Program: 21735
Project: 21735
Buggy source:
private void replaceSystemPackageLI(PackageParser.Package deletedPackage,PackageParser.Package pkg,int parseFlags,int scanMode,String installerPackageName,PackageInstalledInfo res){
  PackageParser.Package newPackage=null;
  boolean updatedSettings=false;
  parseFlags|=PackageManager.INSTALL_REPLACE_EXISTING | PackageParser.PARSE_IS_SYSTEM;
  String packageName=deletedPackage.packageName;
  res.returnCode=PackageManager.INSTALL_FAILED_REPLACE_COULDNT_DELETE;
  if (packageName == null) {
    Slog.w(TAG,"String_Node_Str");
    return;
  }
  PackageParser.Package oldPkg;
  PackageSetting oldPkgSetting;
synchronized (mPackages) {
    oldPkg=mPackages.get(packageName);
    oldPkgSetting=mSettings.mPackages.get(packageName);
    if ((oldPkg == null) || (oldPkg.applicationInfo == null) || (oldPkgSetting == null)) {
      Slog.w(TAG,"String_Node_Str" + packageName + "String_Node_Str");
      return;
    }
  }
  res.removedInfo.uid=oldPkg.applicationInfo.uid;
  res.removedInfo.removedPackage=packageName;
  removePackageLI(oldPkg,true);
  mLastScanError=PackageManager.INSTALL_SUCCEEDED;
  pkg.applicationInfo.flags|=ApplicationInfo.FLAG_UPDATED_SYSTEM_APP;
  newPackage=scanPackageLI(pkg,parseFlags,scanMode,0);
  if (newPackage == null) {
    Slog.w(TAG,"String_Node_Str" + pkg.mPath);
    if ((res.returnCode=mLastScanError) == PackageManager.INSTALL_SUCCEEDED) {
      res.returnCode=PackageManager.INSTALL_FAILED_INVALID_APK;
    }
  }
 else {
    if (newPackage.mExtras != null) {
      final PackageSetting newPkgSetting=(PackageSetting)newPackage.mExtras;
      newPkgSetting.firstInstallTime=oldPkgSetting.firstInstallTime;
      newPkgSetting.lastUpdateTime=System.currentTimeMillis();
    }
    updateSettingsLI(newPackage,installerPackageName,res);
    updatedSettings=true;
  }
  if (res.returnCode != PackageManager.INSTALL_SUCCEEDED) {
    if (newPackage != null) {
      removePackageLI(newPackage,true);
    }
    scanPackageLI(oldPkg,parseFlags,SCAN_MONITOR | SCAN_UPDATE_SIGNATURE,0);
synchronized (mPackages) {
      if (updatedSettings) {
        mSettings.enableSystemPackageLP(packageName);
        mSettings.setInstallerPackageName(packageName,oldPkgSetting.installerPackageName);
      }
      mSettings.writeLP();
    }
  }
 else {
synchronized (mPackages) {
      PackageSetting ps=mSettings.getDisabledSystemPkg(packageName);
      if (ps != null && ps.codePathString != null && !ps.codePathString.equals(oldPkgSetting.codePathString)) {
        res.removedInfo.args=createInstallArgs(0,oldPkgSetting.codePathString,oldPkgSetting.resourcePathString,oldPkgSetting.nativeLibraryPathString);
      }
    }
  }
}

Fixed version (ground truth):
private void replaceSystemPackageLI(PackageParser.Package deletedPackage,PackageParser.Package pkg,int parseFlags,int scanMode,String installerPackageName,PackageInstalledInfo res){
  PackageParser.Package newPackage=null;
  boolean updatedSettings=false;
  parseFlags|=PackageManager.INSTALL_REPLACE_EXISTING | PackageParser.PARSE_IS_SYSTEM;
  String packageName=deletedPackage.packageName;
  res.returnCode=PackageManager.INSTALL_FAILED_REPLACE_COULDNT_DELETE;
  if (packageName == null) {
    Slog.w(TAG,"String_Node_Str");
    return;
  }
  PackageParser.Package oldPkg;
  PackageSetting oldPkgSetting;
synchronized (mPackages) {
    oldPkg=mPackages.get(packageName);
    oldPkgSetting=mSettings.mPackages.get(packageName);
    if ((oldPkg == null) || (oldPkg.applicationInfo == null) || (oldPkgSetting == null)) {
      Slog.w(TAG,"String_Node_Str" + packageName + "String_Node_Str");
      return;
    }
  }
  res.removedInfo.uid=oldPkg.applicationInfo.uid;
  res.removedInfo.removedPackage=packageName;
  removePackageLI(oldPkg,true);
synchronized (mPackages) {
    mSettings.disableSystemPackageLP(packageName);
  }
  mLastScanError=PackageManager.INSTALL_SUCCEEDED;
  pkg.applicationInfo.flags|=ApplicationInfo.FLAG_UPDATED_SYSTEM_APP;
  newPackage=scanPackageLI(pkg,parseFlags,scanMode,0);
  if (newPackage == null) {
    Slog.w(TAG,"String_Node_Str" + pkg.mPath);
    if ((res.returnCode=mLastScanError) == PackageManager.INSTALL_SUCCEEDED) {
      res.returnCode=PackageManager.INSTALL_FAILED_INVALID_APK;
    }
  }
 else {
    if (newPackage.mExtras != null) {
      final PackageSetting newPkgSetting=(PackageSetting)newPackage.mExtras;
      newPkgSetting.firstInstallTime=oldPkgSetting.firstInstallTime;
      newPkgSetting.lastUpdateTime=System.currentTimeMillis();
    }
    updateSettingsLI(newPackage,installerPackageName,res);
    updatedSettings=true;
  }
  if (res.returnCode != PackageManager.INSTALL_SUCCEEDED) {
    if (newPackage != null) {
      removePackageLI(newPackage,true);
    }
    scanPackageLI(oldPkg,parseFlags,SCAN_MONITOR | SCAN_UPDATE_SIGNATURE,0);
synchronized (mPackages) {
      if (updatedSettings) {
        mSettings.enableSystemPackageLP(packageName);
        mSettings.setInstallerPackageName(packageName,oldPkgSetting.installerPackageName);
      }
      mSettings.writeLP();
    }
  }
 else {
synchronized (mPackages) {
      PackageSetting ps=mSettings.getDisabledSystemPkg(packageName);
      if (ps != null && ps.codePathString != null && !ps.codePathString.equals(oldPkgSetting.codePathString)) {
        res.removedInfo.args=createInstallArgs(0,oldPkgSetting.codePathString,oldPkgSetting.resourcePathString,oldPkgSetting.nativeLibraryPathString);
      }
    }
  }
}