Program: 183511
Project: 183511
Buggy source:
/** 
 * @return Returns true if event was dispatched, false if it was dropped for any reason
 */
private int dispatchTrackball(QueuedEvent qev,MotionEvent ev,int pid,int uid){
  if (DEBUG_INPUT)   Log.v(TAG,"String_Node_Str" + ev.getAction() + "String_Node_Str"+ ev.getX()+ "String_Node_Str"+ ev.getY()+ "String_Node_Str");
  Object focusObj=mKeyWaiter.waitForNextEventTarget(null,qev,ev,false,false);
  if (focusObj == null) {
    Log.w(TAG,"String_Node_Str" + ev);
    if (qev != null) {
      mQueue.recycleEvent(qev);
    }
    ev.recycle();
    return INJECT_FAILED;
  }
  if (focusObj == mKeyWaiter.CONSUMED_EVENT_TOKEN) {
    if (qev != null) {
      mQueue.recycleEvent(qev);
    }
    ev.recycle();
    return INJECT_SUCCEEDED;
  }
  WindowState focus=(WindowState)focusObj;
  if (uid != 0 && uid != focus.mSession.mUid) {
    if (mContext.checkPermission(android.Manifest.permission.INJECT_EVENTS,pid,uid) != PackageManager.PERMISSION_GRANTED) {
      Log.w(TAG,"String_Node_Str" + pid + "String_Node_Str"+ uid+ "String_Node_Str"+ focus+ "String_Node_Str"+ focus.mSession.mUid);
      if (qev != null) {
        mQueue.recycleEvent(qev);
      }
      ev.recycle();
      return INJECT_NO_PERMISSION;
    }
  }
  final long eventTime=ev.getEventTime();
synchronized (mWindowMap) {
    if (qev != null && ev.getAction() == MotionEvent.ACTION_MOVE) {
      mKeyWaiter.bindTargetWindowLocked(focus,KeyWaiter.RETURN_PENDING_TRACKBALL,qev);
      ev=null;
    }
 else {
      mKeyWaiter.bindTargetWindowLocked(focus);
    }
  }
  try {
    focus.mClient.dispatchTrackball(ev,eventTime);
    return INJECT_SUCCEEDED;
  }
 catch (  android.os.RemoteException e) {
    Log.i(TAG,"String_Node_Str" + focus);
    try {
      removeWindow(focus.mSession,focus.mClient);
    }
 catch (    java.util.NoSuchElementException ex) {
    }
  }
  return INJECT_FAILED;
}

Fixed version (ground truth):
/** 
 * @return Returns true if event was dispatched, false if it was dropped for any reason
 */
private int dispatchTrackball(QueuedEvent qev,MotionEvent ev,int pid,int uid){
  if (DEBUG_INPUT)   Log.v(TAG,"String_Node_Str" + ev.getAction() + "String_Node_Str"+ ev.getX()+ "String_Node_Str"+ ev.getY()+ "String_Node_Str");
  Object focusObj=mKeyWaiter.waitForNextEventTarget(null,qev,ev,false,false,pid,uid);
  if (focusObj == null) {
    Log.w(TAG,"String_Node_Str" + ev);
    if (qev != null) {
      mQueue.recycleEvent(qev);
    }
    ev.recycle();
    return INJECT_FAILED;
  }
  if (focusObj == mKeyWaiter.CONSUMED_EVENT_TOKEN) {
    if (qev != null) {
      mQueue.recycleEvent(qev);
    }
    ev.recycle();
    return INJECT_SUCCEEDED;
  }
  WindowState focus=(WindowState)focusObj;
  if (uid != 0 && uid != focus.mSession.mUid) {
    if (mContext.checkPermission(android.Manifest.permission.INJECT_EVENTS,pid,uid) != PackageManager.PERMISSION_GRANTED) {
      Log.w(TAG,"String_Node_Str" + pid + "String_Node_Str"+ uid+ "String_Node_Str"+ focus+ "String_Node_Str"+ focus.mSession.mUid);
      if (qev != null) {
        mQueue.recycleEvent(qev);
      }
      ev.recycle();
      return INJECT_NO_PERMISSION;
    }
  }
  final long eventTime=ev.getEventTime();
synchronized (mWindowMap) {
    if (qev != null && ev.getAction() == MotionEvent.ACTION_MOVE) {
      mKeyWaiter.bindTargetWindowLocked(focus,KeyWaiter.RETURN_PENDING_TRACKBALL,qev);
      ev=null;
    }
 else {
      mKeyWaiter.bindTargetWindowLocked(focus);
    }
  }
  try {
    focus.mClient.dispatchTrackball(ev,eventTime);
    return INJECT_SUCCEEDED;
  }
 catch (  android.os.RemoteException e) {
    Log.i(TAG,"String_Node_Str" + focus);
    try {
      removeWindow(focus.mSession,focus.mClient);
    }
 catch (    java.util.NoSuchElementException ex) {
    }
  }
  return INJECT_FAILED;
}