Program: 1788
Project: 1788
Buggy source:
private ServiceLookupResult retrieveServiceLocked(Intent service,String resolvedType,int callingPid,int callingUid,int userId,boolean createIfNeeded){
  ServiceRecord r=null;
  if (DEBUG_SERVICE)   Slog.v(TAG,"String_Node_Str" + service + "String_Node_Str"+ resolvedType+ "String_Node_Str"+ callingUid);
  userId=mAm.handleIncomingUser(callingPid,callingUid,userId,false,true,"String_Node_Str",null);
  if (service.getComponent() != null) {
    r=mServiceMap.getServiceByName(service.getComponent(),userId);
  }
  if (r == null) {
    Intent.FilterComparison filter=new Intent.FilterComparison(service);
    r=mServiceMap.getServiceByIntent(filter,userId);
  }
  if (r == null) {
    try {
      ResolveInfo rInfo=AppGlobals.getPackageManager().resolveService(service,resolvedType,ActivityManagerService.STOCK_PM_FLAGS,userId);
      ServiceInfo sInfo=rInfo != null ? rInfo.serviceInfo : null;
      if (sInfo == null) {
        Slog.w(TAG,"String_Node_Str" + service + "String_Node_Str"+ userId+ "String_Node_Str");
        return null;
      }
      ComponentName name=new ComponentName(sInfo.applicationInfo.packageName,sInfo.name);
      if (userId > 0) {
        if (mAm.isSingleton(sInfo.processName,sInfo.applicationInfo,sInfo.name,sInfo.flags)) {
          userId=0;
        }
        sInfo=new ServiceInfo(sInfo);
        sInfo.applicationInfo=mAm.getAppInfoForUser(sInfo.applicationInfo,userId);
      }
      r=mServiceMap.getServiceByName(name,userId);
      if (r == null && createIfNeeded) {
        Intent.FilterComparison filter=new Intent.FilterComparison(service.cloneFilter());
        ServiceRestarter res=new ServiceRestarter();
        BatteryStatsImpl.Uid.Pkg.Serv ss=null;
        BatteryStatsImpl stats=mAm.mBatteryStatsService.getActiveStatistics();
synchronized (stats) {
          ss=stats.getServiceStatsLocked(sInfo.applicationInfo.uid,sInfo.packageName,sInfo.name);
        }
        ProcessTracker.ServiceState tracker=null;
        if ((sInfo.applicationInfo.flags & ApplicationInfo.FLAG_PERSISTENT) == 0) {
          tracker=mAm.mProcessTracker.getServiceStateLocked(sInfo.packageName,sInfo.applicationInfo.uid,sInfo.name);
        }
        r=new ServiceRecord(mAm,ss,name,filter,sInfo,res,tracker);
        res.setService(r);
        mServiceMap.putServiceByName(name,UserHandle.getUserId(r.appInfo.uid),r);
        mServiceMap.putServiceByIntent(filter,UserHandle.getUserId(r.appInfo.uid),r);
        int N=mPendingServices.size();
        for (int i=0; i < N; i++) {
          ServiceRecord pr=mPendingServices.get(i);
          if (pr.serviceInfo.applicationInfo.uid == sInfo.applicationInfo.uid && pr.name.equals(name)) {
            mPendingServices.remove(i);
            i--;
            N--;
          }
        }
      }
    }
 catch (    RemoteException ex) {
    }
  }
  if (r != null) {
    if (mAm.checkComponentPermission(r.permission,callingPid,callingUid,r.appInfo.uid,r.exported) != PackageManager.PERMISSION_GRANTED) {
      if (!r.exported) {
        Slog.w(TAG,"String_Node_Str" + r.name + "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid+ "String_Node_Str"+ r.appInfo.uid);
        return new ServiceLookupResult(null,"String_Node_Str" + r.appInfo.uid);
      }
      Slog.w(TAG,"String_Node_Str" + r.name + "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid+ "String_Node_Str"+ r.permission);
      return new ServiceLookupResult(null,r.permission);
    }
    return new ServiceLookupResult(r,null);
  }
  return null;
}

Fixed version (ground truth):
private ServiceLookupResult retrieveServiceLocked(Intent service,String resolvedType,int callingPid,int callingUid,int userId,boolean createIfNeeded){
  ServiceRecord r=null;
  if (DEBUG_SERVICE)   Slog.v(TAG,"String_Node_Str" + service + "String_Node_Str"+ resolvedType+ "String_Node_Str"+ callingUid);
  userId=mAm.handleIncomingUser(callingPid,callingUid,userId,false,true,"String_Node_Str",null);
  if (service.getComponent() != null) {
    r=mServiceMap.getServiceByName(service.getComponent(),userId);
  }
  if (r == null) {
    Intent.FilterComparison filter=new Intent.FilterComparison(service);
    r=mServiceMap.getServiceByIntent(filter,userId);
  }
  if (r == null) {
    try {
      ResolveInfo rInfo=AppGlobals.getPackageManager().resolveService(service,resolvedType,ActivityManagerService.STOCK_PM_FLAGS,userId);
      ServiceInfo sInfo=rInfo != null ? rInfo.serviceInfo : null;
      if (sInfo == null) {
        Slog.w(TAG,"String_Node_Str" + service + "String_Node_Str"+ userId+ "String_Node_Str");
        return null;
      }
      ComponentName name=new ComponentName(sInfo.applicationInfo.packageName,sInfo.name);
      if (userId > 0) {
        if (mAm.isSingleton(sInfo.processName,sInfo.applicationInfo,sInfo.name,sInfo.flags)) {
          userId=0;
        }
        sInfo=new ServiceInfo(sInfo);
        sInfo.applicationInfo=mAm.getAppInfoForUser(sInfo.applicationInfo,userId);
      }
      r=mServiceMap.getServiceByName(name,userId);
      if (r == null && createIfNeeded) {
        Intent.FilterComparison filter=new Intent.FilterComparison(service.cloneFilter());
        ServiceRestarter res=new ServiceRestarter();
        BatteryStatsImpl.Uid.Pkg.Serv ss=null;
        BatteryStatsImpl stats=mAm.mBatteryStatsService.getActiveStatistics();
synchronized (stats) {
          ss=stats.getServiceStatsLocked(sInfo.applicationInfo.uid,sInfo.packageName,sInfo.name);
        }
        r=new ServiceRecord(mAm,ss,name,filter,sInfo,res);
        res.setService(r);
        mServiceMap.putServiceByName(name,UserHandle.getUserId(r.appInfo.uid),r);
        mServiceMap.putServiceByIntent(filter,UserHandle.getUserId(r.appInfo.uid),r);
        int N=mPendingServices.size();
        for (int i=0; i < N; i++) {
          ServiceRecord pr=mPendingServices.get(i);
          if (pr.serviceInfo.applicationInfo.uid == sInfo.applicationInfo.uid && pr.name.equals(name)) {
            mPendingServices.remove(i);
            i--;
            N--;
          }
        }
      }
    }
 catch (    RemoteException ex) {
    }
  }
  if (r != null) {
    if (mAm.checkComponentPermission(r.permission,callingPid,callingUid,r.appInfo.uid,r.exported) != PackageManager.PERMISSION_GRANTED) {
      if (!r.exported) {
        Slog.w(TAG,"String_Node_Str" + r.name + "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid+ "String_Node_Str"+ r.appInfo.uid);
        return new ServiceLookupResult(null,"String_Node_Str" + r.appInfo.uid);
      }
      Slog.w(TAG,"String_Node_Str" + r.name + "String_Node_Str"+ callingPid+ "String_Node_Str"+ callingUid+ "String_Node_Str"+ r.permission);
      return new ServiceLookupResult(null,r.permission);
    }
    return new ServiceLookupResult(r,null);
  }
  return null;
}