Program: 495
Project: 495
Buggy source:
/** 
 * Sends an event.
 * @param prototype The prototype from which to create the injected events.
 * @param action The action of the event.
 * @param pointerIdBits The bits of the pointers to send.
 * @param policyFlags The policy flags associated with the event.
 */
private void sendMotionEvent(MotionEvent prototype,int action,int pointerIdBits,int policyFlags){
  prototype.setAction(action);
  MotionEvent event=null;
  if (pointerIdBits == ALL_POINTER_ID_BITS) {
    event=prototype;
  }
 else {
    event=prototype.split(pointerIdBits);
  }
  if (action == MotionEvent.ACTION_DOWN) {
    event.setDownTime(event.getEventTime());
  }
 else {
    event.setDownTime(mInjectedPointerTracker.getLastInjectedDownEventTime());
  }
  if (mLongPressingPointerId >= 0) {
    final int remappedIndex=event.findPointerIndex(mLongPressingPointerId);
    final int pointerCount=event.getPointerCount();
    PointerProperties[] props=PointerProperties.createArray(pointerCount);
    PointerCoords[] coords=PointerCoords.createArray(pointerCount);
    for (int i=0; i < pointerCount; i++) {
      event.getPointerProperties(i,props[i]);
      event.getPointerCoords(i,coords[i]);
      if (i == remappedIndex) {
        coords[i].x-=mLongPressingPointerDeltaX;
        coords[i].y-=mLongPressingPointerDeltaY;
      }
    }
    MotionEvent remapped=MotionEvent.obtain(event.getDownTime(),event.getEventTime(),event.getAction(),event.getPointerCount(),props,coords,event.getMetaState(),event.getButtonState(),1.0f,1.0f,event.getDeviceId(),event.getEdgeFlags(),event.getSource(),event.getFlags());
    if (event != prototype) {
      event.recycle();
    }
    event=remapped;
  }
  if (DEBUG) {
    Slog.d(LOG_TAG,"String_Node_Str" + event + "String_Node_Str"+ Integer.toHexString(policyFlags));
  }
  policyFlags|=WindowManagerPolicy.FLAG_PASS_TO_USER;
  if (mNext != null) {
    mNext.onMotionEvent(event,null,policyFlags);
  }
  mInjectedPointerTracker.onMotionEvent(event);
  if (event != prototype) {
    event.recycle();
  }
}

Fixed version (ground truth):
/** 
 * Sends an event.
 * @param prototype The prototype from which to create the injected events.
 * @param action The action of the event.
 * @param pointerIdBits The bits of the pointers to send.
 * @param policyFlags The policy flags associated with the event.
 */
private void sendMotionEvent(MotionEvent prototype,int action,int pointerIdBits,int policyFlags){
  prototype.setAction(action);
  MotionEvent event=null;
  if (pointerIdBits == ALL_POINTER_ID_BITS) {
    event=prototype;
  }
 else {
    event=prototype.split(pointerIdBits);
  }
  if (action == MotionEvent.ACTION_DOWN) {
    event.setDownTime(event.getEventTime());
  }
 else {
    event.setDownTime(mInjectedPointerTracker.getLastInjectedDownEventTime());
  }
  if (mLongPressingPointerId >= 0) {
    event=offsetEvent(event,-mLongPressingPointerDeltaX,-mLongPressingPointerDeltaY);
  }
  if (DEBUG) {
    Slog.d(LOG_TAG,"String_Node_Str" + event + "String_Node_Str"+ Integer.toHexString(policyFlags));
  }
  policyFlags|=WindowManagerPolicy.FLAG_PASS_TO_USER;
  if (mNext != null) {
    mNext.onMotionEvent(event,null,policyFlags);
  }
  mInjectedPointerTracker.onMotionEvent(event);
  if (event != prototype) {
    event.recycle();
  }
}