Program: 22010
Project: 22010
Buggy source:
private final ContentProviderHolder getContentProviderImpl(IApplicationThread caller,String name){
  ContentProviderRecord cpr;
  ProviderInfo cpi=null;
synchronized (this) {
    ProcessRecord r=null;
    if (caller != null) {
      r=getRecordForAppLocked(caller);
      if (r == null) {
        throw new SecurityException("String_Node_Str" + caller + "String_Node_Str"+ Binder.getCallingPid()+ "String_Node_Str"+ name);
      }
    }
    cpr=mProvidersByName.get(name);
    if (cpr != null) {
      cpi=cpr.info;
      if (checkContentProviderPermissionLocked(cpi,r,-1) != null) {
        return new ContentProviderHolder(cpi,cpi.readPermission != null ? cpi.readPermission : cpi.writePermission);
      }
      if (r != null && cpr.canRunHere(r)) {
        if (cpr.provider != null) {
          cpr=new ContentProviderRecord(cpr);
        }
        return cpr;
      }
      final long origId=Binder.clearCallingIdentity();
      if (r != null) {
        if (DEBUG_PROVIDER)         Slog.v(TAG,"String_Node_Str" + r.processName + "String_Node_Str"+ cpr.info.processName);
        Integer cnt=r.conProviders.get(cpr);
        if (cnt == null) {
          r.conProviders.put(cpr,new Integer(1));
        }
 else {
          r.conProviders.put(cpr,new Integer(cnt.intValue() + 1));
        }
        cpr.clients.add(r);
        if (cpr.app != null && r.setAdj <= PERCEPTIBLE_APP_ADJ) {
          updateLruProcessLocked(cpr.app,false,true);
        }
      }
 else {
        cpr.externals++;
      }
      if (cpr.app != null) {
        updateOomAdjLocked(cpr.app);
      }
      Binder.restoreCallingIdentity(origId);
    }
 else {
      try {
        cpi=AppGlobals.getPackageManager().resolveContentProvider(name,STOCK_PM_FLAGS | PackageManager.GET_URI_PERMISSION_PATTERNS);
      }
 catch (      RemoteException ex) {
      }
      if (cpi == null) {
        return null;
      }
      if (checkContentProviderPermissionLocked(cpi,r,-1) != null) {
        return new ContentProviderHolder(cpi,cpi.readPermission != null ? cpi.readPermission : cpi.writePermission);
      }
      if (!mSystemReady && !mDidUpdate && !mWaitingUpdate&& !cpi.processName.equals("String_Node_Str")) {
        throw new IllegalArgumentException("String_Node_Str");
      }
      cpr=mProvidersByClass.get(cpi.name);
      final boolean firstClass=cpr == null;
      if (firstClass) {
        try {
          ApplicationInfo ai=AppGlobals.getPackageManager().getApplicationInfo(cpi.applicationInfo.packageName,STOCK_PM_FLAGS);
          if (ai == null) {
            Slog.w(TAG,"String_Node_Str" + cpi.name);
            return null;
          }
          cpr=new ContentProviderRecord(cpi,ai);
        }
 catch (        RemoteException ex) {
        }
      }
      if (r != null && cpr.canRunHere(r)) {
        return cpr;
      }
      if (DEBUG_PROVIDER) {
        RuntimeException e=new RuntimeException("String_Node_Str");
        Slog.w(TAG,"String_Node_Str" + r.info.uid + "String_Node_Str"+ cpr.appInfo.uid+ "String_Node_Str"+ cpr.info.name,e);
      }
      final int N=mLaunchingProviders.size();
      int i;
      for (i=0; i < N; i++) {
        if (mLaunchingProviders.get(i) == cpr) {
          break;
        }
      }
      if (i >= N) {
        final long origId=Binder.clearCallingIdentity();
        ProcessRecord proc=startProcessLocked(cpi.processName,cpr.appInfo,false,0,"String_Node_Str",new ComponentName(cpi.applicationInfo.packageName,cpi.name),false);
        if (proc == null) {
          Slog.w(TAG,"String_Node_Str" + cpi.applicationInfo.packageName + "String_Node_Str"+ cpi.applicationInfo.uid+ "String_Node_Str"+ name+ "String_Node_Str");
          return null;
        }
        cpr.launchingApp=proc;
        mLaunchingProviders.add(cpr);
        Binder.restoreCallingIdentity(origId);
      }
      if (firstClass) {
        mProvidersByClass.put(cpi.name,cpr);
      }
      mProvidersByName.put(name,cpr);
      if (r != null) {
        if (DEBUG_PROVIDER)         Slog.v(TAG,"String_Node_Str" + r.processName + "String_Node_Str"+ cpr.info.processName);
        Integer cnt=r.conProviders.get(cpr);
        if (cnt == null) {
          r.conProviders.put(cpr,new Integer(1));
        }
 else {
          r.conProviders.put(cpr,new Integer(cnt.intValue() + 1));
        }
        cpr.clients.add(r);
      }
 else {
        cpr.externals++;
      }
    }
  }
synchronized (cpr) {
    while (cpr.provider == null) {
      if (cpr.launchingApp == null) {
        Slog.w(TAG,"String_Node_Str" + cpi.applicationInfo.packageName + "String_Node_Str"+ cpi.applicationInfo.uid+ "String_Node_Str"+ name+ "String_Node_Str");
        EventLog.writeEvent(EventLogTags.AM_PROVIDER_LOST_PROCESS,cpi.applicationInfo.packageName,cpi.applicationInfo.uid,name);
        return null;
      }
      try {
        cpr.wait();
      }
 catch (      InterruptedException ex) {
      }
    }
  }
  return cpr;
}

Fixed version (ground truth):
private final ContentProviderHolder getContentProviderImpl(IApplicationThread caller,String name){
  ContentProviderRecord cpr;
  ProviderInfo cpi=null;
synchronized (this) {
    ProcessRecord r=null;
    if (caller != null) {
      r=getRecordForAppLocked(caller);
      if (r == null) {
        throw new SecurityException("String_Node_Str" + caller + "String_Node_Str"+ Binder.getCallingPid()+ "String_Node_Str"+ name);
      }
    }
    cpr=mProvidersByName.get(name);
    if (cpr != null) {
      cpi=cpr.info;
      String msg;
      if ((msg=checkContentProviderPermissionLocked(cpi,r)) != null) {
        throw new SecurityException(msg);
      }
      if (r != null && cpr.canRunHere(r)) {
        if (cpr.provider != null) {
          cpr=new ContentProviderRecord(cpr);
        }
        return cpr;
      }
      final long origId=Binder.clearCallingIdentity();
      if (r != null) {
        if (DEBUG_PROVIDER)         Slog.v(TAG,"String_Node_Str" + r.processName + "String_Node_Str"+ cpr.info.processName);
        Integer cnt=r.conProviders.get(cpr);
        if (cnt == null) {
          r.conProviders.put(cpr,new Integer(1));
        }
 else {
          r.conProviders.put(cpr,new Integer(cnt.intValue() + 1));
        }
        cpr.clients.add(r);
        if (cpr.app != null && r.setAdj <= PERCEPTIBLE_APP_ADJ) {
          updateLruProcessLocked(cpr.app,false,true);
        }
      }
 else {
        cpr.externals++;
      }
      if (cpr.app != null) {
        updateOomAdjLocked(cpr.app);
      }
      Binder.restoreCallingIdentity(origId);
    }
 else {
      try {
        cpi=AppGlobals.getPackageManager().resolveContentProvider(name,STOCK_PM_FLAGS | PackageManager.GET_URI_PERMISSION_PATTERNS);
      }
 catch (      RemoteException ex) {
      }
      if (cpi == null) {
        return null;
      }
      String msg;
      if ((msg=checkContentProviderPermissionLocked(cpi,r)) != null) {
        throw new SecurityException(msg);
      }
      if (!mSystemReady && !mDidUpdate && !mWaitingUpdate&& !cpi.processName.equals("String_Node_Str")) {
        throw new IllegalArgumentException("String_Node_Str");
      }
      cpr=mProvidersByClass.get(cpi.name);
      final boolean firstClass=cpr == null;
      if (firstClass) {
        try {
          ApplicationInfo ai=AppGlobals.getPackageManager().getApplicationInfo(cpi.applicationInfo.packageName,STOCK_PM_FLAGS);
          if (ai == null) {
            Slog.w(TAG,"String_Node_Str" + cpi.name);
            return null;
          }
          cpr=new ContentProviderRecord(cpi,ai);
        }
 catch (        RemoteException ex) {
        }
      }
      if (r != null && cpr.canRunHere(r)) {
        return cpr;
      }
      if (DEBUG_PROVIDER) {
        RuntimeException e=new RuntimeException("String_Node_Str");
        Slog.w(TAG,"String_Node_Str" + r.info.uid + "String_Node_Str"+ cpr.appInfo.uid+ "String_Node_Str"+ cpr.info.name,e);
      }
      final int N=mLaunchingProviders.size();
      int i;
      for (i=0; i < N; i++) {
        if (mLaunchingProviders.get(i) == cpr) {
          break;
        }
      }
      if (i >= N) {
        final long origId=Binder.clearCallingIdentity();
        ProcessRecord proc=startProcessLocked(cpi.processName,cpr.appInfo,false,0,"String_Node_Str",new ComponentName(cpi.applicationInfo.packageName,cpi.name),false);
        if (proc == null) {
          Slog.w(TAG,"String_Node_Str" + cpi.applicationInfo.packageName + "String_Node_Str"+ cpi.applicationInfo.uid+ "String_Node_Str"+ name+ "String_Node_Str");
          return null;
        }
        cpr.launchingApp=proc;
        mLaunchingProviders.add(cpr);
        Binder.restoreCallingIdentity(origId);
      }
      if (firstClass) {
        mProvidersByClass.put(cpi.name,cpr);
      }
      mProvidersByName.put(name,cpr);
      if (r != null) {
        if (DEBUG_PROVIDER)         Slog.v(TAG,"String_Node_Str" + r.processName + "String_Node_Str"+ cpr.info.processName);
        Integer cnt=r.conProviders.get(cpr);
        if (cnt == null) {
          r.conProviders.put(cpr,new Integer(1));
        }
 else {
          r.conProviders.put(cpr,new Integer(cnt.intValue() + 1));
        }
        cpr.clients.add(r);
      }
 else {
        cpr.externals++;
      }
    }
  }
synchronized (cpr) {
    while (cpr.provider == null) {
      if (cpr.launchingApp == null) {
        Slog.w(TAG,"String_Node_Str" + cpi.applicationInfo.packageName + "String_Node_Str"+ cpi.applicationInfo.uid+ "String_Node_Str"+ name+ "String_Node_Str");
        EventLog.writeEvent(EventLogTags.AM_PROVIDER_LOST_PROCESS,cpi.applicationInfo.packageName,cpi.applicationInfo.uid,name);
        return null;
      }
      try {
        cpr.wait();
      }
 catch (      InterruptedException ex) {
      }
    }
  }
  return cpr;
}