Program: 152714
Project: 152714
Buggy source:
/** 
 * Return the union of MMS and SMS messages whose recipients included this phone number. Use this query: SELECT ... FROM pdu, (SELECT _id AS address_id FROM addr WHERE PHONE_NUMBERS_EQUAL(addr.address, '<phoneNumber>')) AS matching_addresses WHERE pdu._id = matching_addresses.address_id UNION SELECT ... FROM sms WHERE PHONE_NUMBERS_EQUAL(sms.address, '<phoneNumber>');
 */
private Cursor getMessagesByPhoneNumber(String phoneNumber,String[] projection,String selection,String[] selectionArgs,String sortOrder){
  String escapedPhoneNumber=DatabaseUtils.sqlEscapeString(phoneNumber);
  String finalMmsSelection=concatSelections(selection,"String_Node_Str");
  String finalSmsSelection=concatSelections(selection,"String_Node_Str" + escapedPhoneNumber + (mUseStrictPhoneNumberComparation ? "String_Node_Str" : "String_Node_Str"));
  SQLiteQueryBuilder mmsQueryBuilder=new SQLiteQueryBuilder();
  SQLiteQueryBuilder smsQueryBuilder=new SQLiteQueryBuilder();
  mmsQueryBuilder.setDistinct(true);
  smsQueryBuilder.setDistinct(true);
  mmsQueryBuilder.setTables(MmsProvider.TABLE_PDU + "String_Node_Str" + "String_Node_Str"+ escapedPhoneNumber+ (mUseStrictPhoneNumberComparation ? "String_Node_Str" : "String_Node_Str")+ "String_Node_Str");
  smsQueryBuilder.setTables(SmsProvider.TABLE_SMS);
  String[] columns=handleNullMessageProjection(projection);
  String mmsSubQuery=mmsQueryBuilder.buildUnionSubQuery(MmsSms.TYPE_DISCRIMINATOR_COLUMN,columns,MMS_COLUMNS,0,"String_Node_Str",finalMmsSelection,selectionArgs,null,null);
  String smsSubQuery=smsQueryBuilder.buildUnionSubQuery(MmsSms.TYPE_DISCRIMINATOR_COLUMN,columns,SMS_COLUMNS,0,"String_Node_Str",finalSmsSelection,selectionArgs,null,null);
  SQLiteQueryBuilder unionQueryBuilder=new SQLiteQueryBuilder();
  unionQueryBuilder.setDistinct(true);
  String unionQuery=unionQueryBuilder.buildUnionQuery(new String[]{mmsSubQuery,smsSubQuery},sortOrder,null);
  return mOpenHelper.getReadableDatabase().rawQuery(unionQuery,EMPTY_STRING_ARRAY);
}

Fixed version (ground truth):
/** 
 * Return the union of MMS and SMS messages whose recipients included this phone number. Use this query: SELECT ... FROM pdu, (SELECT _id AS address_id FROM addr WHERE (address='<phoneNumber>' OR PHONE_NUMBERS_EQUAL(addr.address, '<phoneNumber>', 1/0))) AS matching_addresses WHERE pdu._id = matching_addresses.address_id UNION SELECT ... FROM sms WHERE (address='<phoneNumber>' OR PHONE_NUMBERS_EQUAL(sms.address, '<phoneNumber>', 1/0));
 */
private Cursor getMessagesByPhoneNumber(String phoneNumber,String[] projection,String selection,String[] selectionArgs,String sortOrder){
  String escapedPhoneNumber=DatabaseUtils.sqlEscapeString(phoneNumber);
  String finalMmsSelection=concatSelections(selection,"String_Node_Str");
  String finalSmsSelection=concatSelections(selection,"String_Node_Str" + escapedPhoneNumber + "String_Node_Str"+ escapedPhoneNumber+ (mUseStrictPhoneNumberComparation ? "String_Node_Str" : "String_Node_Str"));
  SQLiteQueryBuilder mmsQueryBuilder=new SQLiteQueryBuilder();
  SQLiteQueryBuilder smsQueryBuilder=new SQLiteQueryBuilder();
  mmsQueryBuilder.setDistinct(true);
  smsQueryBuilder.setDistinct(true);
  mmsQueryBuilder.setTables(MmsProvider.TABLE_PDU + "String_Node_Str" + "String_Node_Str"+ escapedPhoneNumber+ "String_Node_Str"+ escapedPhoneNumber+ (mUseStrictPhoneNumberComparation ? "String_Node_Str" : "String_Node_Str")+ "String_Node_Str");
  smsQueryBuilder.setTables(SmsProvider.TABLE_SMS);
  String[] columns=handleNullMessageProjection(projection);
  String mmsSubQuery=mmsQueryBuilder.buildUnionSubQuery(MmsSms.TYPE_DISCRIMINATOR_COLUMN,columns,MMS_COLUMNS,0,"String_Node_Str",finalMmsSelection,selectionArgs,null,null);
  String smsSubQuery=smsQueryBuilder.buildUnionSubQuery(MmsSms.TYPE_DISCRIMINATOR_COLUMN,columns,SMS_COLUMNS,0,"String_Node_Str",finalSmsSelection,selectionArgs,null,null);
  SQLiteQueryBuilder unionQueryBuilder=new SQLiteQueryBuilder();
  unionQueryBuilder.setDistinct(true);
  String unionQuery=unionQueryBuilder.buildUnionQuery(new String[]{mmsSubQuery,smsSubQuery},sortOrder,null);
  return mOpenHelper.getReadableDatabase().rawQuery(unionQuery,EMPTY_STRING_ARRAY);
}