.gitlab-ci.yml

@@ -21,7 +21,7 @@ variables:
     REPO_URL_XORGPROTO:   'https://gitlab.freedesktop.org/xorg/proto/xorgproto.git'
     XORG_DEBIAN_VERSION:  'bullseye-slim'
     XORG_DEBIAN_EXEC:     'env FDO_CI_CONCURRENT=${FDO_CI_CONCURRENT} bash .gitlab-ci/debian-install.sh'
-    XORG_DEBIAN_TAG:      '2025-02-12-xts'
+    XORG_DEBIAN_TAG:      '2025-02-26-xcb-deps'
     XORG_FREEBSD_VERSION: '14.2'
     XORG_FREEBSD_EXEC:    ''
     XORG_FREEBSD_TAG:     '2025-02-18-vm-image'
@@ -105,6 +105,8 @@ stages:
     FDO_DISTRIBUTION_TAG:       '$XORG_DEBIAN_TAG'
 
 .freebsd:
+  tags:
+    - kvm
   variables:
     FDO_DISTRIBUTION_TAG:       '$XORG_FREEBSD_TAG'
     FDO_DISTRIBUTION_VERSION:   '$XORG_FREEBSD_VERSION'
@@ -235,6 +237,7 @@ meson-dist:
         paths:
             - $MESON_BUILDDIR/meson-logs/
             - $MESON_BUILDDIR/xserver-*/$MESON_BUILDDIR/meson-logs/
+            - xserver-tarball/install/
     script:
         - .gitlab-ci/meson-build.sh --run-dist
         - mkdir xserver-tarball
@@ -242,7 +245,7 @@ meson-dist:
         - .gitlab-ci/meson-build.sh -C xserver-tarball --skip-test --skip-dist --run-install
     variables:
       MESON_DIST_ARGS: --no-tests
-      DESTDIR: xserver-tarball/install/
+      MESON_EXTRA_ARGS: -Dprefix=$CI_PROJECT_DIR/xserver-tarball/install/
 
 xf86-driver-build-test:
     extends:
@@ -266,14 +269,15 @@ xf86-driver-build-test:
             - REPO: https://gitlab.freedesktop.org/xorg/driver/xf86-video-intel
               SHA: e6a4c4740c15ace9dd79dc7c18955f2eb413a6a5 # no release yet
             - REPO: https://gitlab.freedesktop.org/xorg/driver/xf86-video-qxl
-              SHA: master
+              SHA: 989ff620220e8d0555cec38c1508b57dfbcfb0c6 # no release yet
             - REPO: https://gitlab.freedesktop.org/xorg/driver/xf86-video-vesa
               SHA: xf86-video-vesa-2.6.0
             - REPO: https://gitlab.freedesktop.org/xorg/driver/xf86-video-vmware
               SHA: xf86-video-vmware-13.4.0
     script:
-        # Install the server first
-        - .gitlab-ci/meson-build.sh --skip-test --run-install
+        # built xserver is taken from meson-dist job
+        - export PKG_CONFIG_PATH=$(pwd)/xserver-tarball/install/lib/x86_64-linux-gnu/pkgconfig
+        - export ACLOCAL_PATH=$(pwd)/xserver-tarball/install/share/aclocal/
         - unset MESON_EXTRA_ARGS
         - DRIVER=$(basename $REPO)
         - git clone "$REPO" "$DRIVER"
@@ -286,7 +290,9 @@ xf86-driver-build-test:
              ./autogen.sh && make
           fi
     needs:
-        - "meson"
+        - meson-dist
+    dependencies:
+        - meson-dist
     variables:
         GIT_DEPTH: 1
         MESON_ARGS: -Dprefix=/usr/

.gitlab-ci/debian-install.sh

@@ -65,6 +65,7 @@ apt-get install -y \
 	libx11-xcb-dev \
 	libxau-dev \
 	libxaw7-dev \
+	libxcb-damage0-dev \
 	libxcb-dri2-0-dev \
 	libxcb-dri3-dev \
 	libxcb-glx0-dev \
@@ -76,8 +77,10 @@ apt-get install -y \
 	libxcb-render0-dev \
 	libxcb-shape0-dev \
 	libxcb-shm0-dev \
+	libxcb-sync-dev \
 	libxcb-util0-dev \
 	libxcb-xf86dri0-dev \
+	libxcb-xinput-dev \
 	libxcb-xkb-dev \
 	libxcb-xv0-dev \
 	libxcb1-dev \

.mailmap

@@ -277,7 +277,8 @@ Paulo Zanoni <paulo.r.zanoni@intel.com> Paulo Ricardo Zanoni <pzanoni@mandriva.c
 
 Pekka Paalanen <pekka.paalanen@collabora.co.uk> <pekka.paalanen@collabora.com>
 
-Peter Harris <pharris@opentext.com> <peter.harris@hummingbird.com>
+Peter Harris <pharris2@rocketsoftware.com> <peter.harris@hummingbird.com>
+Peter Harris <pharris2@rocketsoftware.com> <pharris@opentext.com>
 
 Peter Hutterer <peter.hutterer@who-t.net> <peter.hutterer@redhat.com>
 Peter Hutterer <peter.hutterer@who-t.net> <peter@cs.unisa.edu.au>

Xext/dpms.c

@@ -32,6 +32,7 @@ Equipment Corporation.
 #include <X11/Xproto.h>
 
 #include "os/screensaver.h"
+#include "Xext/geext.h"
 
 #include "misc.h"
 #include "os.h"

Xext/geext.c

@@ -27,16 +27,30 @@
 #include "windowstr.h"
 #include <X11/extensions/ge.h>
 
-#include "geint.h"
 #include "geext.h"
 #include "protocol-versions.h"
 #include "extinit_priv.h"
 
-Bool noGEExtension = FALSE;
+#define MAXEXTENSIONS   128
 
 DevPrivateKeyRec GEClientPrivateKeyRec;
 
-GEExtension GEExtensions[MAXEXTENSIONS];
+#define GEClientPrivateKey (&GEClientPrivateKeyRec)
+
+/** Struct to keep information about registered extensions */
+typedef struct _GEExtension {
+    /** Event swapping routine */
+    void (*evswap) (xGenericEvent *from, xGenericEvent *to);
+} GEExtension, *GEExtensionPtr;
+
+static GEExtension GEExtensions[MAXEXTENSIONS];
+
+typedef struct _GEClientInfo {
+    CARD32 major_version;
+    CARD32 minor_version;
+} GEClientInfoRec, *GEClientInfoPtr;
+
+#define GEGetClient(pClient)    ((GEClientInfoPtr)(dixLookupPrivate(&((pClient)->devPrivates), GEClientPrivateKey)))
 
 /* Forward declarations */
 static void SGEGenericEvent(xEvent *from, xEvent *to);
@@ -93,7 +107,7 @@ SProcGEQueryVersion(ClientPtr client)
     REQUEST_SIZE_MATCH(xGEQueryVersionReq);
     swaps(&stuff->majorVersion);
     swaps(&stuff->minorVersion);
-    return SProcGEQueryVersion(client);
+    return ProcGEQueryVersion(client);
 }
 
 /************************************************************/
@@ -198,14 +212,3 @@ GERegisterExtension(int extension,
     /* extension opcodes are > 128, might as well save some space here */
     GEExtensions[EXT_MASK(extension)].evswap = ev_swap;
 }
-
-/* Sets type and extension field for a generic event. This is just an
- * auxiliary function, extensions could do it manually too.
- */
-void
-GEInitEvent(xGenericEvent *ev, int extension)
-{
-    ev->type = GenericEvent;
-    ev->extension = extension;
-    ev->length = 0;
-}

Xext/geext.h

@@ -25,49 +25,11 @@ other dealings in this Software without prior written authorization
 from the author.
 
 */
-
-#ifdef HAVE_DIX_CONFIG_H
-#include <dix-config.h>
-#endif
-
 #ifndef _GEEXT_H_
 #define _GEEXT_H_
-#include <X11/extensions/geproto.h>
-
-/** Struct to keep information about registered extensions */
-typedef struct _GEExtension {
-    /** Event swapping routine */
-    void (*evswap) (xGenericEvent *from, xGenericEvent *to);
-} GEExtension, *GEExtensionPtr;
-
-/* All registered extensions and their handling functions. */
-extern _X_EXPORT GEExtension GEExtensions[MAXEXTENSIONS];
-
-/* Typecast to generic event */
-#define GEV(ev) ((xGenericEvent*)(ev))
-/* Returns the extension offset from the event */
-#define GEEXT(ev) (GEV(ev)->extension)
 
-/* Return zero-based extension offset (offset - 128). Only for use in arrays */
-#define GEEXTIDX(ev) (GEEXT(ev) & 0x7F)
-/* True if mask is set for extension on window */
-#define GEMaskIsSet(pWin, extension, mask) \
-    ((pWin)->optional && \
-     (pWin)->optional->geMasks && \
-     ((pWin)->optional->geMasks->eventMasks[(extension) & 0x7F] & (mask)))
-
-/* Returns first client */
-#define GECLIENT(pWin) \
-    (((pWin)->optional) ? (pWin)->optional->geMasks->geClients : NULL)
-
-/* Returns the event_fill for the given event */
-#define GEEventFill(ev) \
-    GEExtensions[GEEXTIDX(ev)].evfill
-
-#define GEIsType(ev, ext, ev_type) \
-        ((GEV(ev)->type == GenericEvent) &&  \
-         GEEXT(ev) == (ext) && \
-         GEV(ev)->evtype == (ev_type))
+#include <X11/Xfuncproto.h>
+#include <X11/extensions/geproto.h>
 
 /* Interface for other extensions */
 extern _X_EXPORT void GERegisterExtension(int extension,
@@ -76,6 +38,4 @@ extern _X_EXPORT void GERegisterExtension(int extension,
                                                                xGenericEvent
                                                                *to));
 
-extern _X_EXPORT void GEInitEvent(xGenericEvent *ev, int extension);
-
 #endif                          /* _GEEXT_H_ */

Xext/geint.h

-/*
- * Copyright 2007-2008 Peter Hutterer
- *
- * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the "Software"),
- * to deal in the Software without restriction, including without limitation
- * the rights to use, copy, modify, merge, publish, distribute, sublicense,
- * and/or sell copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice (including the next
- * paragraph) shall be included in all copies or substantial portions of the
- * Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
- * DEALINGS IN THE SOFTWARE.
- *
- * Author: Peter Hutterer, University of South Australia, NICTA
- */
-#ifdef HAVE_DIX_CONFIG_H
-#include <dix-config.h>
-#endif
-
-#ifndef _GEINT_H_
-#define _GEINT_H_
-
-#include <X11/X.h>
-#include <X11/Xproto.h>
-#include "misc.h"
-#include "os.h"
-#include "dixstruct.h"
-#include "extnsionst.h"
-#include <X11/extensions/geproto.h>
-
-extern DevPrivateKeyRec GEClientPrivateKeyRec;
-
-#define GEClientPrivateKey (&GEClientPrivateKeyRec)
-
-typedef struct _GEClientInfo {
-    CARD32 major_version;
-    CARD32 minor_version;
-} GEClientInfoRec, *GEClientInfoPtr;
-
-#define GEGetClient(pClient)    ((GEClientInfoPtr)(dixLookupPrivate(&((pClient)->devPrivates), GEClientPrivateKey)))
-
-#endif                          /* _GEINT_H_ */

Xext/meson.build

@@ -10,7 +10,6 @@ srcs_xext = [
 
 hdrs_xext = [
     'geext.h',
-    'geint.h',
     'syncsdk.h',
 ]
 
@@ -45,7 +44,6 @@ endif
 
 if build_xinerama
     srcs_xext += ['panoramiX.c', 'panoramiXprocs.c', 'panoramiXSwap.c']
-    hdrs_xext += ['panoramiX.h', 'panoramiXsrv.h']
 endif
 
 if build_xsecurity

Xext/sync.c

@@ -201,8 +201,8 @@ SyncAddTriggerToSyncObject(SyncTrigger * pTrigger)
             return Success;
     }
 
-    if (!(pCur = malloc(sizeof(SyncTriggerList))))
-        return BadAlloc;
+    /* Failure is not an option, it's succeed or burst! */
+    pCur = XNFalloc(sizeof(SyncTriggerList));
 
     pCur->pTrigger = pTrigger;
     pCur->next = pTrigger->pSync->pTriglist;
@@ -312,6 +312,35 @@ SyncCheckTriggerFence(SyncTrigger * pTrigger, int64_t unused)
     return (pFence == NULL || pFence->funcs.CheckTriggered(pFence));
 }
 
+static inline Bool
+checked_int64_add(int64_t *out, int64_t a, int64_t b)
+{
+    /* Do the potentially overflowing math as uint64_t, as signed
+     * integers in C are undefined on overflow (and the compiler may
+     * optimize out our overflow check below, otherwise)
+     */
+    int64_t result = (uint64_t)a + (uint64_t)b;
+    /* signed addition overflows if operands have the same sign, and
+     * the sign of the result doesn't match the sign of the inputs.
+     */
+    Bool overflow = (a < 0) == (b < 0) && (a < 0) != (result < 0);
+
+    *out = result;
+
+    return overflow;
+}
+
+static inline Bool
+checked_int64_subtract(int64_t *out, int64_t a, int64_t b)
+{
+    int64_t result = (uint64_t)a - (uint64_t)b;
+    Bool overflow = (a < 0) != (b < 0) && (a < 0) != (result < 0);
+
+    *out = result;
+
+    return overflow;
+}
+
 static int
 SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject,
                 RESTYPE resType, Mask changes)
@@ -331,11 +360,6 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject,
             client->errorValue = syncObject;
             return rc;
         }
-        if (pSync != pTrigger->pSync) { /* new counter for trigger */
-            SyncDeleteTriggerFromSyncObject(pTrigger);
-            pTrigger->pSync = pSync;
-            newSyncObject = TRUE;
-        }
     }
 
     /* if system counter, ask it what the current value is */
@@ -357,6 +381,24 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject,
         }
     }
 
+    if (changes & (XSyncCAValueType | XSyncCAValue)) {
+        if (pTrigger->value_type == XSyncAbsolute)
+            pTrigger->test_value = pTrigger->wait_value;
+        else {                  /* relative */
+            Bool overflow;
+
+            if (pCounter == NULL)
+                return BadMatch;
+
+            overflow = checked_int64_add(&pTrigger->test_value,
+                                         pCounter->value, pTrigger->wait_value);
+            if (overflow) {
+                client->errorValue = pTrigger->wait_value >> 32;
+                return BadValue;
+            }
+        }
+    }
+
     if (changes & XSyncCATestType) {
 
         if (pSync && SYNC_FENCE == pSync->type) {
@@ -385,21 +427,11 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject,
         }
     }
 
-    if (changes & (XSyncCAValueType | XSyncCAValue)) {
-        if (pTrigger->value_type == XSyncAbsolute)
-            pTrigger->test_value = pTrigger->wait_value;
-        else {                  /* relative */
-            Bool overflow;
-
-            if (pCounter == NULL)
-                return BadMatch;
-
-            overflow = checked_int64_add(&pTrigger->test_value,
-                                         pCounter->value, pTrigger->wait_value);
-            if (overflow) {
-                client->errorValue = pTrigger->wait_value >> 32;
-                return BadValue;
-            }
+    if (changes & XSyncCACounter) {
+        if (pSync != pTrigger->pSync) { /* new counter for trigger */
+            SyncDeleteTriggerFromSyncObject(pTrigger);
+            pTrigger->pSync = pSync;
+            newSyncObject = TRUE;
         }
     }
 
@@ -407,8 +439,7 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject,
      *  a new counter on a trigger
      */
     if (newSyncObject) {
-        if ((rc = SyncAddTriggerToSyncObject(pTrigger)) != Success)
-            return rc;
+        SyncAddTriggerToSyncObject(pTrigger);
     }
     else if (pCounter && IsSystemCounter(pCounter)) {
         SyncComputeBracketValues(pCounter);
@@ -799,8 +830,14 @@ SyncChangeAlarmAttributes(ClientPtr client, SyncAlarm * pAlarm, Mask mask,
     int status;
     XSyncCounter counter;
     Mask origmask = mask;
+    SyncTrigger trigger;
+    Bool select_events_changed = FALSE;
+    Bool select_events_value = FALSE;
+    int64_t delta;
 
-    counter = pAlarm->trigger.pSync ? pAlarm->trigger.pSync->id : None;
+    trigger = pAlarm->trigger;
+    delta = pAlarm->delta;
+    counter = trigger.pSync ? trigger.pSync->id : None;
 
     while (mask) {
         int index2 = lowbit(mask);
@@ -816,24 +853,24 @@ SyncChangeAlarmAttributes(ClientPtr client, SyncAlarm * pAlarm, Mask mask,
         case XSyncCAValueType:
             mask &= ~XSyncCAValueType;
             /* sanity check in SyncInitTrigger */
-            pAlarm->trigger.value_type = *values++;
+            trigger.value_type = *values++;
             break;
 
         case XSyncCAValue:
             mask &= ~XSyncCAValue;
-            pAlarm->trigger.wait_value = ((int64_t)values[0] << 32) | values[1];
+            trigger.wait_value = ((int64_t)values[0] << 32) | values[1];
             values += 2;
             break;
 
         case XSyncCATestType:
             mask &= ~XSyncCATestType;
             /* sanity check in SyncInitTrigger */
-            pAlarm->trigger.test_type = *values++;
+            trigger.test_type = *values++;
             break;
 
         case XSyncCADelta:
             mask &= ~XSyncCADelta;
-            pAlarm->delta = ((int64_t)values[0] << 32) | values[1];
+            delta = ((int64_t)values[0] << 32) | values[1];
             values += 2;
             break;
 
@@ -843,10 +880,8 @@ SyncChangeAlarmAttributes(ClientPtr client, SyncAlarm * pAlarm, Mask mask,
                 client->errorValue = *values;
                 return BadValue;
             }
-            status = SyncEventSelectForAlarm(pAlarm, client,
-                                             (Bool) (*values++));
-            if (status != Success)
-                return status;
+            select_events_value = (Bool) (*values++);
+            select_events_changed = TRUE;
             break;
 
         default:
@@ -855,25 +890,33 @@ SyncChangeAlarmAttributes(ClientPtr client, SyncAlarm * pAlarm, Mask mask,
         }
     }
 
+    if (select_events_changed) {
+        status = SyncEventSelectForAlarm(pAlarm, client, select_events_value);
+        if (status != Success)
+            return status;
+    }
+
     /* "If the test-type is PositiveComparison or PositiveTransition
      *  and delta is less than zero, or if the test-type is
      *  NegativeComparison or NegativeTransition and delta is
      *  greater than zero, a Match error is generated."
      */
     if (origmask & (XSyncCADelta | XSyncCATestType)) {
-        if ((((pAlarm->trigger.test_type == XSyncPositiveComparison) ||
-              (pAlarm->trigger.test_type == XSyncPositiveTransition))
-             && pAlarm->delta < 0)
+        if ((((trigger.test_type == XSyncPositiveComparison) ||
+              (trigger.test_type == XSyncPositiveTransition))
+             && delta < 0)
             ||
-            (((pAlarm->trigger.test_type == XSyncNegativeComparison) ||
-              (pAlarm->trigger.test_type == XSyncNegativeTransition))
-             && pAlarm->delta > 0)
+            (((trigger.test_type == XSyncNegativeComparison) ||
+              (trigger.test_type == XSyncNegativeTransition))
+             && delta > 0)
             ) {
             return BadMatch;
         }
     }
 
     /* postpone this until now, when we're sure nothing else can go wrong */
+    pAlarm->delta = delta;
+    pAlarm->trigger = trigger;
     if ((status = SyncInitTrigger(client, &pAlarm->trigger, counter, RTCounter,
                                   origmask & XSyncCAAllTrigger)) != Success)
         return status;

Xi/allowev.c

@@ -57,6 +57,7 @@ SOFTWARE.
 #include <X11/extensions/XIproto.h>
 
 #include "dix/dix_priv.h"
+#include "dix/input_priv.h"
 
 #include "exglobals.h"
 #include "allowev.h"
@@ -100,22 +101,22 @@ ProcXAllowDeviceEvents(ClientPtr client)
 
     switch (stuff->mode) {
     case ReplayThisDevice:
-        AllowSome(client, time, thisdev, NOT_GRABBED);
+        AllowSome(client, time, thisdev, GRAB_STATE_NOT_GRABBED);
         break;
     case SyncThisDevice:
-        AllowSome(client, time, thisdev, FREEZE_NEXT_EVENT);
+        AllowSome(client, time, thisdev, GRAB_STATE_FREEZE_NEXT_EVENT);
         break;
     case AsyncThisDevice:
-        AllowSome(client, time, thisdev, THAWED);
+        AllowSome(client, time, thisdev, GRAB_STATE_THAWED);
         break;
     case AsyncOtherDevices:
-        AllowSome(client, time, thisdev, THAW_OTHERS);
+        AllowSome(client, time, thisdev, GRAB_STATE_THAW_OTHERS);
         break;
     case SyncAll:
-        AllowSome(client, time, thisdev, FREEZE_BOTH_NEXT_EVENT);
+        AllowSome(client, time, thisdev, GRAB_STATE_FREEZE_BOTH_NEXT_EVENT);
         break;
     case AsyncAll:
-        AllowSome(client, time, thisdev, THAWED_BOTH);
+        AllowSome(client, time, thisdev, GRAB_STATE_THAWED_BOTH);
         break;
     default:
         client->errorValue = stuff->mode;

Xi/xiallowev.c

@@ -95,25 +95,25 @@ ProcXIAllowEvents(ClientPtr client)
 
     switch (stuff->mode) {
     case XIReplayDevice:
-        AllowSome(client, time, dev, NOT_GRABBED);
+        AllowSome(client, time, dev, GRAB_STATE_NOT_GRABBED);
         break;
     case XISyncDevice:
-        AllowSome(client, time, dev, FREEZE_NEXT_EVENT);
+        AllowSome(client, time, dev, GRAB_STATE_FREEZE_NEXT_EVENT);
         break;
     case XIAsyncDevice:
-        AllowSome(client, time, dev, THAWED);
+        AllowSome(client, time, dev, GRAB_STATE_THAWED);
         break;
     case XIAsyncPairedDevice:
         if (IsMaster(dev))
-            AllowSome(client, time, dev, THAW_OTHERS);
+            AllowSome(client, time, dev, GRAB_STATE_THAW_OTHERS);
         break;
     case XISyncPair:
         if (IsMaster(dev))
-            AllowSome(client, time, dev, FREEZE_BOTH_NEXT_EVENT);
+            AllowSome(client, time, dev, GRAB_STATE_FREEZE_BOTH_NEXT_EVENT);
         break;
     case XIAsyncPair:
         if (IsMaster(dev))
-            AllowSome(client, time, dev, THAWED_BOTH);
+            AllowSome(client, time, dev, GRAB_STATE_THAWED_BOTH);
         break;
     case XIRejectTouch:
     case XIAcceptTouch:

Xi/xibarriers.c

@@ -132,14 +132,15 @@ static void FreePointerBarrierClient(struct PointerBarrierClient *c)
 
 static struct PointerBarrierDevice *GetBarrierDevice(struct PointerBarrierClient *c, int deviceid)
 {
-    struct PointerBarrierDevice *pbd = NULL;
+    struct PointerBarrierDevice *p, *pbd = NULL;
 
-    xorg_list_for_each_entry(pbd, &c->per_device, entry) {
-        if (pbd->deviceid == deviceid)
+    xorg_list_for_each_entry(p, &c->per_device, entry) {
+        if (p->deviceid == deviceid) {
+            pbd = p;
             break;
+        }
     }
 
-    BUG_WARN(!pbd);
     return pbd;
 }
 
@@ -340,6 +341,9 @@ barrier_find_nearest(BarrierScreenPtr cs, DeviceIntPtr dev,
         double distance;
 
         pbd = GetBarrierDevice(c, dev->id);
+        if (!pbd)
+            continue;
+
         if (pbd->seen)
             continue;
 
@@ -448,6 +452,9 @@ input_constrain_cursor(DeviceIntPtr dev, ScreenPtr screen,
         nearest = &c->barrier;
 
         pbd = GetBarrierDevice(c, master->id);
+        if (!pbd)
+            continue;
+
         new_sequence = !pbd->hit;
 
         pbd->seen = TRUE;
@@ -488,6 +495,9 @@ input_constrain_cursor(DeviceIntPtr dev, ScreenPtr screen,
         int flags = 0;
 
         pbd = GetBarrierDevice(c, master->id);
+        if (!pbd)
+            continue;
+
         pbd->seen = FALSE;
         if (!pbd->hit)
             continue;
@@ -682,6 +692,9 @@ BarrierFreeBarrier(void *data, XID id)
             continue;
 
         pbd = GetBarrierDevice(c, dev->id);
+        if (!pbd)
+            continue;
+
         if (!pbd->hit)
             continue;
 
@@ -741,6 +754,8 @@ static void remove_master_func(void *res, XID id, void *devid)
     barrier = container_of(b, struct PointerBarrierClient, barrier);
 
     pbd = GetBarrierDevice(barrier, *deviceid);
+    if (!pbd)
+        return;
 
     if (pbd->hit) {
         BarrierEvent ev = {
@@ -905,6 +920,10 @@ ProcXIBarrierReleasePointer(ClientPtr client)
         barrier = container_of(b, struct PointerBarrierClient, barrier);
 
         pbd = GetBarrierDevice(barrier, dev->id);
+        if (!pbd) {
+            client->errorValue = dev->id;
+            return BadDevice;
+        }
 
         if (pbd->barrier_event_id == event_id)
             pbd->release_event_id = event_id;

Xi/xichangehierarchy.c

@@ -48,7 +48,6 @@
 #include "scrnintstr.h"         /* screen structure  */
 #include "extnsionst.h"
 #include "exglobals.h"
-#include "geext.h"
 #include "misc.h"
 #include "xace.h"
 #include "xiquerydevice.h"      /* for GetDeviceUse */

Xi/xigrabdev.c

@@ -81,6 +81,9 @@ ProcXIGrabDevice(ClientPtr client)
     if (ret != Success)
         return ret;
 
+    if (!dev->enabled)
+        return AlreadyGrabbed;
+
     if (!IsMaster(dev))
         stuff->paired_device_mode = GrabModeAsync;
 

composite/compalloc.c

@@ -138,6 +138,7 @@ compRedirectWindow(ClientPtr pClient, WindowPtr pWin, int update)
     CompScreenPtr cs = GetCompScreen(pWin->drawable.pScreen);
     WindowPtr pLayerWin;
     Bool anyMarked = FALSE;
+    int status = Success;
 
     if (pWin == cs->pOverlayWin) {
         return Success;
@@ -216,13 +217,13 @@ compRedirectWindow(ClientPtr pClient, WindowPtr pWin, int update)
 
     if (!compCheckRedirect(pWin)) {
         FreeResource(ccw->id, X11_RESTYPE_NONE);
-        return BadAlloc;
+        status = BadAlloc;
     }
 
     if (anyMarked)
         compHandleMarkedWindows(pWin, pLayerWin);
 
-    return Success;
+    return status;
 }
 
 void
@@ -604,9 +605,12 @@ compAllocPixmap(WindowPtr pWin)
     int h = pWin->drawable.height + (bw << 1);
     PixmapPtr pPixmap = compNewPixmap(pWin, x, y, w, h);
     CompWindowPtr cw = GetCompWindow(pWin);
+    Bool status;
 
-    if (!pPixmap)
-        return FALSE;
+    if (!pPixmap) {
+        status = FALSE;
+        goto out;
+    }
     if (cw->update == CompositeRedirectAutomatic)
         pWin->redirectDraw = RedirectDrawAutomatic;
     else
@@ -620,14 +624,16 @@ compAllocPixmap(WindowPtr pWin)
         DamageRegister(&pWin->drawable, cw->damage);
         cw->damageRegistered = TRUE;
     }
+    status = TRUE;
 
+out:
     /* Make sure our borderClip is up to date */
     RegionUninit(&cw->borderClip);
     RegionCopy(&cw->borderClip, &pWin->borderClip);
     cw->borderClipX = pWin->drawable.x;
     cw->borderClipY = pWin->drawable.y;
 
-    return TRUE;
+    return status;
 }
 
 void

damageext/damageext.c

@@ -24,6 +24,7 @@
 #include <dix-config.h>
 
 #include "dix/dix_priv.h"
+#include "os/client_priv.h"
 
 #include "damageextint.h"
 #include "damagestr.h"

dbe/dbe.c

@@ -907,7 +907,7 @@ SProcDbeSwapBuffers(ClientPtr client)
          * followed by a 1 byte swap action and then 3 pad bytes.  We only need
          * to swap the window information.
          */
-        for (i = 0; i < stuff->n; i++) {
+        for (i = 0; i < stuff->n; i++, pSwapInfo++) {
             swapl(&pSwapInfo->window);
         }
     }

dix/devices.c

@@ -981,6 +981,23 @@ FreeAllDeviceClasses(ClassesPtr classes)
 
 }
 
+static void
+FreePendingFrozenDeviceEvents(DeviceIntPtr dev)
+{
+    QdEventPtr qe, tmp;
+
+    if (!dev->deviceGrab.sync.frozen)
+        return;
+
+    /* Dequeue any frozen pending events */
+    xorg_list_for_each_entry_safe(qe, tmp, &syncEvents.pending, next) {
+        if (qe->device == dev) {
+            xorg_list_del(&qe->next);
+            free(qe);
+        }
+    }
+}
+
 /**
  * Close down a device and free all resources.
  * Once closed down, the driver will probably not expect you that you'll ever
@@ -1044,6 +1061,7 @@ CloseDevice(DeviceIntPtr dev)
         valuator_mask_free(&dev->last.touches[j].valuators);
     free(dev->last.touches);
     dev->config_info = NULL;
+    FreePendingFrozenDeviceEvents(dev);
     dixFreePrivates(dev->devPrivates, PRIVATE_DEVICE);
     free(dev);
 }

dix/dispatch.c

@@ -3123,6 +3123,10 @@ ProcFreeCursor(ClientPtr client)
     rc = dixLookupResourceByType((void **) &pCursor, stuff->id, X11_RESTYPE_CURSOR,
                                  client, DixDestroyAccess);
     if (rc == Success) {
+        if (pCursor == rootCursor) {
+            client->errorValue = stuff->id;
+            return BadCursor;
+        }
         FreeResource(stuff->id, X11_RESTYPE_NONE);
         return Success;
     }

dix/dix_priv.h

@@ -24,7 +24,6 @@
 #include "include/gc.h"
 #include "include/input.h"
 #include "include/window.h"
-#include "Xext/geext.h"
 
 /* server setting: maximum size for big requests */
 #define MAX_BIG_REQUEST_SIZE 4194303