dix: read grab informations before processing it

As part of TouchRemoveListener, the grab might be free'd, thus
read the needed informations before we reach that level and finally
free only if we should

Fixes #7

dix/events.c

@@ -1556,11 +1556,16 @@ void
 DeactivatePointerGrab(DeviceIntPtr mouse)
 {
     GrabPtr grab = mouse->deviceGrab.grab;
+    GrabPtr oldGrab = grab;
     DeviceIntPtr dev;
     Bool wasPassive = mouse->deviceGrab.fromPassiveGrab;
     Bool wasImplicit = (mouse->deviceGrab.fromPassiveGrab &&
                         mouse->deviceGrab.implicitGrab);
+    WindowPtr grabConfineTo = grab->confineTo;
+    WindowPtr grabWindow = grab->window;
+    Bool wasTouchBeginSet = xi2mask_isset(grab->xi2mask, mouse, XI_TouchBegin);
     XID grab_resource = grab->resource;
+    int grabType = grab->grabtype;
     int i;
 
     /* If an explicit grab was deactivated, we must remove it from the head of
@@ -1572,8 +1577,7 @@ DeactivatePointerGrab(DeviceIntPtr mouse)
             /* Rejecting will generate a TouchEnd, but we must not
                emulate a ButtonRelease here. So pretend the listener
                already has the end event */
-            if (grab->grabtype == CORE || grab->grabtype == XI ||
-                    !xi2mask_isset(mouse->deviceGrab.grab->xi2mask, mouse, XI_TouchBegin)) {
+            if (grabType == CORE || grabType == XI || !wasTouchBeginSet) {
                 mode = XIAcceptTouch;
                 /* NOTE: we set the state here, but
                  * ProcessTouchOwnershipEvent() will still call
@@ -1581,6 +1585,12 @@ DeactivatePointerGrab(DeviceIntPtr mouse)
                  * this hack is in DeliverTouchEndEvent */
                 ti->listeners[0].state = LISTENER_HAS_END;
             }
+            else {
+                /* If we reject a touch, then we implicitly free the Grab
+                 * as part of TouchRemoveListener, and thus invalidate
+                 * the local reference to avaid reading it */
+                grab = NullGrab;
+            }
             TouchListenerAcceptReject(mouse, ti, 0, mode);
         }
     }
@@ -1593,21 +1603,22 @@ DeactivatePointerGrab(DeviceIntPtr mouse)
     mouse->deviceGrab.fromPassiveGrab = FALSE;
 
     for (dev = inputInfo.devices; dev; dev = dev->next) {
-        if (dev->deviceGrab.sync.other == grab)
+        if (dev->deviceGrab.sync.other == oldGrab)
             dev->deviceGrab.sync.other = NullGrab;
     }
-    DoEnterLeaveEvents(mouse, mouse->id, grab->window,
+    DoEnterLeaveEvents(mouse, mouse->id, grabWindow,
                        mouse->spriteInfo->sprite->win, NotifyUngrab);
-    if (grab->confineTo)
+    if (grabConfineTo)
         ConfineCursorToWindow(mouse, GetCurrentRootWindow(mouse), FALSE, FALSE);
     PostNewCursor(mouse);
 
-    if (!wasImplicit && grab->grabtype == XI2)
+    if (!wasImplicit && grabType == XI2)
         ReattachToOldMaster(mouse);
 
     ComputeFreezes();
 
-    FreeGrab(grab);
+    if (grab)
+        FreeGrab(grab);
 }
 
 /**