dix: keep a copy of current grab if we're rejecting the touch

As part of TouchRemoveListener, the grab will be free'd, thus not risk to
double-free it, better to keep a copy of the current grab.

Fixes #7

dix/events.c

@@ -1556,10 +1556,12 @@ void
 DeactivatePointerGrab(DeviceIntPtr mouse)
 {
     GrabPtr grab = mouse->deviceGrab.grab;
+    GrabPtr old_grab = grab;
     DeviceIntPtr dev;
     Bool wasPassive = mouse->deviceGrab.fromPassiveGrab;
     Bool wasImplicit = (mouse->deviceGrab.fromPassiveGrab &&
                         mouse->deviceGrab.implicitGrab);
+    Bool wasRejected = FALSE;
     XID grab_resource = grab->resource;
     int i;
 
@@ -1581,6 +1583,13 @@ DeactivatePointerGrab(DeviceIntPtr mouse)
                  * this hack is in DeliverTouchEndEvent */
                 ti->listeners[0].state = LISTENER_HAS_END;
             }
+            if (mode == XIRejectTouch && !wasRejected) {
+                /* If we reject a touch, then we implicitly free the Grab
+                 * as part of TouchRemoveListener, and thus let's keep
+                 * a temporary copy here to avoid working on invalid data */
+                grab = AllocGrab(grab);
+                wasRejected = TRUE;
+            }
             TouchListenerAcceptReject(mouse, ti, 0, mode);
         }
     }
@@ -1593,7 +1602,7 @@ DeactivatePointerGrab(DeviceIntPtr mouse)
     mouse->deviceGrab.fromPassiveGrab = FALSE;
 
     for (dev = inputInfo.devices; dev; dev = dev->next) {
-        if (dev->deviceGrab.sync.other == grab)
+        if (dev->deviceGrab.sync.other == old_grab)
             dev->deviceGrab.sync.other = NullGrab;
     }
     DoEnterLeaveEvents(mouse, mouse->id, grab->window,