Program: 24147
Project: 24147
Buggy source:
public IIntentSender getIntentSender(int type,String packageName,IBinder token,String resultWho,int requestCode,Intent intent,String resolvedType,int flags){
  if (intent != null && intent.hasFileDescriptors() == true) {
    throw new IllegalArgumentException("String_Node_Str");
  }
synchronized (this) {
    int callingUid=Binder.getCallingUid();
    try {
      if (callingUid != 0 && callingUid != Process.SYSTEM_UID && Process.supportsProcesses()) {
        int uid=ActivityThread.getPackageManager().getPackageUid(packageName);
        if (uid != Binder.getCallingUid()) {
          String msg="String_Node_Str" + Binder.getCallingPid() + "String_Node_Str"+ Binder.getCallingUid()+ "String_Node_Str"+ uid+ "String_Node_Str"+ "String_Node_Str"+ packageName;
          Log.w(TAG,msg);
          throw new SecurityException(msg);
        }
      }
    }
 catch (    RemoteException e) {
      throw new SecurityException(e);
    }
    HistoryRecord activity=null;
    if (type == INTENT_SENDER_ACTIVITY_RESULT) {
      int index=indexOfTokenLocked(token,false);
      if (index < 0) {
        return null;
      }
      activity=(HistoryRecord)mHistory.get(index);
      if (activity.finishing) {
        return null;
      }
    }
    final boolean noCreate=(flags & PendingIntent.FLAG_NO_CREATE) != 0;
    final boolean cancelCurrent=(flags & PendingIntent.FLAG_CANCEL_CURRENT) != 0;
    final boolean updateCurrent=(flags & PendingIntent.FLAG_UPDATE_CURRENT) != 0;
    flags&=~(PendingIntent.FLAG_NO_CREATE | PendingIntent.FLAG_CANCEL_CURRENT | PendingIntent.FLAG_UPDATE_CURRENT);
    PendingIntentRecord.Key key=new PendingIntentRecord.Key(type,packageName,activity,resultWho,requestCode,intent,resolvedType,flags);
    WeakReference<PendingIntentRecord> ref;
    ref=mIntentSenderRecords.get(key);
    PendingIntentRecord rec=ref != null ? ref.get() : null;
    if (rec != null) {
      if (!cancelCurrent) {
        if (updateCurrent) {
          rec.key.requestIntent.replaceExtras(intent);
        }
        return rec;
      }
      rec.canceled=true;
      mIntentSenderRecords.remove(key);
    }
    if (noCreate) {
      return rec;
    }
    rec=new PendingIntentRecord(this,key,callingUid);
    mIntentSenderRecords.put(key,rec.ref);
    if (type == INTENT_SENDER_ACTIVITY_RESULT) {
      if (activity.pendingResults == null) {
        activity.pendingResults=new HashSet<WeakReference<PendingIntentRecord>>();
      }
      activity.pendingResults.add(rec.ref);
    }
    return rec;
  }
}

Fixed version (ground truth):
public IIntentSender getIntentSender(int type,String packageName,IBinder token,String resultWho,int requestCode,Intent intent,String resolvedType,int flags){
  if (intent != null && intent.hasFileDescriptors() == true) {
    throw new IllegalArgumentException("String_Node_Str");
  }
synchronized (this) {
    int callingUid=Binder.getCallingUid();
    try {
      if (callingUid != 0 && callingUid != Process.SYSTEM_UID && Process.supportsProcesses()) {
        int uid=ActivityThread.getPackageManager().getPackageUid(packageName);
        if (uid != Binder.getCallingUid()) {
          String msg="String_Node_Str" + Binder.getCallingPid() + "String_Node_Str"+ Binder.getCallingUid()+ "String_Node_Str"+ uid+ "String_Node_Str"+ "String_Node_Str"+ packageName;
          Log.w(TAG,msg);
          throw new SecurityException(msg);
        }
      }
    }
 catch (    RemoteException e) {
      throw new SecurityException(e);
    }
    HistoryRecord activity=null;
    if (type == INTENT_SENDER_ACTIVITY_RESULT) {
      int index=indexOfTokenLocked(token);
      if (index < 0) {
        return null;
      }
      activity=(HistoryRecord)mHistory.get(index);
      if (activity.finishing) {
        return null;
      }
    }
    final boolean noCreate=(flags & PendingIntent.FLAG_NO_CREATE) != 0;
    final boolean cancelCurrent=(flags & PendingIntent.FLAG_CANCEL_CURRENT) != 0;
    final boolean updateCurrent=(flags & PendingIntent.FLAG_UPDATE_CURRENT) != 0;
    flags&=~(PendingIntent.FLAG_NO_CREATE | PendingIntent.FLAG_CANCEL_CURRENT | PendingIntent.FLAG_UPDATE_CURRENT);
    PendingIntentRecord.Key key=new PendingIntentRecord.Key(type,packageName,activity,resultWho,requestCode,intent,resolvedType,flags);
    WeakReference<PendingIntentRecord> ref;
    ref=mIntentSenderRecords.get(key);
    PendingIntentRecord rec=ref != null ? ref.get() : null;
    if (rec != null) {
      if (!cancelCurrent) {
        if (updateCurrent) {
          rec.key.requestIntent.replaceExtras(intent);
        }
        return rec;
      }
      rec.canceled=true;
      mIntentSenderRecords.remove(key);
    }
    if (noCreate) {
      return rec;
    }
    rec=new PendingIntentRecord(this,key,callingUid);
    mIntentSenderRecords.put(key,rec.ref);
    if (type == INTENT_SENDER_ACTIVITY_RESULT) {
      if (activity.pendingResults == null) {
        activity.pendingResults=new HashSet<WeakReference<PendingIntentRecord>>();
      }
      activity.pendingResults.add(rec.ref);
    }
    return rec;
  }
}