[Xquartz-changes] xserver: Branch 'server-1.9-apple' - 14 commits

Jeremy Huddleston jeremyhu at freedesktop.org
Tue Sep 28 10:20:16 PDT 2010


Rebased ref, commits from common ancestor:
commit 5e323d904e7b6000cecf1879122661058f66f049
Author: Jeremy Huddleston <jeremyhu at apple.com>
Date:   Fri Feb 12 19:48:52 2010 -0800

    fb: Revert fb changes that broke XQuartz
    
    http://bugs.freedesktop.org/show_bug.cgi?id=26124
    
    Revert "Fix source pictures getting random transforms after 2d6a8f668342a5190cdf43b5."
    Revert "fb: Adjust transform or composite coordinates for pixman operations"
    
    http://bugs.freedesktop.org/26124
    
    This reverts commit a72c65e9176c51de95db2fdbf4c5d946a4911695.
    This reverts commit a6bd5d2e482a5aa84acb3d4932e2a166d8670ef1.
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>

diff --git a/fb/fb.h b/fb/fb.h
index a06f98b..3b9efea 100644
--- a/fb/fb.h
+++ b/fb/fb.h
@@ -2080,11 +2080,8 @@ fbFillRegionSolid (DrawablePtr	pDrawable,
 		   FbBits	xor);
 
 extern _X_EXPORT pixman_image_t *
-image_from_pict (PicturePtr	pict,
-		 Bool		has_clip,
-		 int		*xoff,
-		 int		*yoff);
-
+image_from_pict (PicturePtr pict,
+		 Bool       has_clip);
 extern _X_EXPORT void free_pixman_pict (PicturePtr, pixman_image_t *);
 
 #endif /* _FB_H_ */
diff --git a/fb/fbpict.c b/fb/fbpict.c
index f7f1200..5467ee4 100644
--- a/fb/fbpict.c
+++ b/fb/fbpict.c
@@ -156,24 +156,19 @@ fbComposite (CARD8      op,
 	     CARD16     height)
 {
     pixman_image_t *src, *mask, *dest;
-    int src_xoff, src_yoff;
-    int msk_xoff, msk_yoff;
-    int dst_xoff, dst_yoff;
     
     miCompositeSourceValidate (pSrc, xSrc - xDst, ySrc - yDst, width, height);
     if (pMask)
 	miCompositeSourceValidate (pMask, xMask - xDst, yMask - yDst, width, height);
     
-    src = image_from_pict (pSrc, FALSE, &src_xoff, &src_yoff);
-    mask = image_from_pict (pMask, FALSE, &msk_xoff, &msk_yoff);
-    dest = image_from_pict (pDst, TRUE, &dst_xoff, &dst_yoff);
+    src = image_from_pict (pSrc, TRUE);
+    mask = image_from_pict (pMask, TRUE);
+    dest = image_from_pict (pDst, TRUE);
 
     if (src && dest && !(pMask && !mask))
     {
 	pixman_image_composite (op, src, mask, dest,
-				xSrc + src_xoff, ySrc + src_yoff,
-				xMask + msk_xoff, yMask + msk_yoff,
-				xDst + dst_xoff, yDst + dst_yoff,
+				xSrc, ySrc, xMask, yMask, xDst, yDst,
 				width, height);
     }
 
@@ -271,22 +266,22 @@ create_conical_gradient_image (PictGradient *gradient)
 
 static pixman_image_t *
 create_bits_picture (PicturePtr pict,
-		     Bool       has_clip,
-		     int	*xoff,
-		     int	*yoff)
+		     Bool       has_clip)
 {
-    PixmapPtr pixmap;
     FbBits *bits;
     FbStride stride;
-    int bpp;
+    int bpp, xoff, yoff;
     pixman_image_t *image;
     
-    fbGetDrawablePixmap (pict->pDrawable, pixmap, *xoff, *yoff);
-    fbGetPixmapBitsData(pixmap, bits, stride, bpp);
+    fbGetDrawable (pict->pDrawable, bits, stride, bpp, xoff, yoff);
+
+    bits = (FbBits*)((CARD8*)bits +
+		     (pict->pDrawable->y + yoff) * stride * sizeof(FbBits) +
+		     (pict->pDrawable->x + xoff) * (bpp / 8));
 
     image = pixman_image_create_bits (
 	pict->format,
-	pixmap->drawable.width, pixmap->drawable.height,
+	pict->pDrawable->width, pict->pDrawable->height,
 	(uint32_t *)bits, stride * sizeof (FbStride));
     
     
@@ -312,55 +307,33 @@ create_bits_picture (PicturePtr pict,
 	if (pict->clientClipType != CT_NONE)
 	    pixman_image_set_has_client_clip (image, TRUE);
 
-	if (*xoff || *yoff)
-	    pixman_region_translate (pict->pCompositeClip, *xoff, *yoff);
+	pixman_region_translate (pict->pCompositeClip, - pict->pDrawable->x, - pict->pDrawable->y);
 
 	pixman_image_set_clip_region (image, pict->pCompositeClip);
 
-	if (*xoff || *yoff)
-	    pixman_region_translate (pict->pCompositeClip, -*xoff, -*yoff);
+	pixman_region_translate (pict->pCompositeClip, pict->pDrawable->x, pict->pDrawable->y);
     }
     
     /* Indexed table */
     if (pict->pFormat->index.devPrivate)
 	pixman_image_set_indexed (image, pict->pFormat->index.devPrivate);
 
-    /* Add in drawable origin to position within the image */
-    *xoff += pict->pDrawable->x;
-    *yoff += pict->pDrawable->y;
-
     return image;
 }
 
 static pixman_image_t *
-image_from_pict_internal (PicturePtr pict, Bool has_clip, int *xoff, int *yoff, Bool is_alpha_map);
+image_from_pict_internal (PicturePtr pict, Bool has_clip, Bool is_alpha_map);
 
 static void
-set_image_properties (pixman_image_t *image, PicturePtr pict, Bool has_clip, int *xoff, int *yoff, Bool is_alpha_map)
+set_image_properties (pixman_image_t *image, PicturePtr pict, Bool is_alpha_map)
 {
     pixman_repeat_t repeat;
     pixman_filter_t filter;
     
     if (pict->transform)
     {
-	/* For source images, adjust the transform to account
-	 * for the drawable offset within the pixman image,
-	 * then set the offset to 0 as it will be used
-	 * to compute positions within the transformed image.
-	 */
-	if (!has_clip) {
-	    struct pixman_transform	adjusted;
-
-	    adjusted = *pict->transform;
-	    pixman_transform_translate(&adjusted,
-				       NULL,
-				       pixman_int_to_fixed(*xoff),
-				       pixman_int_to_fixed(*yoff));
-	    pixman_image_set_transform (image, &adjusted);
-	    *xoff = 0;
-	    *yoff = 0;
-	} else
-	    pixman_image_set_transform (image, pict->transform);
+	pixman_image_set_transform (
+	    image, (pixman_transform_t *)pict->transform);
     }
     
     switch (pict->repeatType)
@@ -390,8 +363,7 @@ set_image_properties (pixman_image_t *image, PicturePtr pict, Bool has_clip, int
      */
     if (pict->alphaMap && !is_alpha_map)
     {
-	int alpha_xoff, alpha_yoff;
-	pixman_image_t *alpha_map = image_from_pict_internal (pict->alphaMap, FALSE, &alpha_xoff, &alpha_yoff, TRUE);
+	pixman_image_t *alpha_map = image_from_pict_internal (pict->alphaMap, TRUE, TRUE);
 	
 	pixman_image_set_alpha_map (
 	    image, alpha_map, pict->alphaOrigin.x, pict->alphaOrigin.y);
@@ -424,7 +396,8 @@ set_image_properties (pixman_image_t *image, PicturePtr pict, Bool has_clip, int
 }
 
 static pixman_image_t *
-image_from_pict_internal (PicturePtr pict, Bool has_clip, int *xoff, int *yoff, Bool is_alpha_map)
+image_from_pict_internal (PicturePtr pict,
+		 Bool has_clip, Bool is_alpha_map)
 {
     pixman_image_t *image = NULL;
 
@@ -433,7 +406,7 @@ image_from_pict_internal (PicturePtr pict, Bool has_clip, int *xoff, int *yoff,
 
     if (pict->pDrawable)
     {
-	image = create_bits_picture (pict, has_clip, xoff, yoff);
+	image = create_bits_picture (pict, has_clip);
     }
     else if (pict->pSourcePict)
     {
@@ -454,19 +427,18 @@ image_from_pict_internal (PicturePtr pict, Bool has_clip, int *xoff, int *yoff,
 	    else if (sp->type == SourcePictTypeConical)
 		image = create_conical_gradient_image (gradient);
 	}
-	*xoff = *yoff = 0;
     }
     
     if (image)
-	set_image_properties (image, pict, has_clip, xoff, yoff, is_alpha_map);
+	set_image_properties (image, pict, is_alpha_map);
     
     return image;
 }
 
 pixman_image_t *
-image_from_pict (PicturePtr pict, Bool has_clip, int *xoff, int *yoff)
+image_from_pict (PicturePtr pict, Bool has_clip)
 {
-    return image_from_pict_internal (pict, has_clip, xoff, yoff, FALSE);
+    return image_from_pict_internal (pict, has_clip, FALSE);
 }
 
 void
diff --git a/fb/fbtrap.c b/fb/fbtrap.c
index 9f5c39f..9c55236 100644
--- a/fb/fbtrap.c
+++ b/fb/fbtrap.c
@@ -38,8 +38,7 @@ fbAddTraps (PicturePtr	pPicture,
 	    int		ntrap,
 	    xTrap	*traps)
 {
-    int image_xoff, image_yoff;
-    pixman_image_t *image = image_from_pict (pPicture, FALSE, &image_xoff, &image_yoff);
+    pixman_image_t *image = image_from_pict (pPicture, FALSE);
 
     if (!image)
 	return;
@@ -55,8 +54,7 @@ fbRasterizeTrapezoid (PicturePtr    pPicture,
 		      int	    x_off,
 		      int	    y_off)
 {
-    int	mask_xoff, mask_yoff;
-    pixman_image_t *image = image_from_pict (pPicture, FALSE, &mask_xoff, &mask_yoff);
+    pixman_image_t *image = image_from_pict (pPicture, FALSE);
 
     if (!image)
 	return;
commit 2729f3430d4490b4400d3dfaa4292451822095be
Author: Jeremy Huddleston <jeremyhu at apple.com>
Date:   Fri Apr 30 13:08:25 2010 -0700

    Workaround the GC clipping problem in miPaintWindow and add some debugging output.
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>

diff --git a/mi/miexpose.c b/mi/miexpose.c
index 94258b8..4f25c23 100644
--- a/mi/miexpose.c
+++ b/mi/miexpose.c
@@ -521,6 +521,7 @@ void RootlessSetPixmapOfAncestors(WindowPtr pWin);
 void RootlessStartDrawing(WindowPtr pWin);
 void RootlessDamageRegion(WindowPtr pWin, RegionPtr prgn);
 Bool IsFramedWindow(WindowPtr pWin);
+#include "../fb/fb.h"
 #endif 
 
 void
@@ -548,24 +549,37 @@ miPaintWindow(WindowPtr pWin, RegionPtr prgn, int what)
     Bool	solid = TRUE;
     DrawablePtr	drawable = &pWin->drawable;
 
+#ifdef XQUARTZ_CLIP_DEBUG
+    ErrorF("START %d BS %d (pR = %ld)\n", what, pWin->backgroundState, ParentRelative);
+    ErrorF("      Rgn: %d %d %d %d\n", prgn->extents.x1, prgn->extents.y1,
+	                               prgn->extents.x2 - prgn->extents.x1,
+	                               prgn->extents.y2 - prgn->extents.y1);
+    ErrorF("      Win: %d %d (%d %d) %d %d\n", pWin->origin.x, pWin->origin.y,
+	                                       pWin->winSize.extents.x1, pWin->winSize.extents.y1,
+	                                       pWin->winSize.extents.x2 - pWin->winSize.extents.x1,
+					       pWin->winSize.extents.y2 - pWin->winSize.extents.y1);
+    ErrorF("     Draw: %d %d %d %d\n", pWin->drawable.x, pWin->drawable.y,
+				       pWin->drawable.width, pWin->drawable.height);
+#endif
+
 #ifdef ROOTLESS
     if(!drawable || drawable->type == UNDRAWABLE_WINDOW)
 	return;
-
-    if(IsFramedWindow(pWin)) {
-        RootlessStartDrawing(pWin);
-        RootlessDamageRegion(pWin, prgn);
-    
-        if(pWin->backgroundState == ParentRelative) {
-            if((what == PW_BACKGROUND) || 
-               (what == PW_BORDER && !pWin->borderIsPixel))
-                RootlessSetPixmapOfAncestors(pWin);
-        }
-    }
 #endif
     
     if (what == PW_BACKGROUND)
     {
+#ifdef ROOTLESS
+	if(IsFramedWindow(pWin)) {
+	    RootlessStartDrawing(pWin);
+	    RootlessDamageRegion(pWin, prgn);
+
+	    if(pWin->backgroundState == ParentRelative) {
+		RootlessSetPixmapOfAncestors(pWin);
+	    }
+	}
+#endif
+
 	while (pWin->backgroundState == ParentRelative)
 	    pWin = pWin->parent;
 
@@ -587,6 +601,18 @@ miPaintWindow(WindowPtr pWin, RegionPtr prgn, int what)
     {
 	PixmapPtr   pixmap;
 
+#ifdef ROOTLESS
+	if(IsFramedWindow(pWin)) {
+	    RootlessStartDrawing(pWin);
+	    RootlessDamageRegion(pWin, prgn);
+	    
+	    if(!pWin->borderIsPixel &&
+		pWin->backgroundState == ParentRelative) {
+		RootlessSetPixmapOfAncestors(pWin);
+	    }
+	}
+#endif
+
 	tile_x_off = drawable->x;
 	tile_y_off = drawable->y;
 	
@@ -595,6 +621,12 @@ miPaintWindow(WindowPtr pWin, RegionPtr prgn, int what)
 	    return;
 	pixmap = (*pScreen->GetWindowPixmap) ((WindowPtr) drawable);
 	drawable = &pixmap->drawable;
+
+#ifdef XQUARTZ_CLIP_DEBUG
+	ErrorF("     Draw: %d %d %d %d\n",
+	       drawable->x, drawable->y, drawable->width, drawable->height);    
+#endif
+	
 #ifdef COMPOSITE
 	draw_x_off = pixmap->screen_x;
 	draw_y_off = pixmap->screen_y;
@@ -657,6 +689,57 @@ miPaintWindow(WindowPtr pWin, RegionPtr prgn, int what)
     ChangeGC (NullClient, pGC, gcmask, gcval);
     ValidateGC (drawable, pGC);
 
+#ifdef XQUARTZ_CLIP_DEBUG
+    ErrorF("       GC: %d %d %d %d\n",
+	   pGC->pCompositeClip->extents.x1, pGC->pCompositeClip->extents.y1,
+	   pGC->pCompositeClip->extents.x2 - pGC->pCompositeClip->extents.x1,
+	   pGC->pCompositeClip->extents.y2 - pGC->pCompositeClip->extents.y1);
+#endif
+    
+#ifdef XQUARTZ
+    /* Looks like our clipping isn't set right for some reason:
+     * http://xquartz.macosforge.org/trac/ticket/290
+     */
+    if(what == PW_BORDER) {
+
+#if 0
+	if(solid) {
+#if 1
+	    fbFillRegionSolid(&pWin->drawable,
+			      prgn,
+			      0,
+			      fbReplicatePixel(fill.pixel,
+					       pWin->drawable.bitsPerPixel));
+#else
+	    fbFillRegionSolid(drawable,
+			      prgn,
+			      0,
+			      fbReplicatePixel(fill.pixel,
+					       drawable->bitsPerPixel));
+#endif
+	    return;
+	}
+#endif
+    
+	pGC->pCompositeClip->extents.x1 += prgn->extents.x1;
+	pGC->pCompositeClip->extents.y1 += prgn->extents.y1;
+	pGC->pCompositeClip->extents.x2 += prgn->extents.x1;
+	pGC->pCompositeClip->extents.y2 += prgn->extents.y1;
+	
+	if(pGC->pCompositeClip->extents.x2 > drawable->pScreen->width)
+	    pGC->pCompositeClip->extents.x2 = drawable->pScreen->width;
+	if(pGC->pCompositeClip->extents.y2 > drawable->pScreen->height)
+	    pGC->pCompositeClip->extents.y2 = drawable->pScreen->height;
+    }
+#endif
+
+#ifdef XQUARTZ_CLIP_DEBUG
+    ErrorF("       GC: %d %d %d %d\n",
+	   pGC->pCompositeClip->extents.x1, pGC->pCompositeClip->extents.y1,
+	   pGC->pCompositeClip->extents.x2 - pGC->pCompositeClip->extents.x1,
+	   pGC->pCompositeClip->extents.y2 - pGC->pCompositeClip->extents.y1);    
+#endif
+
     numRects = RegionNumRects(prgn);
     pbox = RegionRects(prgn);
     for (i= numRects; --i >= 0; pbox++, prect++)
commit 3b687814a5b999305042775a2bddc3c10706f6da
Author: Kristian Høgsberg <krh at bitplanet.net>
Date:   Thu Sep 23 09:04:11 2010 -0400

    glx: Fix use after free in DrawableGone
    
    (note that nearly identical patches were proposed by Kristian and Chris)
    
    Signed-off-by: Kristian Høgsberg <krh at bitplanet.net>
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
    Reported-by: Julien Cristau <jcristau at debian.org>
    Reviewed-by: Adam Jackson <ajax at redhat.com>
    Reviewed-by: Jamey Sharp <jamey at minilop.net>
    Tested-by: Chris Wilson <chris at chris-wilson.co.uk>
    Signed-off-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit 2f0abd7d690c3bcce2a80c093a0880f43e56d8cb)

diff --git a/glx/glxext.c b/glx/glxext.c
index e203156..f5ebe4f 100644
--- a/glx/glxext.c
+++ b/glx/glxext.c
@@ -124,7 +124,7 @@ static int glxBlockClients;
 */
 static Bool DrawableGone(__GLXdrawable *glxPriv, XID xid)
 {
-    __GLXcontext *c;
+    __GLXcontext *c, *next;
 
     /* If this drawable was created using glx 1.3 drawable
      * constructors, we added it as a glx drawable resource under both
@@ -137,7 +137,8 @@ static Bool DrawableGone(__GLXdrawable *glxPriv, XID xid)
 	    FreeResourceByType(glxPriv->drawId, __glXDrawableRes, TRUE);
     }
 
-    for (c = glxAllContexts; c; c = c->next) {
+    for (c = glxAllContexts; c; c = next) {
+	next = c->next;
 	if (c->isCurrent && (c->drawPriv == glxPriv || c->readPriv == glxPriv)) {
 	    int i;
 
@@ -160,15 +161,13 @@ static Bool DrawableGone(__GLXdrawable *glxPriv, XID xid)
 		    }
 		}
 	    }
-
-	    if (!c->idExists) {
-		__glXFreeContext(c);
-	    }
 	}
 	if (c->drawPriv == glxPriv)
 	    c->drawPriv = NULL;
 	if (c->readPriv == glxPriv)
 	    c->readPriv = NULL;
+	if (!c->idExists && !c->isCurrent)
+	    __glXFreeContext(c);
     }
 
     glxPriv->destroy(glxPriv);
commit 57d454758994312b8572a753501dd1e5c89b4f7e
Author: Thomas Hellstrom <thellstrom at vmware.com>
Date:   Thu Sep 2 10:53:28 2010 +0200

    linux: Don't lose console events on non-evdev drivers (#29969)
    
    The drain_console() function will race with new keyboard events being added
    by the hardware causing the server to lose keyboard events if the console fd
    is used for input.
    
    Only use the drain_console() when AllowEmptyInput is off which is the best
    indicator we have for whether the keyboard driver will be used. This patch
    will only fix the bug when hotplugging is disabled.
    What we really need is a way to figure out either whether we're _not_ using
    the keyboard driver (not predictable) or a way for the keyboard driver to
    disable drain_console().
    
    X.Org Bug 29969 <http://bugs.freedesktop.org/show_bug.cgi?id=29969>
    
    Signed-off-by: Thomas Hellstrom <thellstrom at vmware.com>
    Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
    Reviewed-by: Adam Jackson <ajax at redhat.com>
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    (cherry picked from commit 71972c2534d490284d3d42b456c2f34b964b2894)

diff --git a/hw/xfree86/os-support/linux/lnx_init.c b/hw/xfree86/os-support/linux/lnx_init.c
index c8cec2e..92bfde4 100644
--- a/hw/xfree86/os-support/linux/lnx_init.c
+++ b/hw/xfree86/os-support/linux/lnx_init.c
@@ -277,8 +277,9 @@ xf86OpenConsole(void)
             tcsetattr(xf86Info.consoleFd, TCSANOW, &nTty);
 
             /* need to keep the buffer clean, else the kernel gets angry */
-            console_handler = xf86AddGeneralHandler(xf86Info.consoleFd,
-                    drain_console, NULL);
+	    if (xf86Info.allowEmptyInput)
+		console_handler = xf86AddGeneralHandler(xf86Info.consoleFd,
+							drain_console, NULL);
 
 	    /* we really should have a InitOSInputDevices() function instead
 	     * of Init?$#*&Device(). So I just place it here */
commit 918cb214ab4240be4772a141d1209c0ff5dfd63b
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Mon Aug 23 08:35:01 2010 +1000

    xfree86: Check for existence of button class before dereferencing it.
    
    The Irxon Super Mini Bluetooth Wireless Keyboard for PC/PDA/Cell Phones
    keyboards have axes but not buttons. The evdev driver doesn't set up a
    button class for these keyboards and a motion event handled by
    DGAProcessPointerEvent dereferences the dev->button NULL pointer, causing a
    server crash.
    
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    Reviewed-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit e00e2e7b68fbc932269d607ac5dc2c441d07ad9d)

diff --git a/hw/xfree86/common/xf86DGA.c b/hw/xfree86/common/xf86DGA.c
index 82fb52a..c468c60 100644
--- a/hw/xfree86/common/xf86DGA.c
+++ b/hw/xfree86/common/xf86DGA.c
@@ -1095,7 +1095,7 @@ DGAProcessPointerEvent (ScreenPtr pScreen, DGAEvent *event, DeviceIntPtr mouse)
     ev.header = ET_Internal;
     ev.length = sizeof(ev);
     ev.type = event->subtype;
-    ev.corestate  = butc->state;
+    ev.corestate  = butc ? butc->state : 0;
     if (master && master->key)
         ev.corestate |= XkbStateFieldFromRec(&master->key->xkbInfo->state);
 
commit 5a29cb126de577a2a0a41e10d9af13091a73d334
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Tue Aug 24 13:46:35 2010 +1000

    dix: don't set time to CurrentTime in DeviceChangedEvents.
    
    CurrentTime is used by clients to skip setting the time, but not by the
    server.
    
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    Reviewed-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit 86560b5d05f14bdf04d21b3457a66c0d5045db9c)

diff --git a/dix/devices.c b/dix/devices.c
index 0bd9b75..9aaadc4 100644
--- a/dix/devices.c
+++ b/dix/devices.c
@@ -2347,7 +2347,7 @@ RecalculateMasterButtons(DeviceIntPtr slave)
 
         event.header = ET_Internal;
         event.type = ET_DeviceChanged;
-        event.time = CurrentTime;
+        event.time = GetTimeInMillis();
         event.deviceid = master->id;
         event.flags = DEVCHANGE_POINTER_EVENT | DEVCHANGE_DEVICE_CHANGE;
         event.buttons.num_buttons = maxbuttons;
commit 72e3e6f4a7690f70a6b5f7689633cdea859535e1
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Mon Aug 23 13:20:09 2010 +1000

    dix: fix crash when removing devices on a buttonless MD pointer (#29669)
    
    If the master does not have a button class, recalculating the number of
    buttons required for this master dereferences a NULL pointer. Guard against
    this, if the master pointer doesn't have a button class, it doesn't need to
    update it's number of buttons.
    
    Reproducible:
    Two devices on the same master, device NB with axes but no buttons, device
    A+B with axes and button .
    If NB was the last one to send an event through the master when A+B is
    removed from the server, master->button is NULL and leads to the above
    NULL-pointer dereference.
    
    X.Org Bug 29669 <http://bugs.freedesktop.org/show_bug.cgi?id=29669>
    
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    Reviewed-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit ff055506f0cbb852bed17acb9f9bbf1d715a854e)

diff --git a/dix/devices.c b/dix/devices.c
index 2e65a04..0bd9b75 100644
--- a/dix/devices.c
+++ b/dix/devices.c
@@ -2336,7 +2336,7 @@ RecalculateMasterButtons(DeviceIntPtr slave)
         maxbuttons = max(maxbuttons, dev->button->numButtons);
     }
 
-    if (master->button->numButtons != maxbuttons)
+    if (master->button && master->button->numButtons != maxbuttons)
     {
         int i;
         DeviceChangedEvent event;
commit 0f3a0ab1f01ec5314ccb0bfb932c49f8c61b9866
Author: Chase Douglas <chase.douglas at ubuntu.com>
Date:   Wed Sep 1 14:45:34 2010 +1000

    Fix udev population of Bluetooth input device product IDs
    
    The udev device_added function takes the vendor and model IDs of added
    devices and converts them into an attribute that can be matched for by
    an InputClass configuration using MatchUSBID. Currently, the udev
    mechanism works for USB devices, but fails to work properly for
    Bluetooth devices. The product IDs of the event node are actually the
    IDs of the Bluetooth receiver instead of the device.
    
    This patch reads the product ID from the PRODUCT property of the parent
    of the added device. This tag is set correctly for both USB and
    Bluetooth input devices. The following devices have been tested by
    specifying individual InputClass sections in xorg.conf:
    
    * Apple Keyboard (Bluetooth)
    * Apple Magic Trackpad (Bluetooth)
    * Apple Magic Mouse (Bluetooth)
    * Microsoft Bluetooth Notebook Mouse 5000 (Bluetooth)
    * Microsoft IntelliMouse Optical (USB)
    * N-Trig Touchscreen (USB)
    * Wacom Bamboo Touch (USB)
    
    Signed-off-by: Chase Douglas <chase.douglas at canonical.com>
    Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    (cherry picked from commit 7925e8945649d4af237e6c3c5593b895a461bd1e)

diff --git a/config/udev.c b/config/udev.c
index 9934490..b7717c9 100644
--- a/config/udev.c
+++ b/config/udev.c
@@ -58,7 +58,6 @@ device_added(struct udev_device *udev_device)
     char *config_info = NULL;
     const char *syspath;
     const char *tags_prop;
-    const char *usb_vendor = NULL, *usb_model = NULL;
     const char *key, *value, *tmp;
     InputOption *options = NULL, *tmpo;
     InputAttributes attrs = {};
@@ -94,6 +93,8 @@ device_added(struct udev_device *udev_device)
     parent = udev_device_get_parent(udev_device);
     if (parent) {
         const char *ppath = udev_device_get_devnode(parent);
+        const char *product = udev_device_get_property_value(parent, "PRODUCT");
+        unsigned int usb_vendor, usb_model;
 
         name = udev_device_get_sysattr_value(parent, "name");
         LOG_SYSATTR(ppath, "name", name);
@@ -104,6 +105,13 @@ device_added(struct udev_device *udev_device)
 
         attrs.pnp_id = udev_device_get_sysattr_value(parent, "id");
         LOG_SYSATTR(ppath, "id", attrs.pnp_id);
+
+        /* construct USB ID in lowercase hex - "0000:ffff" */
+        if (product && sscanf(product, "%*x/%4x/%4x/%*x", &usb_vendor, &usb_model) == 2) {
+            attrs.usb_id = Xprintf("%04x:%04x", usb_vendor, usb_model);
+            if (attrs.usb_id)
+                LOG_PROPERTY(path, "PRODUCT", product);
+        }
     }
     if (!name)
         name = "(unnamed)";
@@ -152,12 +160,6 @@ device_added(struct udev_device *udev_device)
         } else if (!strcmp(key, "ID_VENDOR")) {
             LOG_PROPERTY(path, key, value);
             attrs.vendor = value;
-        } else if (!strcmp(key, "ID_VENDOR_ID")) {
-            LOG_PROPERTY(path, key, value);
-            usb_vendor = value;
-        } else if (!strcmp(key, "ID_VENDOR_MODEL")) {
-            LOG_PROPERTY(path, key, value);
-            usb_model = value;
         } else if (!strcmp(key, "ID_INPUT_KEY")) {
             LOG_PROPERTY(path, key, value);
             attrs.flags |= ATTR_KEYBOARD;
@@ -179,16 +181,6 @@ device_added(struct udev_device *udev_device)
         }
     }
 
-    /* construct USB ID in lowercase hex - "0000:ffff" */
-    if (usb_vendor && usb_model) {
-        attrs.usb_id = Xprintf("%s:%s", usb_vendor, usb_model);
-        if (attrs.usb_id) {
-            char *cur;
-            for (cur = attrs.usb_id; *cur; cur++)
-                *cur = tolower(*cur);
-        }
-    }
-
     LogMessage(X_INFO, "config/udev: Adding input device %s (%s)\n",
                name, path);
     rc = NewInputDeviceRequest(options, &attrs, &dev);
commit a0040f9870c78fd1f7e7ac81555cb783c152e287
Author: Jesse Adkins <jesserayadkins at gmail.com>
Date:   Wed Aug 25 13:48:29 2010 -0700

    xfree86: Document terminate not mapped by default (bug 25083)
    
    Document that terminate is not mapped to Ctrl+Alt+Backspace by default, to help alleviate some confusion.
    
    Signed-off-by: Jesse Adkins <jesserayadkins at gmail.com>
    Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    (cherry picked from commit 4a12aecac670debd0dafb17c245fccb93eea2d60)

diff --git a/hw/xfree86/doc/man/Xorg.man.pre b/hw/xfree86/doc/man/Xorg.man.pre
index 46d0e44..805f3a3 100644
--- a/hw/xfree86/doc/man/Xorg.man.pre
+++ b/hw/xfree86/doc/man/Xorg.man.pre
@@ -1,4 +1,6 @@
 .\" $XdotOrg: xserver/xorg/hw/xfree86/doc/man/Xorg.man.pre,v 1.3 2005/07/04 18:41:01 ajax Exp $
+.\" shorthand for double quote that works everywhere.
+.ds q \N'34'
 .TH __xservername__ __appmansuffix__ __vendorversion__
 .SH NAME
 __xservername__ - X11R7 X server
@@ -440,6 +442,14 @@ Immediately kills the server -- no questions asked. It can be disabled by
 setting the
 .B DontZap
 __xconfigfile__(__filemansuffix__) file option to a TRUE value.
+.PP
+.RS 8
+It should be noted that zapping is triggered by the
+.B Terminate_Server
+action in the keyboard map. This action is not part of the default keymaps
+but can be enabled with the XKB option
+.B \*qterminate:ctrl_alt_bksp\*q.
+.RE
 .TP 8
 .B Ctrl+Alt+Keypad-Plus
 Change video mode to next one specified in the configuration file.
commit 34b11fcd90258a70c02a04a13598b4a4af2c2974
Author: David Ge <davidqge at gmail.com>
Date:   Thu Aug 19 00:33:57 2010 -0500

    xkb: Fix RedirectKey didn't send any event.
    
    Xorg.log shows error: Valuators reported for non-valuator device.
    This is caused by uninitialized valuators.mask in _XkbFilterRedirectKey(),
    which trigger the error in UpdateDeviceState().
    
    Signed-off-by: David Ge <davidqge at gmail.com>
    Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    (cherry picked from commit a90052ba8697e217b0dc68057d7b9202ae8797db)

diff --git a/xkb/xkbActions.c b/xkb/xkbActions.c
index 8c75301..c020444 100644
--- a/xkb/xkbActions.c
+++ b/xkb/xkbActions.c
@@ -806,6 +806,7 @@ ProcessInputProc backupproc;
     /* never actually used uninitialised, but gcc isn't smart enough
      * to work that out. */
     memset(&old, 0, sizeof(old));
+    memset(&ev, 0, sizeof(ev));
 
     if ((filter->keycode!=0)&&(filter->keycode!=keycode))
 	return 1;
commit 0062d94cafcea5a2fea6224904188d1435c1983f
Author: Pauli Nieminen <ext-pauli.nieminen at nokia.com>
Date:   Mon Jul 26 15:31:03 2010 +0300

    xkb: Check if AddResource failed
    
    Signed-off-by: Pauli Nieminen <ext-pauli.nieminen at nokia.com>
    Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
    (cherry picked from commit b5c9953bbf4ffd11f1a70d058c6d3feb2bd1bca8)

diff --git a/xkb/xkb.c b/xkb/xkb.c
index a82cc38..4105c1c 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -224,7 +224,8 @@ ProcXkbSelectEvents(ClientPtr client)
     masks = XkbFindClientResource((DevicePtr)dev,client);
     if (!masks){
 	XID id = FakeClientID(client->index);
-	AddResource(id,RT_XKBCLIENT,dev);
+	if (!AddResource(id,RT_XKBCLIENT,dev))
+	    return BadAlloc;
 	masks= XkbAddClientResource((DevicePtr)dev,client,id);
     }
     if (masks) {
@@ -5378,7 +5379,8 @@ ProcXkbPerClientFlags(ClientPtr client)
 	}
 	else if (want && (!interest)) {
 	    XID id = FakeClientID(client->index);
-	    AddResource(id,RT_XKBCLIENT,dev);
+	    if (!AddResource(id,RT_XKBCLIENT,dev))
+		return BadAlloc;
 	    interest= XkbAddClientResource((DevicePtr)dev,client,id);
 	    if (!interest)
 		return BadAlloc;
commit eecf91150d4c17fe73913fd6c24064c0394fb40e
Author: Pauli Nieminen <ext-pauli.nieminen at nokia.com>
Date:   Thu Jul 22 15:11:27 2010 +0300

    xkb: Fix memory leak in error path
    
    map is allocated but not freed if reply length and data don't match.
    
    Signed-off-by: Pauli Nieminen <ext-pauli.nieminen at nokia.com>
    Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
    (cherry picked from commit adc0697cfcfba295a15d7a307125093cbccd637f)

diff --git a/xkb/xkb.c b/xkb/xkb.c
index 935f5ea..a82cc38 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -3019,6 +3019,7 @@ register unsigned	bit;
 	    to = (CARD8 *)wire;
 	    if ((to-map)!=length) {
 		client->errorValue = _XkbErrCode2(0xff,length);
+		free(map);
 		return BadLength;
 	    }
 	}
commit b912c08ffa09ec9d7c55db7df1df622dd4b6ab64
Author: Pauli Nieminen <ext-pauli.nieminen at nokia.com>
Date:   Thu Jul 22 11:33:33 2010 +0300

    xkb: Fix memory leak if opening file fails
    
    If fopen fails pointer in buf would be overwriten with a new pointer.
    
    Signed-off-by: Pauli Nieminen <ext-pauli.nieminen at nokia.com>
    Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
    (cherry picked from commit 1223340644744c0b38aa85f5956eb5ab7c696517)

diff --git a/xkb/ddxList.c b/xkb/ddxList.c
index 2256424..39bd739 100644
--- a/xkb/ddxList.c
+++ b/xkb/ddxList.c
@@ -161,6 +161,7 @@ char	tmpname[PATH_MAX];
 	}
 	if (!in) {
 	    haveDir= FALSE;
+	    free(buf);
 	    buf = Xprintf(
 		"'%s/xkbcomp' '-R%s/%s' -w %ld -l -vlfhpR '%s'" W32_tmparg,
                 XkbBinDirectory,XkbBaseDirectory,componentDirs[what],(long)
@@ -176,6 +177,7 @@ char	tmpname[PATH_MAX];
 	}
 	if (!in) {
 	    haveDir= FALSE;
+	    free(buf);
 	    buf = Xprintf(
 		"xkbcomp -R%s -w %ld -l -vlfhpR '%s'" W32_tmparg,
                 componentDirs[what],(long)
commit d4ef63f602325a9920dc1cbf64e3969dfa394d5f
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Tue Aug 17 12:08:52 2010 +1000

    dix: don't create core motion events for non-x/y valuators.
    
    Devices that send motion events with valuators other than x/y get core
    motion events with unchanged x/y coordinates. This confuses some
    applications.
    
    If the DeviceEvent does not have the x/y valuators set, return BadMatch on
    core conversion, thus skipping the event altogether.
    
    Reported-by: Bartosz Brachaczek <b.brachaczek at gmail.com>
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    Tested-by: Bartosz Brachaczek <b.brachaczek at gmail.com>
    (cherry picked from commit de8be07cc0a8163b6ef04455706fd5ca2cebe587)

diff --git a/dix/eventconvert.c b/dix/eventconvert.c
index 4e3de0b..0f747c1 100644
--- a/dix/eventconvert.c
+++ b/dix/eventconvert.c
@@ -102,6 +102,15 @@ EventToCore(InternalEvent *event, xEvent *core)
     switch(event->any.type)
     {
         case ET_Motion:
+            {
+                DeviceEvent *e = &event->device_event;
+                /* Don't create core motion event if neither x nor y are
+                 * present */
+                if (!BitIsOn(e->valuators.mask, 0) &&
+                    !BitIsOn(e->valuators.mask, 1))
+                    return BadMatch;
+            }
+            /* fallthrough */
         case ET_ButtonPress:
         case ET_ButtonRelease:
         case ET_KeyPress:


More information about the Xquartz-changes mailing list