Program: 43470
Project: 43470
Buggy source:
/** 
 * @return Returns true if event was dispatched, false if it was dropped for any reason
 */
private int dispatchPointer(QueuedEvent qev,MotionEvent ev,int pid,int uid){
  if (DEBUG_INPUT || WindowManagerPolicy.WATCH_POINTER)   Log.v(TAG,"String_Node_Str" + ev);
  Object targetObj=mKeyWaiter.waitForNextEventTarget(null,qev,ev,true,false);
  int action=ev.getAction();
  if (action == MotionEvent.ACTION_UP) {
    mKeyWaiter.mMotionTarget=null;
    mPowerManager.logPointerUpEvent();
  }
 else   if (action == MotionEvent.ACTION_DOWN) {
    mPowerManager.logPointerDownEvent();
  }
  if (targetObj == null) {
    if (action != MotionEvent.ACTION_MOVE) {
      Log.w(TAG,"String_Node_Str" + ev.getAction());
    }
    if (qev != null) {
      mQueue.recycleEvent(qev);
    }
    ev.recycle();
    return INJECT_FAILED;
  }
  if (targetObj == mKeyWaiter.CONSUMED_EVENT_TOKEN) {
    if (qev != null) {
      mQueue.recycleEvent(qev);
    }
    ev.recycle();
    return INJECT_SUCCEEDED;
  }
  WindowState target=(WindowState)targetObj;
  final long eventTime=ev.getEventTime();
  if (uid != 0 && uid != target.mSession.mUid) {
    if (mContext.checkPermission(android.Manifest.permission.INJECT_EVENTS,pid,uid) != PackageManager.PERMISSION_GRANTED) {
      Log.w(TAG,"String_Node_Str" + pid + "String_Node_Str"+ uid+ "String_Node_Str"+ target+ "String_Node_Str"+ target.mSession.mUid);
      if (qev != null) {
        mQueue.recycleEvent(qev);
      }
      ev.recycle();
      return INJECT_NO_PERMISSION;
    }
  }
  if ((target.mAttrs.flags & WindowManager.LayoutParams.FLAG_IGNORE_CHEEK_PRESSES) != 0) {
    boolean cheekPress=mPolicy.isCheekPressedAgainstScreen(ev);
    boolean returnFlag=false;
    if ((action == MotionEvent.ACTION_DOWN)) {
      mFatTouch=false;
      if (cheekPress) {
        mFatTouch=true;
        returnFlag=true;
      }
    }
 else {
      if (action == MotionEvent.ACTION_UP) {
        if (mFatTouch) {
          mFatTouch=false;
          returnFlag=true;
        }
 else         if (cheekPress) {
          ev.setAction(MotionEvent.ACTION_CANCEL);
          action=MotionEvent.ACTION_CANCEL;
        }
      }
 else       if (action == MotionEvent.ACTION_MOVE) {
        if (mFatTouch) {
          returnFlag=true;
        }
 else         if (cheekPress) {
          ev.setAction(MotionEvent.ACTION_CANCEL);
          action=MotionEvent.ACTION_CANCEL;
          if (DEBUG_INPUT)           Log.v(TAG,"String_Node_Str");
          mFatTouch=true;
        }
      }
    }
    if (returnFlag) {
      if (qev != null) {
        mQueue.recycleEvent(qev);
      }
      ev.recycle();
      return INJECT_FAILED;
    }
  }
  if (action == MotionEvent.ACTION_DOWN) {
    int max_events_per_sec=35;
    try {
      max_events_per_sec=Integer.parseInt(SystemProperties.get("String_Node_Str"));
      if (max_events_per_sec < 1) {
        max_events_per_sec=35;
      }
    }
 catch (    NumberFormatException e) {
    }
    mMinWaitTimeBetweenTouchEvents=1000 / max_events_per_sec;
  }
  if (action == MotionEvent.ACTION_MOVE) {
    long nextEventTime=mLastTouchEventTime + mMinWaitTimeBetweenTouchEvents;
    long now=SystemClock.uptimeMillis();
    if (now < nextEventTime) {
      try {
        Thread.sleep(nextEventTime - now);
      }
 catch (      InterruptedException e) {
      }
      mLastTouchEventTime=nextEventTime;
    }
 else {
      mLastTouchEventTime=now;
    }
  }
synchronized (mWindowMap) {
    if (qev != null && action == MotionEvent.ACTION_MOVE) {
      mKeyWaiter.bindTargetWindowLocked(target,KeyWaiter.RETURN_PENDING_POINTER,qev);
      ev=null;
    }
 else {
      if (action == MotionEvent.ACTION_DOWN) {
        WindowState out=mKeyWaiter.mOutsideTouchTargets;
        if (out != null) {
          MotionEvent oev=MotionEvent.obtain(ev);
          oev.setAction(MotionEvent.ACTION_OUTSIDE);
          do {
            final Rect frame=out.mFrame;
            oev.offsetLocation(-(float)frame.left,-(float)frame.top);
            try {
              out.mClient.dispatchPointer(oev,eventTime);
            }
 catch (            android.os.RemoteException e) {
              Log.i(TAG,"String_Node_Str" + out);
            }
            oev.offsetLocation((float)frame.left,(float)frame.top);
            out=out.mNextOutsideTouch;
          }
 while (out != null);
          mKeyWaiter.mOutsideTouchTargets=null;
        }
      }
      final Rect frame=target.mFrame;
      ev.offsetLocation(-(float)frame.left,-(float)frame.top);
      mKeyWaiter.bindTargetWindowLocked(target);
    }
  }
  try {
    if (DEBUG_INPUT || DEBUG_FOCUS || WindowManagerPolicy.WATCH_POINTER) {
      Log.v(TAG,"String_Node_Str" + qev + "String_Node_Str"+ target);
    }
    target.mClient.dispatchPointer(ev,eventTime);
    return INJECT_SUCCEEDED;
  }
 catch (  android.os.RemoteException e) {
    Log.i(TAG,"String_Node_Str" + target);
    mKeyWaiter.mMotionTarget=null;
    try {
      removeWindow(target.mSession,target.mClient);
    }
 catch (    java.util.NoSuchElementException ex) {
    }
  }
  return INJECT_FAILED;
}

Fixed version (ground truth):
/** 
 * @return Returns true if event was dispatched, false if it was dropped for any reason
 */
private int dispatchPointer(QueuedEvent qev,MotionEvent ev,int pid,int uid){
  if (DEBUG_INPUT || WindowManagerPolicy.WATCH_POINTER)   Log.v(TAG,"String_Node_Str" + ev);
  Object targetObj=mKeyWaiter.waitForNextEventTarget(null,qev,ev,true,false,pid,uid);
  int action=ev.getAction();
  if (action == MotionEvent.ACTION_UP) {
    mKeyWaiter.mMotionTarget=null;
    mPowerManager.logPointerUpEvent();
  }
 else   if (action == MotionEvent.ACTION_DOWN) {
    mPowerManager.logPointerDownEvent();
  }
  if (targetObj == null) {
    if (action != MotionEvent.ACTION_MOVE) {
      Log.w(TAG,"String_Node_Str" + ev.getAction());
    }
    if (qev != null) {
      mQueue.recycleEvent(qev);
    }
    ev.recycle();
    return INJECT_FAILED;
  }
  if (targetObj == mKeyWaiter.CONSUMED_EVENT_TOKEN) {
    if (qev != null) {
      mQueue.recycleEvent(qev);
    }
    ev.recycle();
    return INJECT_SUCCEEDED;
  }
  WindowState target=(WindowState)targetObj;
  final long eventTime=ev.getEventTime();
  if (uid != 0 && uid != target.mSession.mUid) {
    if (mContext.checkPermission(android.Manifest.permission.INJECT_EVENTS,pid,uid) != PackageManager.PERMISSION_GRANTED) {
      Log.w(TAG,"String_Node_Str" + pid + "String_Node_Str"+ uid+ "String_Node_Str"+ target+ "String_Node_Str"+ target.mSession.mUid);
      if (qev != null) {
        mQueue.recycleEvent(qev);
      }
      ev.recycle();
      return INJECT_NO_PERMISSION;
    }
  }
  if ((target.mAttrs.flags & WindowManager.LayoutParams.FLAG_IGNORE_CHEEK_PRESSES) != 0) {
    boolean cheekPress=mPolicy.isCheekPressedAgainstScreen(ev);
    boolean returnFlag=false;
    if ((action == MotionEvent.ACTION_DOWN)) {
      mFatTouch=false;
      if (cheekPress) {
        mFatTouch=true;
        returnFlag=true;
      }
    }
 else {
      if (action == MotionEvent.ACTION_UP) {
        if (mFatTouch) {
          mFatTouch=false;
          returnFlag=true;
        }
 else         if (cheekPress) {
          ev.setAction(MotionEvent.ACTION_CANCEL);
          action=MotionEvent.ACTION_CANCEL;
        }
      }
 else       if (action == MotionEvent.ACTION_MOVE) {
        if (mFatTouch) {
          returnFlag=true;
        }
 else         if (cheekPress) {
          ev.setAction(MotionEvent.ACTION_CANCEL);
          action=MotionEvent.ACTION_CANCEL;
          if (DEBUG_INPUT)           Log.v(TAG,"String_Node_Str");
          mFatTouch=true;
        }
      }
    }
    if (returnFlag) {
      if (qev != null) {
        mQueue.recycleEvent(qev);
      }
      ev.recycle();
      return INJECT_FAILED;
    }
  }
  if (action == MotionEvent.ACTION_DOWN) {
    int max_events_per_sec=35;
    try {
      max_events_per_sec=Integer.parseInt(SystemProperties.get("String_Node_Str"));
      if (max_events_per_sec < 1) {
        max_events_per_sec=35;
      }
    }
 catch (    NumberFormatException e) {
    }
    mMinWaitTimeBetweenTouchEvents=1000 / max_events_per_sec;
  }
  if (action == MotionEvent.ACTION_MOVE) {
    long nextEventTime=mLastTouchEventTime + mMinWaitTimeBetweenTouchEvents;
    long now=SystemClock.uptimeMillis();
    if (now < nextEventTime) {
      try {
        Thread.sleep(nextEventTime - now);
      }
 catch (      InterruptedException e) {
      }
      mLastTouchEventTime=nextEventTime;
    }
 else {
      mLastTouchEventTime=now;
    }
  }
synchronized (mWindowMap) {
    if (qev != null && action == MotionEvent.ACTION_MOVE) {
      mKeyWaiter.bindTargetWindowLocked(target,KeyWaiter.RETURN_PENDING_POINTER,qev);
      ev=null;
    }
 else {
      if (action == MotionEvent.ACTION_DOWN) {
        WindowState out=mKeyWaiter.mOutsideTouchTargets;
        if (out != null) {
          MotionEvent oev=MotionEvent.obtain(ev);
          oev.setAction(MotionEvent.ACTION_OUTSIDE);
          do {
            final Rect frame=out.mFrame;
            oev.offsetLocation(-(float)frame.left,-(float)frame.top);
            try {
              out.mClient.dispatchPointer(oev,eventTime);
            }
 catch (            android.os.RemoteException e) {
              Log.i(TAG,"String_Node_Str" + out);
            }
            oev.offsetLocation((float)frame.left,(float)frame.top);
            out=out.mNextOutsideTouch;
          }
 while (out != null);
          mKeyWaiter.mOutsideTouchTargets=null;
        }
      }
      final Rect frame=target.mFrame;
      ev.offsetLocation(-(float)frame.left,-(float)frame.top);
      mKeyWaiter.bindTargetWindowLocked(target);
    }
  }
  try {
    if (DEBUG_INPUT || DEBUG_FOCUS || WindowManagerPolicy.WATCH_POINTER) {
      Log.v(TAG,"String_Node_Str" + qev + "String_Node_Str"+ target);
    }
    target.mClient.dispatchPointer(ev,eventTime);
    return INJECT_SUCCEEDED;
  }
 catch (  android.os.RemoteException e) {
    Log.i(TAG,"String_Node_Str" + target);
    mKeyWaiter.mMotionTarget=null;
    try {
      removeWindow(target.mSession,target.mClient);
    }
 catch (    java.util.NoSuchElementException ex) {
    }
  }
  return INJECT_FAILED;
}