Program: 24142
Project: 24142
Buggy source:
public int bindService(IApplicationThread caller,IBinder token,Intent service,String resolvedType,IServiceConnection connection,int flags){
  if (service != null && service.hasFileDescriptors() == true) {
    throw new IllegalArgumentException("String_Node_Str");
  }
synchronized (this) {
    if (DEBUG_SERVICE)     Log.v(TAG,"String_Node_Str" + service + "String_Node_Str"+ resolvedType+ "String_Node_Str"+ connection.asBinder()+ "String_Node_Str"+ Integer.toHexString(flags));
    final ProcessRecord callerApp=getRecordForAppLocked(caller);
    if (callerApp == null) {
      throw new SecurityException("String_Node_Str" + caller + "String_Node_Str"+ Binder.getCallingPid()+ "String_Node_Str"+ service);
    }
    HistoryRecord activity=null;
    if (token != null) {
      int aindex=indexOfTokenLocked(token,false);
      if (aindex < 0) {
        Log.w(TAG,"String_Node_Str" + token);
        return 0;
      }
      activity=(HistoryRecord)mHistory.get(aindex);
    }
    ServiceLookupResult res=retrieveServiceLocked(service,resolvedType,Binder.getCallingPid(),Binder.getCallingUid());
    if (res == null) {
      return 0;
    }
    if (res.record == null) {
      return -1;
    }
    ServiceRecord s=res.record;
    final long origId=Binder.clearCallingIdentity();
    if (unscheduleServiceRestartLocked(s)) {
      if (DEBUG_SERVICE)       Log.v(TAG,"String_Node_Str" + s.shortName);
    }
    AppBindRecord b=s.retrieveAppBindingLocked(service,callerApp);
    ConnectionRecord c=new ConnectionRecord(b,activity,connection,flags);
    IBinder binder=connection.asBinder();
    s.connections.put(binder,c);
    b.connections.add(c);
    if (activity != null) {
      if (activity.connections == null) {
        activity.connections=new HashSet<ConnectionRecord>();
      }
      activity.connections.add(c);
    }
    b.client.connections.add(c);
    mServiceConnections.put(binder,c);
    if ((flags & Context.BIND_AUTO_CREATE) != 0) {
      s.lastActivity=SystemClock.uptimeMillis();
      if (!bringUpServiceLocked(s,service.getFlags(),false)) {
        return 0;
      }
    }
    if (s.app != null) {
      updateOomAdjLocked(s.app);
    }
    if (DEBUG_SERVICE)     Log.v(TAG,"String_Node_Str" + s + "String_Node_Str"+ b+ "String_Node_Str"+ b.intent.received+ "String_Node_Str"+ b.intent.apps.size()+ "String_Node_Str"+ b.intent.doRebind);
    if (s.app != null && b.intent.received) {
      try {
        c.conn.connected(s.name,b.intent.binder);
      }
 catch (      Exception e) {
        Log.w(TAG,"String_Node_Str" + s.shortName + "String_Node_Str"+ c.conn.asBinder()+ "String_Node_Str"+ c.binding.client.processName+ "String_Node_Str",e);
      }
      if (b.intent.apps.size() == 1 && b.intent.doRebind) {
        requestServiceBindingLocked(s,b.intent,true);
      }
    }
 else     if (!b.intent.requested) {
      requestServiceBindingLocked(s,b.intent,false);
    }
    Binder.restoreCallingIdentity(origId);
  }
  return 1;
}

Fixed version (ground truth):
public int bindService(IApplicationThread caller,IBinder token,Intent service,String resolvedType,IServiceConnection connection,int flags){
  if (service != null && service.hasFileDescriptors() == true) {
    throw new IllegalArgumentException("String_Node_Str");
  }
synchronized (this) {
    if (DEBUG_SERVICE)     Log.v(TAG,"String_Node_Str" + service + "String_Node_Str"+ resolvedType+ "String_Node_Str"+ connection.asBinder()+ "String_Node_Str"+ Integer.toHexString(flags));
    final ProcessRecord callerApp=getRecordForAppLocked(caller);
    if (callerApp == null) {
      throw new SecurityException("String_Node_Str" + caller + "String_Node_Str"+ Binder.getCallingPid()+ "String_Node_Str"+ service);
    }
    HistoryRecord activity=null;
    if (token != null) {
      int aindex=indexOfTokenLocked(token);
      if (aindex < 0) {
        Log.w(TAG,"String_Node_Str" + token);
        return 0;
      }
      activity=(HistoryRecord)mHistory.get(aindex);
    }
    ServiceLookupResult res=retrieveServiceLocked(service,resolvedType,Binder.getCallingPid(),Binder.getCallingUid());
    if (res == null) {
      return 0;
    }
    if (res.record == null) {
      return -1;
    }
    ServiceRecord s=res.record;
    final long origId=Binder.clearCallingIdentity();
    if (unscheduleServiceRestartLocked(s)) {
      if (DEBUG_SERVICE)       Log.v(TAG,"String_Node_Str" + s.shortName);
    }
    AppBindRecord b=s.retrieveAppBindingLocked(service,callerApp);
    ConnectionRecord c=new ConnectionRecord(b,activity,connection,flags);
    IBinder binder=connection.asBinder();
    s.connections.put(binder,c);
    b.connections.add(c);
    if (activity != null) {
      if (activity.connections == null) {
        activity.connections=new HashSet<ConnectionRecord>();
      }
      activity.connections.add(c);
    }
    b.client.connections.add(c);
    mServiceConnections.put(binder,c);
    if ((flags & Context.BIND_AUTO_CREATE) != 0) {
      s.lastActivity=SystemClock.uptimeMillis();
      if (!bringUpServiceLocked(s,service.getFlags(),false)) {
        return 0;
      }
    }
    if (s.app != null) {
      updateOomAdjLocked(s.app);
    }
    if (DEBUG_SERVICE)     Log.v(TAG,"String_Node_Str" + s + "String_Node_Str"+ b+ "String_Node_Str"+ b.intent.received+ "String_Node_Str"+ b.intent.apps.size()+ "String_Node_Str"+ b.intent.doRebind);
    if (s.app != null && b.intent.received) {
      try {
        c.conn.connected(s.name,b.intent.binder);
      }
 catch (      Exception e) {
        Log.w(TAG,"String_Node_Str" + s.shortName + "String_Node_Str"+ c.conn.asBinder()+ "String_Node_Str"+ c.binding.client.processName+ "String_Node_Str",e);
      }
      if (b.intent.apps.size() == 1 && b.intent.doRebind) {
        requestServiceBindingLocked(s,b.intent,true);
      }
    }
 else     if (!b.intent.requested) {
      requestServiceBindingLocked(s,b.intent,false);
    }
    Binder.restoreCallingIdentity(origId);
  }
  return 1;
}