Program: 22595
Project: 22595
Buggy source:
private void replaceNonSystemPackageLI(PackageParser.Package deletedPackage,PackageParser.Package pkg,int parseFlags,int scanMode,String installerPackageName,PackageInstalledInfo res){
  PackageParser.Package newPackage=null;
  String pkgName=deletedPackage.packageName;
  boolean deletedPkg=true;
  boolean updatedSettings=false;
  String oldInstallerPackageName=null;
synchronized (mPackages) {
    oldInstallerPackageName=mSettings.getInstallerPackageName(pkgName);
  }
  parseFlags|=PackageManager.INSTALL_REPLACE_EXISTING;
  if (!deletePackageLI(pkgName,true,PackageManager.DONT_DELETE_DATA,res.removedInfo)) {
    res.returnCode=PackageManager.INSTALL_FAILED_REPLACE_COULDNT_DELETE;
    deletedPkg=false;
  }
 else {
    mLastScanError=PackageManager.INSTALL_SUCCEEDED;
    newPackage=scanPackageLI(pkg,parseFlags,scanMode);
    if (newPackage == null) {
      Slog.w(TAG,"String_Node_Str" + pkg.mPath);
      if ((res.returnCode=mLastScanError) == PackageManager.INSTALL_SUCCEEDED) {
        res.returnCode=PackageManager.INSTALL_FAILED_INVALID_APK;
      }
    }
 else {
      updateSettingsLI(newPackage,installerPackageName,res);
      updatedSettings=true;
    }
  }
  if (res.returnCode == PackageManager.INSTALL_SUCCEEDED) {
synchronized (mPackages) {
      verifySignaturesLP(mSettings.mPackages.get(pkgName),pkg,parseFlags,true);
    }
  }
 else {
    if (updatedSettings) {
      deletePackageLI(pkgName,true,PackageManager.DONT_DELETE_DATA,res.removedInfo);
    }
    if (deletedPkg) {
      File restoreFile=new File(deletedPackage.mPath);
      if (restoreFile == null) {
        Slog.e(TAG,"String_Node_Str" + pkgName);
        return;
      }
      PackageInstalledInfo restoreRes=new PackageInstalledInfo();
      restoreRes.removedInfo=new PackageRemovedInfo();
      parseFlags|=~PackageManager.INSTALL_REPLACE_EXISTING;
      scanPackageLI(restoreFile,parseFlags,scanMode);
synchronized (mPackages) {
        updatePermissionsLP(deletedPackage.packageName,deletedPackage,true,false);
        mSettings.writeLP();
      }
      if (restoreRes.returnCode != PackageManager.INSTALL_SUCCEEDED) {
        Slog.e(TAG,"String_Node_Str" + pkgName + "String_Node_Str");
      }
    }
  }
}

Fixed version (ground truth):
private void replaceNonSystemPackageLI(PackageParser.Package deletedPackage,PackageParser.Package pkg,int parseFlags,int scanMode,String installerPackageName,PackageInstalledInfo res){
  PackageParser.Package newPackage=null;
  String pkgName=deletedPackage.packageName;
  boolean deletedPkg=true;
  boolean updatedSettings=false;
  String oldInstallerPackageName=null;
synchronized (mPackages) {
    oldInstallerPackageName=mSettings.getInstallerPackageName(pkgName);
  }
  parseFlags|=PackageManager.INSTALL_REPLACE_EXISTING;
  if (!deletePackageLI(pkgName,true,PackageManager.DONT_DELETE_DATA,res.removedInfo)) {
    res.returnCode=PackageManager.INSTALL_FAILED_REPLACE_COULDNT_DELETE;
    deletedPkg=false;
  }
 else {
    mLastScanError=PackageManager.INSTALL_SUCCEEDED;
    newPackage=scanPackageLI(pkg,parseFlags,scanMode);
    if (newPackage == null) {
      Slog.w(TAG,"String_Node_Str" + pkg.mPath);
      if ((res.returnCode=mLastScanError) == PackageManager.INSTALL_SUCCEEDED) {
        res.returnCode=PackageManager.INSTALL_FAILED_INVALID_APK;
      }
    }
 else {
      updateSettingsLI(newPackage,installerPackageName,res);
      updatedSettings=true;
    }
  }
  if (res.returnCode == PackageManager.INSTALL_SUCCEEDED) {
synchronized (mPackages) {
      verifySignaturesLP(mSettings.mPackages.get(pkgName),pkg,parseFlags,true);
    }
  }
 else {
    if (updatedSettings) {
      deletePackageLI(pkgName,true,PackageManager.DONT_DELETE_DATA,res.removedInfo);
    }
    if (deletedPkg) {
      File restoreFile=new File(deletedPackage.mPath);
      if (restoreFile == null) {
        Slog.e(TAG,"String_Node_Str" + pkgName);
        return;
      }
      PackageInstalledInfo restoreRes=new PackageInstalledInfo();
      restoreRes.removedInfo=new PackageRemovedInfo();
      parseFlags&=~PackageManager.INSTALL_REPLACE_EXISTING;
      scanPackageLI(restoreFile,parseFlags,scanMode);
synchronized (mPackages) {
        updatePermissionsLP(deletedPackage.packageName,deletedPackage,true,false);
        mSettings.writeLP();
      }
      if (restoreRes.returnCode != PackageManager.INSTALL_SUCCEEDED) {
        Slog.e(TAG,"String_Node_Str" + pkgName + "String_Node_Str");
      }
    }
  }
}