESULT) != 0 && sourceRecord != null) {
    if (requestCode >= 0) {
      return START_FORWARD_AND_REQUEST_CONFLICT;
    }
    resultRecord=sourceRecord.resultTo;
    resultWho=sourceRecord.resultWho;
    requestCode=sourceRecord.requestCode;
    sourceRecord.resultTo=null;
    if (resultRecord != null) {
      resultRecord.removeResultsLocked(sourceRecord,resultWho,requestCode);
    }
  }
  int err=START_SUCCESS;
  if (intent.getComponent() == null) {
    err=START_INTENT_NOT_RESOLVED;
  }
  if (err == START_SUCCESS && aInfo == null) {
    err=START_CLASS_NOT_FOUND;
  }
  ProcessRecord callerApp=null;
  if (err == START_SUCCESS && caller != null) {
    callerApp=getRecordForAppLocked(caller);
    if (callerApp != null) {
      callingPid=callerApp.pid;
      callingUid=callerApp.info.uid;
    }
 else {
      Log.w(TAG,"String_Node_Str" + caller + "String_Node_Str"+ callingPid+ "String_Node_Str"+ intent.toString());
      err=START_PERMISSION_DENIED;
    }
  }
  if (err != START_SUCCESS) {
    if (resultRecord != null) {
      sendActivityResultLocked(-1,resultRecord,resultWho,requestCode,Activity.RESULT_CANCELED,null);
    }
    return err;
  }
  final int perm=checkComponentPermission(aInfo.permission,callingPid,callingUid,aInfo.exported ? -1 : aInfo.applicationInfo.uid);
  if (perm != PackageManager.PERMISSION_GRANTED) {
    if (resultRecord != null) {
      sendActivityResultLocked(-1,resultRecord,resultWho,requestCode,Activity.RESULT_CANCELED,null);
    }
    String msg="String_Node_Str" + intent.toString() + "String_Node_Str"+ callerApp+ "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid+ "String_Node_Str"+ "String_Node_Str"+ aInfo.permission;
    Log.w(TAG,msg);
    throw new SecurityException(msg);
  }
  if (mWatcher != null) {
    boolean abort=false;
    try {
      Intent watchIntent=intent.cloneFilter();
      abort=!mWatcher.activityStarting(watchIntent,aInfo.applicationInfo.packageName);
    }
 catch (    RemoteException e) {
      mWatcher=null;
    }
    if (abort) {
      if (resultRecord != null) {
        sendActivityResultLocked(-1,resultRecord,resultWho,requestCode,Activity.RESULT_CANCELED,null);
      }
      return START_SUCCESS;
    }
  }
  HistoryRecord r=new HistoryRecord(this,callerApp,callingUid,intent,resolvedType,aInfo,mConfiguration,resultRecord,resultWho,requestCode,componentSpecified);
  if (mResumedActivity == null || mResumedActivity.info.applicationInfo.uid != callingUid) {
    if (!checkAppSwitchAllowedLocked(callingPid,callingUid,"String_Node_Str")) {
      PendingActivityLaunch pal=new PendingActivityLaunch();
      pal.r=r;
      pal.sourceRecord=sourceRecord;
      pal.grantedUriPermissions=grantedUriPermissions;
      pal.grantedMode=grantedMode;
      pal.onlyIfNeeded=onlyIfNeeded;
      mPendingActivityLaunches.add(pal);
      return START_SWITCHES_CANCELED;
    }
  }
  if (mDidAppSwitch) {
    mAppSwitchesAllowedTime=0;
  }
 else {
    mDidAppSwitch=true;
  }
  doPendingActivityLaunchesLocked(false);
  return startActivityUncheckedLocked(r,sourceRecord,grantedUriPermissions,grantedMode,onlyIfNeeded,true);
}

Fixed version (ground truth):
private final int startActivityLocked(IApplicationThread caller,Intent intent,String resolvedType,Uri[] grantedUriPermissions,int grantedMode,ActivityInfo aInfo,IBinder resultTo,String resultWho,int requestCode,int callingPid,int callingUid,boolean onlyIfNeeded,boolean componentSpecified){
  Log.i(TAG,"String_Node_Str" + intent);
  HistoryRecord sourceRecord=null;
  HistoryRecord resultRecord=null;
  if (resultTo != null) {
    int index=indexOfTokenLocked(resultTo);
    if (DEBUG_RESULTS)     Log.v(TAG,"String_Node_Str" + resultTo + "String_Node_Str"+ index+ "String_Node_Str");
    if (index >= 0) {
      sourceRecord=(HistoryRecord)mHistory.get(index);
      if (requestCode >= 0 && !sourceRecord.finishing) {
        resultRecord=sourceRecord;
      }
    }
  }
  int launchFlags=intent.getFlags();
  if ((launchFlags & Intent.FLAG_ACTIVITY_FORWARD_RESULT) != 0 && sourceRecord != null) {
    if (requestCode >= 0) {
      return START_FORWARD_AND_REQUEST_CONFLICT;
    }
    resultRecord=sourceRecord.resultTo;
    resultWho=sourceRecord.resultWho;
    requestCode=sourceRecord.requestCode;
    sourceRecord.resultTo=null;
    if (resultRecord != null) {
      resultRecord.removeResultsLocked(sourceRecord,resultWho,requestCode);
    }
  }
  int err=START_SUCCESS;
  if (intent.getComponent() == null) {
    err=START_INTENT_NOT_RESOLVED;
  }
  if (err == START_SUCCESS && aInfo == null) {
    err=START_CLASS_NOT_FOUND;
  }
  ProcessRecord callerApp=null;
  if (err == START_SUCCESS && caller != null) {
    callerApp=getRecordForAppLocked(caller);
    if (callerApp != null) {
      callingPid=callerApp.pid;
      callingUid=callerApp.info.uid;
    }
 else {
      Log.w(TAG,"String_Node_Str" + caller + "String_Node_Str"+ callingPid+ "String_Node_Str"+ intent.toString());
      err=START_PERMISSION_DENIED;
    }
  }
  if (err != START_SUCCESS) {
    if (resultRecord != null) {
      sendActivityResultLocked(-1,resultRecord,resultWho,requestCode,Activity.RESULT_CANCELED,null);
    }
    return err;
  }
  final int perm=checkComponentPermission(aInfo.permission,callingPid,callingUid,aInfo.exported ? -1 : aInfo.applicationInfo.uid);
  if (perm != PackageManager.PERMISSION_GRANTED) {
    if (resultRecord != null) {
      sendActivityResultLocked(-1,resultRecord,resultWho,requestCode,Activity.RESULT_CANCELED,null);
    }
    String msg="String_Node_Str" + intent.toString() + "String_Node_Str"+ callerApp+ "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid+ "String_Node_Str"+ "String_Node_Str"+ aInfo.permission;
    Log.w(TAG,msg);
    throw new SecurityException(msg);
  }
  if (mWatcher != null) {
    boolean abort=false;
    try {
      Intent watchIntent=intent.cloneFilter();
      abort=!mWatcher.activityStarting(watchIntent,aInfo.applicationInfo.packageName);
    }
 catch (    RemoteException e) {
      mWatcher=null;
    }
    if (abort) {
      if (resultRecord != null) {
        sendActivityResultLocked(-1,resultRecord,resultWho,requestCode,Activity.RESULT_CANCELED,null);
      }
      return START_SUCCESS;
    }
  }
  HistoryRecord r=new HistoryRecord(this,callerApp,callingUid,intent,resolvedType,aInfo,mConfiguration,resultRecord,resultWho,requestCode,componentSpecified);
  if (mResumedActivity == null || mResumedActivity.info.applicationInfo.uid != callingUid) {
    if (!checkAppSwitchAllowedLocked(callingPid,callingUid,"String_Node_Str")) {
      PendingActivityLaunch pal=new PendingActivityLaunch();
      pal.r=r;
      pal.sourceRecord=sourceRecord;
      pal.grantedUriPermissions=grantedUriPermissions;
      pal.grantedMode=grantedMode;
      pal.onlyIfNeeded=onlyIfNeeded;
      mPendingActivityLaunches.add(pal);
      return START_SWITCHES_CANCELED;
    }
  }
  if (mDidAppSwitch) {
    mAppSwitchesAllowedTime=0;
  }
 else {
    mDidAppSwitch=true;
  }
  doPendingActivityLaunchesLocked(false);
  return startActivityUncheckedLocked(r,sourceRecord,grantedUriPermissions,grantedMode,onlyIfNeeded,true);
}