[Xquartz-changes] xserver: Branch 'server-1.11-apple' - 53 commits

Jeremy Huddleston jeremyhu at freedesktop.org
Wed Nov 30 15:00:27 PST 2011


Rebased ref, commits from common ancestor:
commit 02caaab533a9435a6a63ff01ba7f791e39ec76f6
Author: Jeremy Huddleston <jeremyhu at apple.com>
Date:   Fri Feb 12 19:48:52 2010 -0800

    fb: Revert fb changes that broke XQuartz
    
    http://bugs.freedesktop.org/show_bug.cgi?id=26124
    
    Revert "Fix source pictures getting random transforms after 2d6a8f668342a5190cdf43b5."
    Revert "fb: Adjust transform or composite coordinates for pixman operations"
    
    http://bugs.freedesktop.org/26124
    
    This reverts commit a72c65e9176c51de95db2fdbf4c5d946a4911695.
    This reverts commit a6bd5d2e482a5aa84acb3d4932e2a166d8670ef1.
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>

diff --git a/fb/fb.h b/fb/fb.h
index eaa21ad..e65a1c0 100644
--- a/fb/fb.h
+++ b/fb/fb.h
@@ -2049,11 +2049,8 @@ fbFillRegionSolid (DrawablePtr	pDrawable,
 		   FbBits	xor);
 
 extern _X_EXPORT pixman_image_t *
-image_from_pict (PicturePtr	pict,
-		 Bool		has_clip,
-		 int		*xoff,
-		 int		*yoff);
-
+image_from_pict (PicturePtr pict,
+		 Bool       has_clip);
 extern _X_EXPORT void free_pixman_pict (PicturePtr, pixman_image_t *);
 
 #endif /* _FB_H_ */
diff --git a/fb/fbpict.c b/fb/fbpict.c
index 57c93fd..127e5c7 100644
--- a/fb/fbpict.c
+++ b/fb/fbpict.c
@@ -50,24 +50,19 @@ fbComposite (CARD8      op,
 	     CARD16     height)
 {
     pixman_image_t *src, *mask, *dest;
-    int src_xoff, src_yoff;
-    int msk_xoff, msk_yoff;
-    int dst_xoff, dst_yoff;
     
     miCompositeSourceValidate (pSrc);
     if (pMask)
 	miCompositeSourceValidate (pMask);
     
-    src = image_from_pict (pSrc, FALSE, &src_xoff, &src_yoff);
-    mask = image_from_pict (pMask, FALSE, &msk_xoff, &msk_yoff);
-    dest = image_from_pict (pDst, TRUE, &dst_xoff, &dst_yoff);
+    src = image_from_pict (pSrc, TRUE);
+    mask = image_from_pict (pMask, TRUE);
+    dest = image_from_pict (pDst, TRUE);
 
     if (src && dest && !(pMask && !mask))
     {
 	pixman_image_composite (op, src, mask, dest,
-				xSrc + src_xoff, ySrc + src_yoff,
-				xMask + msk_xoff, yMask + msk_yoff,
-				xDst + dst_xoff, yDst + dst_yoff,
+				xSrc, ySrc, xMask, yMask, xDst, yDst,
 				width, height);
     }
 
@@ -146,22 +141,22 @@ create_conical_gradient_image (PictGradient *gradient)
 
 static pixman_image_t *
 create_bits_picture (PicturePtr pict,
-		     Bool       has_clip,
-		     int	*xoff,
-		     int	*yoff)
+		     Bool       has_clip)
 {
-    PixmapPtr pixmap;
     FbBits *bits;
     FbStride stride;
-    int bpp;
+    int bpp, xoff, yoff;
     pixman_image_t *image;
     
-    fbGetDrawablePixmap (pict->pDrawable, pixmap, *xoff, *yoff);
-    fbGetPixmapBitsData(pixmap, bits, stride, bpp);
+    fbGetDrawable (pict->pDrawable, bits, stride, bpp, xoff, yoff);
+
+    bits = (FbBits*)((CARD8*)bits +
+		     (pict->pDrawable->y + yoff) * stride * sizeof(FbBits) +
+		     (pict->pDrawable->x + xoff) * (bpp / 8));
 
     image = pixman_image_create_bits (
 	(pixman_format_code_t)pict->format,
-	pixmap->drawable.width, pixmap->drawable.height,
+	pict->pDrawable->width, pict->pDrawable->height,
 	(uint32_t *)bits, stride * sizeof (FbStride));
 
     if (!image)
@@ -189,55 +184,33 @@ create_bits_picture (PicturePtr pict,
 	if (pict->clientClipType != CT_NONE)
 	    pixman_image_set_has_client_clip (image, TRUE);
 
-	if (*xoff || *yoff)
-	    pixman_region_translate (pict->pCompositeClip, *xoff, *yoff);
+	pixman_region_translate (pict->pCompositeClip, - pict->pDrawable->x, - pict->pDrawable->y);
 
 	pixman_image_set_clip_region (image, pict->pCompositeClip);
 
-	if (*xoff || *yoff)
-	    pixman_region_translate (pict->pCompositeClip, -*xoff, -*yoff);
+	pixman_region_translate (pict->pCompositeClip, pict->pDrawable->x, pict->pDrawable->y);
     }
     
     /* Indexed table */
     if (pict->pFormat->index.devPrivate)
 	pixman_image_set_indexed (image, pict->pFormat->index.devPrivate);
 
-    /* Add in drawable origin to position within the image */
-    *xoff += pict->pDrawable->x;
-    *yoff += pict->pDrawable->y;
-
     return image;
 }
 
 static pixman_image_t *
-image_from_pict_internal (PicturePtr pict, Bool has_clip, int *xoff, int *yoff, Bool is_alpha_map);
+image_from_pict_internal (PicturePtr pict, Bool has_clip, Bool is_alpha_map);
 
 static void
-set_image_properties (pixman_image_t *image, PicturePtr pict, Bool has_clip, int *xoff, int *yoff, Bool is_alpha_map)
+set_image_properties (pixman_image_t *image, PicturePtr pict, Bool is_alpha_map)
 {
     pixman_repeat_t repeat;
     pixman_filter_t filter;
     
     if (pict->transform)
     {
-	/* For source images, adjust the transform to account
-	 * for the drawable offset within the pixman image,
-	 * then set the offset to 0 as it will be used
-	 * to compute positions within the transformed image.
-	 */
-	if (!has_clip) {
-	    struct pixman_transform	adjusted;
-
-	    adjusted = *pict->transform;
-	    pixman_transform_translate(&adjusted,
-				       NULL,
-				       pixman_int_to_fixed(*xoff),
-				       pixman_int_to_fixed(*yoff));
-	    pixman_image_set_transform (image, &adjusted);
-	    *xoff = 0;
-	    *yoff = 0;
-	} else
-	    pixman_image_set_transform (image, pict->transform);
+	pixman_image_set_transform (
+	    image, (pixman_transform_t *)pict->transform);
     }
     
     switch (pict->repeatType)
@@ -267,8 +240,7 @@ set_image_properties (pixman_image_t *image, PicturePtr pict, Bool has_clip, int
      */
     if (pict->alphaMap && !is_alpha_map)
     {
-	int alpha_xoff, alpha_yoff;
-	pixman_image_t *alpha_map = image_from_pict_internal (pict->alphaMap, FALSE, &alpha_xoff, &alpha_yoff, TRUE);
+	pixman_image_t *alpha_map = image_from_pict_internal (pict->alphaMap, TRUE, TRUE);
 	
 	pixman_image_set_alpha_map (
 	    image, alpha_map, pict->alphaOrigin.x, pict->alphaOrigin.y);
@@ -301,7 +273,8 @@ set_image_properties (pixman_image_t *image, PicturePtr pict, Bool has_clip, int
 }
 
 static pixman_image_t *
-image_from_pict_internal (PicturePtr pict, Bool has_clip, int *xoff, int *yoff, Bool is_alpha_map)
+image_from_pict_internal (PicturePtr pict,
+		 Bool has_clip, Bool is_alpha_map)
 {
     pixman_image_t *image = NULL;
 
@@ -310,7 +283,7 @@ image_from_pict_internal (PicturePtr pict, Bool has_clip, int *xoff, int *yoff,
 
     if (pict->pDrawable)
     {
-	image = create_bits_picture (pict, has_clip, xoff, yoff);
+	image = create_bits_picture (pict, has_clip);
     }
     else if (pict->pSourcePict)
     {
@@ -331,19 +304,18 @@ image_from_pict_internal (PicturePtr pict, Bool has_clip, int *xoff, int *yoff,
 	    else if (sp->type == SourcePictTypeConical)
 		image = create_conical_gradient_image (gradient);
 	}
-	*xoff = *yoff = 0;
     }
     
     if (image)
-	set_image_properties (image, pict, has_clip, xoff, yoff, is_alpha_map);
+	set_image_properties (image, pict, is_alpha_map);
     
     return image;
 }
 
 pixman_image_t *
-image_from_pict (PicturePtr pict, Bool has_clip, int *xoff, int *yoff)
+image_from_pict (PicturePtr pict, Bool has_clip)
 {
-    return image_from_pict_internal (pict, has_clip, xoff, yoff, FALSE);
+    return image_from_pict_internal (pict, has_clip, FALSE);
 }
 
 void
diff --git a/fb/fbtrap.c b/fb/fbtrap.c
index 0b5a638..fbe2647 100644
--- a/fb/fbtrap.c
+++ b/fb/fbtrap.c
@@ -39,12 +39,11 @@ fbAddTraps (PicturePtr	pPicture,
 	    xTrap	*traps)
 {
     pixman_image_t *image;
-    int dst_xoff, dst_yoff;
 
-    if (!(image = image_from_pict (pPicture, FALSE, &dst_xoff, &dst_yoff)))
+    if (!(image = image_from_pict (pPicture, FALSE)))
 	return;
     
-    pixman_add_traps (image, x_off + dst_xoff, y_off + dst_yoff,
+    pixman_add_traps (image, x_off, y_off,
 		      ntrap, (pixman_trap_t *)traps);
 
     free_pixman_pict (pPicture, image);
@@ -57,14 +56,13 @@ fbRasterizeTrapezoid (PicturePtr    pPicture,
 		      int	    y_off)
 {
     pixman_image_t *image;
-    int	dst_xoff, dst_yoff;
 
-    if (!(image = image_from_pict (pPicture, FALSE, &dst_xoff, &dst_yoff)))
+    if (!(image = image_from_pict (pPicture, FALSE)))
 	return;
 
     pixman_rasterize_trapezoid (image, (pixman_trapezoid_t *)trap,
-				x_off + dst_xoff,
-				y_off + dst_yoff);
+				x_off,
+				y_off);
 
     free_pixman_pict (pPicture, image);
 }
@@ -77,13 +75,12 @@ fbAddTriangles (PicturePtr  pPicture,
 		xTriangle *tris)
 {
     pixman_image_t *image;
-    int dst_xoff, dst_yoff;
 
-    if (!(image = image_from_pict (pPicture, FALSE, &dst_xoff, &dst_yoff)))
+    if (!(image = image_from_pict (pPicture, FALSE)))
 	return;
     
     pixman_add_triangles (image,
-			  dst_xoff + x_off, dst_yoff + y_off,
+			  x_off, y_off,
 			  ntri, (pixman_triangle_t *)tris);
 
     free_pixman_pict (pPicture, image);
@@ -110,13 +107,11 @@ fbShapes (CompositeShapesFunc	composite,
 	  const uint8_t *	shapes)
 {
     pixman_image_t *src, *dst;
-    int src_xoff, src_yoff;
-    int dst_xoff, dst_yoff;
 
     miCompositeSourceValidate (pSrc);
 
-    src = image_from_pict (pSrc, FALSE, &src_xoff, &src_yoff);
-    dst = image_from_pict (pDst, TRUE, &dst_xoff, &dst_yoff);
+    src = image_from_pict (pSrc, FALSE);
+    dst = image_from_pict (pDst, TRUE);
 
     if (src && dst)
     {
@@ -136,10 +131,10 @@ fbShapes (CompositeShapesFunc	composite,
 	    for (i = 0; i < nshapes; ++i)
 	    {
 		composite (op, src, dst, format,
-			   xSrc + src_xoff,
-			   ySrc + src_yoff,
-			   dst_xoff,
-			   dst_yoff,
+			   xSrc,
+			   ySrc,
+			   0,
+			   0,
 			   1, shapes + i * shape_size);
 	    }
 	}
@@ -162,10 +157,10 @@ fbShapes (CompositeShapesFunc	composite,
 	    }
 	    
 	    composite (op, src, dst, format,
-		       xSrc + src_xoff,
-		       ySrc + src_yoff,
-		       dst_xoff,
-		       dst_yoff,
+		       xSrc,
+		       ySrc,
+		       0,
+		       0,
 		       nshapes, shapes);
 	}
 
commit beb4749f629fbfce3b314f0de1cfd8e781f99241
Author: Jeremy Huddleston <jeremyhu at apple.com>
Date:   Fri Apr 30 13:08:25 2010 -0700

    Workaround the GC clipping problem in miPaintWindow and add some debugging output.
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>

diff --git a/mi/miexpose.c b/mi/miexpose.c
index 0f1ebe5..dcbfe1c 100644
--- a/mi/miexpose.c
+++ b/mi/miexpose.c
@@ -521,6 +521,7 @@ void RootlessSetPixmapOfAncestors(WindowPtr pWin);
 void RootlessStartDrawing(WindowPtr pWin);
 void RootlessDamageRegion(WindowPtr pWin, RegionPtr prgn);
 Bool IsFramedWindow(WindowPtr pWin);
+#include "../fb/fb.h"
 #endif 
 
 void
@@ -548,24 +549,37 @@ miPaintWindow(WindowPtr pWin, RegionPtr prgn, int what)
     Bool	solid = TRUE;
     DrawablePtr	drawable = &pWin->drawable;
 
+#ifdef XQUARTZ_CLIP_DEBUG
+    ErrorF("START %d BS %d (pR = %ld)\n", what, pWin->backgroundState, ParentRelative);
+    ErrorF("      Rgn: %d %d %d %d\n", prgn->extents.x1, prgn->extents.y1,
+	                               prgn->extents.x2 - prgn->extents.x1,
+	                               prgn->extents.y2 - prgn->extents.y1);
+    ErrorF("      Win: %d %d (%d %d) %d %d\n", pWin->origin.x, pWin->origin.y,
+	                                       pWin->winSize.extents.x1, pWin->winSize.extents.y1,
+	                                       pWin->winSize.extents.x2 - pWin->winSize.extents.x1,
+					       pWin->winSize.extents.y2 - pWin->winSize.extents.y1);
+    ErrorF("     Draw: %d %d %d %d\n", pWin->drawable.x, pWin->drawable.y,
+				       pWin->drawable.width, pWin->drawable.height);
+#endif
+
 #ifdef ROOTLESS
     if(!drawable || drawable->type == UNDRAWABLE_WINDOW)
 	return;
-
-    if(IsFramedWindow(pWin)) {
-        RootlessStartDrawing(pWin);
-        RootlessDamageRegion(pWin, prgn);
-    
-        if(pWin->backgroundState == ParentRelative) {
-            if((what == PW_BACKGROUND) || 
-               (what == PW_BORDER && !pWin->borderIsPixel))
-                RootlessSetPixmapOfAncestors(pWin);
-        }
-    }
 #endif
     
     if (what == PW_BACKGROUND)
     {
+#ifdef ROOTLESS
+	if(IsFramedWindow(pWin)) {
+	    RootlessStartDrawing(pWin);
+	    RootlessDamageRegion(pWin, prgn);
+
+	    if(pWin->backgroundState == ParentRelative) {
+		RootlessSetPixmapOfAncestors(pWin);
+	    }
+	}
+#endif
+
 	while (pWin->backgroundState == ParentRelative)
 	    pWin = pWin->parent;
 
@@ -591,6 +605,18 @@ miPaintWindow(WindowPtr pWin, RegionPtr prgn, int what)
     {
 	PixmapPtr   pixmap;
 
+#ifdef ROOTLESS
+	if(IsFramedWindow(pWin)) {
+	    RootlessStartDrawing(pWin);
+	    RootlessDamageRegion(pWin, prgn);
+	    
+	    if(!pWin->borderIsPixel &&
+		pWin->backgroundState == ParentRelative) {
+		RootlessSetPixmapOfAncestors(pWin);
+	    }
+	}
+#endif
+
 	tile_x_off = drawable->x;
 	tile_y_off = drawable->y;
 	
@@ -599,6 +625,12 @@ miPaintWindow(WindowPtr pWin, RegionPtr prgn, int what)
 	    return;
 	pixmap = (*pScreen->GetWindowPixmap) ((WindowPtr) drawable);
 	drawable = &pixmap->drawable;
+
+#ifdef XQUARTZ_CLIP_DEBUG
+	ErrorF("     Draw: %d %d %d %d\n",
+	       drawable->x, drawable->y, drawable->width, drawable->height);    
+#endif
+	
 #ifdef COMPOSITE
 	draw_x_off = pixmap->screen_x;
 	draw_y_off = pixmap->screen_y;
@@ -661,6 +693,57 @@ miPaintWindow(WindowPtr pWin, RegionPtr prgn, int what)
     ChangeGC (NullClient, pGC, gcmask, gcval);
     ValidateGC (drawable, pGC);
 
+#ifdef XQUARTZ_CLIP_DEBUG
+    ErrorF("       GC: %d %d %d %d\n",
+	   pGC->pCompositeClip->extents.x1, pGC->pCompositeClip->extents.y1,
+	   pGC->pCompositeClip->extents.x2 - pGC->pCompositeClip->extents.x1,
+	   pGC->pCompositeClip->extents.y2 - pGC->pCompositeClip->extents.y1);
+#endif
+    
+#ifdef XQUARTZ
+    /* Looks like our clipping isn't set right for some reason:
+     * http://xquartz.macosforge.org/trac/ticket/290
+     */
+    if(what == PW_BORDER) {
+
+#if 0
+	if(solid) {
+#if 1
+	    fbFillRegionSolid(&pWin->drawable,
+			      prgn,
+			      0,
+			      fbReplicatePixel(fill.pixel,
+					       pWin->drawable.bitsPerPixel));
+#else
+	    fbFillRegionSolid(drawable,
+			      prgn,
+			      0,
+			      fbReplicatePixel(fill.pixel,
+					       drawable->bitsPerPixel));
+#endif
+	    return;
+	}
+#endif
+    
+	pGC->pCompositeClip->extents.x1 += prgn->extents.x1;
+	pGC->pCompositeClip->extents.y1 += prgn->extents.y1;
+	pGC->pCompositeClip->extents.x2 += prgn->extents.x1;
+	pGC->pCompositeClip->extents.y2 += prgn->extents.y1;
+	
+	if(pGC->pCompositeClip->extents.x2 > drawable->pScreen->width)
+	    pGC->pCompositeClip->extents.x2 = drawable->pScreen->width;
+	if(pGC->pCompositeClip->extents.y2 > drawable->pScreen->height)
+	    pGC->pCompositeClip->extents.y2 = drawable->pScreen->height;
+    }
+#endif
+
+#ifdef XQUARTZ_CLIP_DEBUG
+    ErrorF("       GC: %d %d %d %d\n",
+	   pGC->pCompositeClip->extents.x1, pGC->pCompositeClip->extents.y1,
+	   pGC->pCompositeClip->extents.x2 - pGC->pCompositeClip->extents.x1,
+	   pGC->pCompositeClip->extents.y2 - pGC->pCompositeClip->extents.y1);    
+#endif
+
     numRects = RegionNumRects(prgn);
     pbox = RegionRects(prgn);
     for (i= numRects; --i >= 0; pbox++, prect++)
commit 920e74cf9b17b0f54bcb9fdea468a97909376bb8
Author: Jeremy Huddleston <jeremyhu at apple.com>
Date:   Sat Oct 30 14:55:06 2010 -0700

    configure.ac: Add -fno-strict-aliasing to CFLAGS
    
    This should address https://bugs.freedesktop.org/show_bug.cgi?id=31238
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>

diff --git a/configure.ac b/configure.ac
index 9237686..c203f9f 100644
--- a/configure.ac
+++ b/configure.ac
@@ -87,6 +87,12 @@ XORG_PROG_RAWCPP
 # easier overrides at build time.
 XSERVER_CFLAGS='$(CWARNFLAGS)'
 
+dnl Explicitly add -fno-strict-aliasing since this option should disappear
+dnl from util-macros CWARNFLAGS
+if  test "x$GCC" = xyes ; then
+    XSERVER_CFLAGS="$XSERVER_CFLAGS -fno-strict-aliasing"
+fi
+
 dnl Check for dtrace program (needed to build Xserver dtrace probes)
 dnl Also checks for <sys/sdt.h>, since some Linux distros have an 
 dnl ISDN trace program named dtrace
commit bed7d7f31ed48cbf0931ca77fdac135e514a2a44
Author: Rui Matos <tiagomatos at gmail.com>
Date:   Tue Nov 1 21:32:36 2011 +0000

    randr: Make the RRConstrainCursorHarder logic the same as miPointerSetPosition
    
    The constraining logic in RRConstrainCursorHarder allows the cursor to reach
    crtc positions of x = width and y = height while the constraining code in
    miPointerSetPosition only allows it to reach x = width - 1 and y = height - 1
    for the analogous screen case.
    
    This patch makes the former's logic equivalent to the latter's which allows
    applications to benefit from Fitts's law. E.g. a maximized application
    adjacent to a crtc border wouldn't get pointer events if the user moved the
    pointer all the way until it's contained.
    
    Signed-off-by: Rui Matos <tiagomatos at gmail.com>
    Reviewed-by: Daniel Stone <daniel at fooishbar.org>
    Signed-off-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit 9cc44b955b27de33348d6a20bebc9704930ee18e)

diff --git a/randr/rrcrtc.c b/randr/rrcrtc.c
index 0437795..305a270 100644
--- a/randr/rrcrtc.c
+++ b/randr/rrcrtc.c
@@ -1465,7 +1465,7 @@ RRConstrainCursorHarder(DeviceIntPtr pDev, ScreenPtr pScreen, int mode, int *x,
 
        crtc_bounds(crtc, &left, &right, &top, &bottom);
 
-       if ((*x >= left) && (*x <= right) && (*y >= top) && (*y <= bottom))
+       if ((*x >= left) && (*x < right) && (*y >= top) && (*y < bottom))
            return;
     }
 
@@ -1481,24 +1481,15 @@ RRConstrainCursorHarder(DeviceIntPtr pDev, ScreenPtr pScreen, int mode, int *x,
        crtc_bounds(crtc, &left, &right, &top, &bottom);
        miPointerGetPosition(pDev, &nx, &ny);
 
-       if ((nx >= left) && (nx <= right) && (ny >= top) && (ny <= bottom)) {
-           if ((*x <= left) || (*x >= right)) {
-               int dx = *x - nx;
-
-               if (dx > 0)
-                   *x = right;
-               else if (dx < 0)
-                   *x = left;
-           }
-
-           if ((*y <= top) || (*y >= bottom)) {
-               int dy = *y - ny;
-
-               if (dy > 0)
-                   *y = bottom;
-               else if (dy < 0)
-                   *y = top;
-           }
+       if ((nx >= left) && (nx < right) && (ny >= top) && (ny < bottom)) {
+           if (*x < left)
+               *x = left;
+           if (*x >= right)
+               *x = right - 1;
+           if (*y < top)
+               *y = top;
+           if (*y >= bottom)
+               *y = bottom - 1;
 
            return;
        }
commit 4689c84a07f87d35492feeae2bc59642c31b6eb3
Author: Jeremy Huddleston <jeremyhu at apple.com>
Date:   Mon Nov 28 00:07:29 2011 -0800

    configure.ac: 1.11.2.901 (1.11.3 RC1)
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>

diff --git a/configure.ac b/configure.ac
index f0a14c4..9237686 100644
--- a/configure.ac
+++ b/configure.ac
@@ -26,8 +26,8 @@ dnl
 dnl Process this file with autoconf to create configure.
 
 AC_PREREQ(2.57)
-AC_INIT([xorg-server], 1.11.2, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
-RELEASE_DATE="2011-11-04"
+AC_INIT([xorg-server], 1.11.2.901, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
+RELEASE_DATE="2011-11-28"
 AC_CONFIG_SRCDIR([Makefile.am])
 AM_INIT_AUTOMAKE([foreign dist-bzip2])
 AM_MAINTAINER_MODE
commit e2661ddbc5d1b2edb1ab514a761f8c0b66e69736
Author: Derek Buitenhuis <derek.buitenhuis at gmail.com>
Date:   Sun Nov 6 12:20:51 2011 -0500

    Fix vesa's VBE PanelID interpretation
    
    xserver's VESA driver's VBE (Vesa BIOS Extensions) code
    includes a PanelID probe, which can get a monitor's native
    resolution. From this, using CVT formulas, it derives
    horizontal sync rate and a vertical refresh rate ranges.
    
    It however, only derives the upper bounds of the ranges, and
    the lower bounds cannot de derived. By default, they are set
    to hardcoded constants which represent the lowest supported
    resolution: 640x480. The constants in vbe.c however, were
    not actually derived from forulas, but carried over from
    other code from the bad old days, and are not relevant
    to flat panel displays. This caused, for example, EEEPC701's
    panel, with a native resolution of 800x480, to end up with
    a upper bound of the horizontal sync rate that was lower
    than the hardcoded lower bound, which of course broke things.
    
    These numbers have been rederived using both my own CVT tool
    based on xf86CVTMode(), and using the provided 'cvt' tool
    that comes with xserver.
    
    Signed-off-by: Derek Buitenhuis <derek.buitenhuis at gmail.com>
    Reviewed-by: Adam Jackson <ajax at redhat.com>
    Signed-off-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit f0d50cc6651dce3a8a3cd3fb84210aa92b139763)

diff --git a/hw/xfree86/vbe/vbe.c b/hw/xfree86/vbe/vbe.c
index 04132d9..06a6284 100644
--- a/hw/xfree86/vbe/vbe.c
+++ b/hw/xfree86/vbe/vbe.c
@@ -1036,13 +1036,16 @@ VBEInterpretPanelID(int scrnIndex, struct vbePanelID *data)
     mode = xf86CVTMode(data->hsize, data->vsize, PANEL_HZ, 1, 0);
 
     pScrn->monitor->nHsync = 1;
-    pScrn->monitor->hsync[0].lo = 31.5;
+    pScrn->monitor->hsync[0].lo = 29.37;
     pScrn->monitor->hsync[0].hi = (float)mode->Clock / (float)mode->HTotal;
     pScrn->monitor->nVrefresh = 1;
     pScrn->monitor->vrefresh[0].lo = 56.0;
     pScrn->monitor->vrefresh[0].hi =
 	(float)mode->Clock*1000.0 / (float)mode->HTotal / (float)mode->VTotal;
 
+    if (pScrn->monitor->vrefresh[0].hi < 59.47)
+	pScrn->monitor->vrefresh[0].hi = 59.47;
+
     free(mode);
 }
 
commit 2e3406fc6737539210e29ac0b2821848e6d1f069
Author: Jeremy Huddleston <jeremyhu at apple.com>
Date:   Mon Nov 7 22:14:30 2011 +0000

    dmx: Build fix for -Werror=implicit-function-declaration
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>
    Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    (cherry picked from commit f405dfffe7d5db81d398615a80acbeba7e014ada)

diff --git a/hw/dmx/glxProxy/compsize.c b/hw/dmx/glxProxy/compsize.c
index 9a40d65..5a5d5d0 100644
--- a/hw/dmx/glxProxy/compsize.c
+++ b/hw/dmx/glxProxy/compsize.c
@@ -29,6 +29,7 @@
  */
 
 #include <GL/gl.h>
+#include "compsize.h"
 
 GLint __glFogiv_size(GLenum pname)
 {
diff --git a/hw/dmx/glxProxy/compsize.h b/hw/dmx/glxProxy/compsize.h
new file mode 100644
index 0000000..856c6f5
--- /dev/null
+++ b/hw/dmx/glxProxy/compsize.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright 2011 Apple Inc.
+ *
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation on the rights to use, copy, modify, merge,
+ * publish, distribute, sublicense, and/or sell copies of the Software,
+ * and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NON-INFRINGEMENT.  IN NO EVENT SHALL RED HAT AND/OR THEIR SUPPLIERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#ifndef __compsize_h__
+#define __compsize_h__
+
+extern GLint __glColorTableParameterfv_size(GLenum pname);
+extern GLint __glColorTableParameteriv_size(GLenum pname);
+extern GLint __glConvolutionParameterfv_size(GLenum pname);
+extern GLint __glConvolutionParameteriv_size(GLenum pname);
+extern GLint __glFogfv_size(GLenum pname);
+extern GLint __glFogiv_size(GLenum pname);
+extern GLint __glLightModelfv_size(GLenum pname);
+extern GLint __glLightModeliv_size(GLenum pname);
+extern GLint __glLightfv_size(GLenum pname);
+extern GLint __glLightiv_size(GLenum pname);
+extern GLint __glMaterialfv_size(GLenum pname);
+extern GLint __glMaterialiv_size(GLenum pname);
+extern GLint __glTexEnvfv_size(GLenum e);
+extern GLint __glTexEnviv_size(GLenum e);
+extern GLint __glTexGendv_size(GLenum e);
+extern GLint __glTexGenfv_size(GLenum e);
+extern GLint __glTexGeniv_size(GLenum e);
+extern GLint __glTexParameterfv_size(GLenum e);
+extern GLint __glTexParameteriv_size(GLenum e);
+
+#endif /* !__compsize_h__ */
diff --git a/hw/dmx/glxProxy/g_renderswap.c b/hw/dmx/glxProxy/g_renderswap.c
index e675696..e434a71 100644
--- a/hw/dmx/glxProxy/g_renderswap.c
+++ b/hw/dmx/glxProxy/g_renderswap.c
@@ -32,6 +32,7 @@
 #include "glxext.h"
 #include "g_disptab.h"
 #include "unpack.h"
+#include "compsize.h"
 
 void __glXDispSwap_CallList(GLbyte *pc)
 {
diff --git a/hw/dmx/glxProxy/glxcmds.c b/hw/dmx/glxProxy/glxcmds.c
index f79264e..3f21f65 100644
--- a/hw/dmx/glxProxy/glxcmds.c
+++ b/hw/dmx/glxProxy/glxcmds.c
@@ -52,6 +52,8 @@
 #include "glxvisuals.h"
 #include "glxswap.h"
 
+#include "glxcmds.h"
+
 #ifdef PANORAMIX
 #include "panoramiXsrv.h"
 #endif
diff --git a/hw/dmx/glxProxy/glxcmds.h b/hw/dmx/glxProxy/glxcmds.h
new file mode 100644
index 0000000..ae866be
--- /dev/null
+++ b/hw/dmx/glxProxy/glxcmds.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright 2011 Apple Inc.
+ *
+ * All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining
+ * a copy of this software and associated documentation files (the
+ * "Software"), to deal in the Software without restriction, including
+ * without limitation on the rights to use, copy, modify, merge,
+ * publish, distribute, sublicense, and/or sell copies of the Software,
+ * and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the
+ * next paragraph) shall be included in all copies or substantial
+ * portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NON-INFRINGEMENT.  IN NO EVENT SHALL RED HAT AND/OR THEIR SUPPLIERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#ifndef __GLX_cmds_h__
+#define __GLX_cmds_h__
+
+extern int __glXBindSwapBarrierSGIX(__GLXclientState *cl, GLbyte *pc);
+extern int __glXCreateContextWithConfigSGIX(__GLXclientState *cl, GLbyte *pc);
+extern int __glXJoinSwapGroupSGIX(__GLXclientState *cl, GLbyte *pc);
+extern int __glXMakeCurrentReadSGI(__GLXclientState *cl, GLbyte *pc);
+extern int __glXQueryMaxSwapBarriersSGIX(__GLXclientState *cl, GLbyte *pc);
+
+#endif /* !__GLX_cmds_h__ */
diff --git a/hw/dmx/glxProxy/glxcmdsswap.c b/hw/dmx/glxProxy/glxcmdsswap.c
index 2294059..f28a79d 100644
--- a/hw/dmx/glxProxy/glxcmdsswap.c
+++ b/hw/dmx/glxProxy/glxcmdsswap.c
@@ -35,11 +35,14 @@
 #include <pixmapstr.h>
 #include <windowstr.h>
 #include "unpack.h"
+#include "glxcmds.h"
 #include "glxext.h"
 #include "glxvendor.h"
 
 extern int glxIsExtensionSupported( char *ext );
 
+int __glXSwapGetFBConfigsSGIX(__GLXclientState *cl, GLbyte *pc);
+
 /************************************************************************/
 
 /*
commit b440fc9c1bb10f8c227120e6d9e58101108d71bb
Author: dtakahashi42 <dtakahashi42 at gmail.com>
Date:   Fri Nov 18 11:30:22 2011 -0800

    rootless: Fix a server crash when choosing a color with the gimp color wheel
    
    https://trac.macports.org/ticket/30927
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>
    Reviewed-by: Jeremy Huddleston <jeremyhu at apple.com>
    (cherry picked from commit 328074890eeb111950e984c6f618311983600b20)

diff --git a/miext/rootless/rootlessScreen.c b/miext/rootless/rootlessScreen.c
index 0801e72..c855706 100644
--- a/miext/rootless/rootlessScreen.c
+++ b/miext/rootless/rootlessScreen.c
@@ -247,8 +247,8 @@ RootlessComposite(CARD8 op, PicturePtr pSrc, PicturePtr pMask, PicturePtr pDst,
     WindowPtr srcWin, dstWin, maskWin = NULL;
 
     if (pMask) {                        // pMask can be NULL
-        maskWin = (pMask->pDrawable->type == DRAWABLE_WINDOW) ?
-                  (WindowPtr)pMask->pDrawable :  NULL;
+        maskWin = (pMask->pDrawable && pMask->pDrawable->type == DRAWABLE_WINDOW) ?
+                  (WindowPtr)pMask->pDrawable : NULL;
     }
     srcWin  = (pSrc->pDrawable && pSrc->pDrawable->type  == DRAWABLE_WINDOW) ?
               (WindowPtr)pSrc->pDrawable  :  NULL;
commit 40c1287f36517f0afd62306e306f6a68120d9a59
Author: Ross Burton <ross at linux.intel.com>
Date:   Wed Sep 28 11:46:02 2011 +0100

    edid: Add quirk for Acer Aspire One 110
    
    At least one revision of the AAO reports a 190x110mm maximum size but a
    451x113mm mode.
    
    X.Org Bug 41141 <https://bugs.freedesktop.org/show_bug.cgi?id=41141>
    
    Signed-off-by: Ross Burton <ross at linux.intel.com>
    Reviewed-by: Daniel Stone <daniel at fooishbar.org>
    Reviewed-by: Jeremy Huddleston <jeremyhu at apple.com>
    (cherry picked from commit 58864146fbdf1820d04825838691e84784ef91bc)

diff --git a/hw/xfree86/modes/xf86EdidModes.c b/hw/xfree86/modes/xf86EdidModes.c
index 9ff2f0d..86065f8 100644
--- a/hw/xfree86/modes/xf86EdidModes.c
+++ b/hw/xfree86/modes/xf86EdidModes.c
@@ -165,6 +165,11 @@ static Bool quirk_detailed_use_maximum_size (int scrnIndex, xf86MonPtr DDC)
 	DDC->vendor.prod_id == 6400)
 	return TRUE;
 
+    /* Bug #41141: Acer Aspire One */
+    if (memcmp (DDC->vendor.name, "LGD", 4) == 0 &&
+	DDC->vendor.prod_id == 0x7f01)
+	return TRUE;
+
     return FALSE;
 }
 
commit 7972e2dade58158bb98f5b7dc5f873b9fb3446de
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Thu Aug 25 16:04:04 2011 +0100

    dri2: Register the DRI2DrawableType after server regeneration
    
    The Resource database is reset upon regeneration and so the dri2 module
    needs to re-register its RESTYPE for the drawable or else it will
    clobber the next unsuspecting user of the database. Fortunately, DRI2 is
    loaded late in the initialisation sequence and was last up until
    xf86-video-intel started using the Resource database to track
    outstanding swaps...
    
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
    Reviewed-by: Jeremy Huddleston <jeremyhu at apple.com>
    Tested-by: Paulo Zanoni <paulo.r.zanoni at intel.com>
    (cherry picked from commit 34b0e4eee911f8b09a3682a7f1b4c8598ef48b8d)

diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
index d71e4f4..f7f7000 100644
--- a/hw/xfree86/dri2/dri2.c
+++ b/hw/xfree86/dri2/dri2.c
@@ -1194,14 +1194,24 @@ DRI2CloseScreen(ScreenPtr pScreen)
 }
 
 extern ExtensionModule dri2ExtensionModule;
+extern Bool DRI2ModuleSetup(void);
+
+/* Called by InitExtensions() */
+Bool
+DRI2ModuleSetup(void)
+{
+    dri2DrawableRes = CreateNewResourceType(DRI2DrawableGone, "DRI2Drawable");
+    if (!dri2DrawableRes)
+	return FALSE;
+
+    return TRUE;
+}
 
 static pointer
 DRI2Setup(pointer module, pointer opts, int *errmaj, int *errmin)
 {
     static Bool setupDone = FALSE;
 
-    dri2DrawableRes = CreateNewResourceType(DRI2DrawableGone, "DRI2Drawable");
-
     if (!setupDone)
     {
 	setupDone = TRUE;
diff --git a/hw/xfree86/dri2/dri2ext.c b/hw/xfree86/dri2/dri2ext.c
index 552b26b..a2198e2 100644
--- a/hw/xfree86/dri2/dri2ext.c
+++ b/hw/xfree86/dri2/dri2ext.c
@@ -50,6 +50,7 @@
 #include "xf86Module.h"
 
 static ExtensionEntry	*dri2Extension;
+extern Bool DRI2ModuleSetup(void);
 
 static Bool
 validDrawable(ClientPtr client, XID drawable, Mask access_mode,
@@ -636,6 +637,8 @@ DRI2ExtensionInit(void)
 				 StandardMinorOpcode);
 
     DRI2EventBase = dri2Extension->eventBase;
+
+    DRI2ModuleSetup();
 }
 
 extern Bool noDRI2Extension;
commit 73beaf9033d9a44e7a7c654f296624c7265eeb6d
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Mon Jan 24 11:17:03 2011 +0000

    DRI2: Avoid a NULL pointer dereference
    
    Bugzilla:  https://bugs.freedesktop.org/show_bug.cgi?id=41211
    
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
    Reviewed-by: Jeremy Huddleston <jeremyhu at apple.com>
    (cherry picked from commit bfa1a0dd190ed88020d60eba3bb04681c8e83a68)

diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
index af3bcae..d71e4f4 100644
--- a/hw/xfree86/dri2/dri2.c
+++ b/hw/xfree86/dri2/dri2.c
@@ -780,7 +780,8 @@ DRI2WaitSwap(ClientPtr client, DrawablePtr pDrawable)
     /* If we're currently waiting for a swap on this drawable, reset
      * the request and suspend the client.  We only support one
      * blocked client per drawable. */
-    if ((pPriv->swapsPending) &&
+    if (pPriv &&
+	pPriv->swapsPending &&
 	pPriv->blockedClient == NULL) {
 	ResetCurrentRequest(client);
 	client->sequence--;
commit 6105fcaa3592cb6d0d5f22d9b850986d0bc4d241
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Mon Jan 24 11:17:03 2011 +0000

    VidMode: prevent crash with no modes
    
    Bugzilla:  https://bugs.freedesktop.org/show_bug.cgi?id=17431
    
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
    Reviewed-by: Jeremy Huddleston <jeremyhu at apple.com>
    (cherry picked from commit eeb21a133b982f71de739baf62e53c8a68f5d495)

diff --git a/hw/xfree86/common/xf86VidMode.c b/hw/xfree86/common/xf86VidMode.c
index 4dd454d..2ae5484 100644
--- a/hw/xfree86/common/xf86VidMode.c
+++ b/hw/xfree86/common/xf86VidMode.c
@@ -221,6 +221,9 @@ VidModeGetFirstModeline(int scrnIndex, pointer *mode, int *dotClock)
 	return FALSE;
 
     pScrn = xf86Screens[scrnIndex];
+    if (pScrn->modes == NULL)
+	    return FALSE;
+
     pVidMode = VMPTR(pScrn->pScreen);
     pVidMode->First = pScrn->modes;
     pVidMode->Next =  pVidMode->First->next;
commit d113b2911573f3685dc644c6fdd1979aa880b99f
Author: Rami Ylimäki <rami.ylimaki at vincit.fi>
Date:   Tue Oct 4 12:25:26 2011 +0300

    record: Prevent out of bounds access when recording a reply.
    
    Any pad bytes in replies are written to the client from a zeroed
    array. However, record extension tries to incorrectly access the pad
    bytes from the end of reply data.
    
    Signed-off-by: Rami Ylimäki <rami.ylimaki at vincit.fi>
    Reviewed-by: Erkki Seppälä <erkki.seppala at vincit.fi>
    (cherry picked from commit c1bb8f43b9290c2b18a9f0ac59773ff8f1eb974f)

diff --git a/include/os.h b/include/os.h
index a553f57..c9a8b3e 100644
--- a/include/os.h
+++ b/include/os.h
@@ -451,9 +451,10 @@ extern _X_EXPORT CallbackListPtr ReplyCallback;
 typedef struct {
     ClientPtr client;
     const void *replyData;
-    unsigned long dataLenBytes;
+    unsigned long dataLenBytes; /* actual bytes from replyData + pad bytes */
     unsigned long bytesRemaining;
     Bool startOfReply;
+    unsigned long padBytes;     /* pad bytes from zeroed array */
 } ReplyInfoRec;
 
 /* stuff for FlushCallback */
diff --git a/os/io.c b/os/io.c
index 4210238..c59e18c 100644
--- a/os/io.c
+++ b/os/io.c
@@ -810,6 +810,7 @@ WriteToClient (ClientPtr who, int count, const void *__buf)
 	replyinfo.client = who;
 	replyinfo.replyData = buf;
 	replyinfo.dataLenBytes = count + padBytes;
+	replyinfo.padBytes = padBytes;
 	if (who->replyBytesRemaining)
 	{ /* still sending data of an earlier reply */
 	    who->replyBytesRemaining -= count + padBytes;
diff --git a/record/record.c b/record/record.c
index 69fca72..93383ce 100644
--- a/record/record.c
+++ b/record/record.c
@@ -269,8 +269,9 @@ RecordFlushReplyBuffer(
  *	  device events and EndOfData, pClient is NULL.
  *	category is the category of the protocol element, as defined
  *	  by the RECORD spec.
- *	data is a pointer to the protocol data, and datalen is its length
- *	  in bytes.
+ *	data is a pointer to the protocol data, and datalen - padlen
+ *	  is its length in bytes.
+ *	padlen is the number of pad bytes from a zeroed array.
  *	futurelen is the number of bytes that will be sent in subsequent
  *	  calls to this function to complete this protocol element.  
  *	  In those subsequent calls, futurelen will be -1 to indicate
@@ -290,7 +291,7 @@ RecordFlushReplyBuffer(
  */
 static void
 RecordAProtocolElement(RecordContextPtr pContext, ClientPtr pClient,
-		       int category, pointer data, int datalen, int futurelen)
+		       int category, pointer data, int datalen, int padlen, int futurelen)
 {
     CARD32 elemHeaderData[2];
     int numElemHeaders = 0;
@@ -399,15 +400,20 @@ RecordAProtocolElement(RecordContextPtr pContext, ClientPtr pClient,
 	}
 	if (datalen)
 	{
+	    static char padBuffer[3]; /* as in FlushClient */
 	    memcpy(pContext->replyBuffer + pContext->numBufBytes,
-		   data, datalen);
-	    pContext->numBufBytes += datalen;
+		   data, datalen - padlen);
+	    pContext->numBufBytes += datalen - padlen;
+	    memcpy(pContext->replyBuffer + pContext->numBufBytes,
+		   padBuffer, padlen);
+	    pContext->numBufBytes += padlen;
 	}
     }
     else
+    {
 	RecordFlushReplyBuffer(pContext, (pointer)elemHeaderData,
-			       numElemHeaders, (pointer)data, datalen);
-
+			       numElemHeaders, (pointer)data, datalen - padlen);
+    }
 } /* RecordAProtocolElement */
 
 
@@ -485,19 +491,19 @@ RecordABigRequest(RecordContextPtr pContext, ClientPtr client, xReq *stuff)
     /* record the request header */
     bytesLeft = client->req_len << 2;
     RecordAProtocolElement(pContext, client, XRecordFromClient,
-			   (pointer)stuff, SIZEOF(xReq), bytesLeft);
+			   (pointer)stuff, SIZEOF(xReq), 0, bytesLeft);
 
     /* reinsert the extended length field that was squished out */
     bigLength = client->req_len + bytes_to_int32(sizeof(bigLength));
     if (client->swapped)
 	swapl(&bigLength, n);
     RecordAProtocolElement(pContext, client, XRecordFromClient,
-		(pointer)&bigLength, sizeof(bigLength), /* continuation */ -1);
+               (pointer)&bigLength, sizeof(bigLength), 0, /* continuation */ -1);
     bytesLeft -= sizeof(bigLength);
 
     /* record the rest of the request after the length */
     RecordAProtocolElement(pContext, client, XRecordFromClient,
-		(pointer)(stuff + 1), bytesLeft, /* continuation */ -1);
+               (pointer)(stuff + 1), bytesLeft, 0, /* continuation */ -1);
 } /* RecordABigRequest */
 
 
@@ -544,7 +550,7 @@ RecordARequest(ClientPtr client)
 		    RecordABigRequest(pContext, client, stuff);
 		else
 		    RecordAProtocolElement(pContext, client, XRecordFromClient,
-				(pointer)stuff, client->req_len << 2, 0);
+				(pointer)stuff, client->req_len << 2, 0, 0);
 	    }
 	    else /* extension, check minor opcode */
 	    {
@@ -568,7 +574,7 @@ RecordARequest(ClientPtr client)
 			else
 			    RecordAProtocolElement(pContext, client, 
 					XRecordFromClient, (pointer)stuff,
-					client->req_len << 2, 0);
+					client->req_len << 2, 0, 0);
 			break;
 		    }			    
 		} /* end for each minor op info */
@@ -621,7 +627,8 @@ RecordAReply(CallbackListPtr *pcbl, pointer nulldata, pointer calldata)
 	    if (pContext->continuedReply)
 	    {
 		RecordAProtocolElement(pContext, client, XRecordFromServer,
-		   (pointer)pri->replyData, pri->dataLenBytes, /* continuation */ -1);
+		   (pointer)pri->replyData, pri->dataLenBytes,
+			    pri->padBytes, /* continuation */ -1);
 		if (!pri->bytesRemaining)
 		    pContext->continuedReply = 0;
 	    }
@@ -631,7 +638,7 @@ RecordAReply(CallbackListPtr *pcbl, pointer nulldata, pointer calldata)
 		if (majorop <= 127)
 		{ /* core reply */
 		    RecordAProtocolElement(pContext, client, XRecordFromServer,
-		       (pointer)pri->replyData, pri->dataLenBytes, pri->bytesRemaining);
+		       (pointer)pri->replyData, pri->dataLenBytes, 0, pri->bytesRemaining);
 		    if (pri->bytesRemaining)
 			pContext->continuedReply = 1;
 		}
@@ -653,7 +660,7 @@ RecordAReply(CallbackListPtr *pcbl, pointer nulldata, pointer calldata)
 			{
 			    RecordAProtocolElement(pContext, client, 
 				XRecordFromServer, (pointer)pri->replyData,
-				pri->dataLenBytes, pri->bytesRemaining);
+				pri->dataLenBytes, 0, pri->bytesRemaining);
 			    if (pri->bytesRemaining)
 				pContext->continuedReply = 1;
 			    break;
@@ -725,7 +732,7 @@ RecordADeliveredEventOrError(CallbackListPtr *pcbl, pointer nulldata, pointer ca
 			
 		    }
 		    RecordAProtocolElement(pContext, pClient,
-			XRecordFromServer, pEvToRecord, SIZEOF(xEvent), 0);
+			XRecordFromServer, pEvToRecord, SIZEOF(xEvent), 0, 0);
 		}
 	    } /* end for each event */
 	} /* end this client is on this context */
@@ -776,7 +783,7 @@ RecordSendProtocolEvents(RecordClientsAndProtocolPtr pRCAP,
 	    }
 
 	    RecordAProtocolElement(pContext, NULL,
-		    XRecordFromServer,  pEvToRecord, SIZEOF(xEvent), 0);
+		    XRecordFromServer,  pEvToRecord, SIZEOF(xEvent), 0, 0);
 	    /* make sure device events get flushed in the absence
 	     * of other client activity
 	     */
@@ -2420,7 +2427,7 @@ ProcRecordEnableContext(ClientPtr client)
     assert(numEnabledContexts > 0);
 
     /* send StartOfData */
-    RecordAProtocolElement(pContext, NULL, XRecordStartOfData, NULL, 0, 0);
+    RecordAProtocolElement(pContext, NULL, XRecordStartOfData, NULL, 0, 0, 0);
     RecordFlushReplyBuffer(pContext, NULL, 0, NULL, 0);
     return Success;
 } /* ProcRecordEnableContext */
@@ -2451,7 +2458,7 @@ RecordDisableContext(RecordContextPtr pContext)
     if (!pContext->pRecordingClient) return;
     if (!pContext->pRecordingClient->clientGone)
     {
-	RecordAProtocolElement(pContext, NULL, XRecordEndOfData, NULL, 0, 0);
+	RecordAProtocolElement(pContext, NULL, XRecordEndOfData, NULL, 0, 0, 0);
 	RecordFlushReplyBuffer(pContext, NULL, 0, NULL, 0);
 	/* Re-enable request processing on this connection. */
 	AttendClient(pContext->pRecordingClient);
@@ -2775,7 +2782,7 @@ RecordConnectionSetupInfo(RecordContextPtr pContext, NewClientInfoRec *pci)
 	SwapConnSetupPrefix(pci->prefix, (xConnSetupPrefix*)pConnSetup);
 	SwapConnSetupInfo((char*)pci->setup, (char*)(pConnSetup + prefixsize));
 	RecordAProtocolElement(pContext, pci->client, XRecordClientStarted,
-			       (pointer)pConnSetup, prefixsize + restsize, 0);
+			       (pointer)pConnSetup, prefixsize + restsize, 0, 0);
 	free(pConnSetup);
     }
     else
@@ -2784,9 +2791,9 @@ RecordConnectionSetupInfo(RecordContextPtr pContext, NewClientInfoRec *pci)
 	 * data in two pieces
 	 */
 	RecordAProtocolElement(pContext, pci->client, XRecordClientStarted,
-			(pointer)pci->prefix, prefixsize, restsize);
+			(pointer)pci->prefix, prefixsize, 0, restsize);
 	RecordAProtocolElement(pContext, pci->client, XRecordClientStarted,
-			(pointer)pci->setup, restsize, /* continuation */ -1);
+			(pointer)pci->setup, restsize, 0, /* continuation */ -1);
     }
 } /* RecordConnectionSetupInfo */
 
@@ -2863,7 +2870,7 @@ RecordAClientStateChange(CallbackListPtr *pcbl, pointer nulldata, pointer callda
 	    {
 		if (pContext->pRecordingClient && pRCAP->clientDied)
 		    RecordAProtocolElement(pContext, pClient,
-					   XRecordClientDied, NULL, 0, 0);
+					   XRecordClientDied, NULL, 0, 0, 0);
 		RecordDeleteClientFromRCAP(pRCAP, pos);
 	    }
 	}
commit 4dc5b6ea9f4932070c37b7c5393d468d00803712
Author: Jeremy Huddleston <jeremyhu at apple.com>
Date:   Tue Nov 1 14:59:15 2011 -0700

    xfree86: Fix powerpc build with -Werror=int-to-pointer-cast -Werror=pointer-to-int-cast
    
    memType is a uint64_t on powerpc. Using memType only really makes
    sense for *physical* addresses, which can be 64-bit for 32-bit
    systems running on 64-bit hardware.
    
    However, unmapVidMem() only deals with *virtual* addresses, which
    are guaranteed to fit into an uintptr_t.
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>
    Reviewed-by: Mark Kettenis <kettenis at openbsd.org>
    (cherry picked from commit eb3377ffb8a7baa26c9831e56ed782d48b28fa71)

diff --git a/hw/xfree86/os-support/linux/lnx_video.c b/hw/xfree86/os-support/linux/lnx_video.c
index 3d45511..468c621 100644
--- a/hw/xfree86/os-support/linux/lnx_video.c
+++ b/hw/xfree86/os-support/linux/lnx_video.c
@@ -469,11 +469,11 @@ mapVidMem(int ScreenNum, unsigned long Base, unsigned long Size, int flags)
 static void
 unmapVidMem(int ScreenNum, pointer Base, unsigned long Size)
 {
-    memType alignOff = (memType)Base 
-	- ((memType)Base & ~(getpagesize() - 1));
+    uintptr_t alignOff = (uintptr_t)Base
+	- ((uintptr_t)Base & ~(getpagesize() - 1));
 
-    DebugF("alignment offset: %lx\n",alignOff);
-    munmap((caddr_t)((memType)Base - alignOff), (Size + alignOff));
+    DebugF("alignment offset: %lx\n", (unsigned long)alignOff);
+    munmap((void *)((uintptr_t)Base - alignOff), (Size + alignOff));
 }
 
 
commit a1925f08790083a5c00f9f4ba766cbb8749240f3
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Fri Apr 15 13:32:10 2011 +1000

    include: export GetProximityEvents and QueueProximityEvents
    
    This is mainly needed for consistency with GetPointerEvents and friend.
    No-one seems to actually need this function from outside the usual DDXs.
    
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    Reviewed-by: Jeremy Huddleston <jeremyhu at apple.com>
    (cherry picked from commit fc16917ad6f0d2722bfb5c5eeca955dd3bc4125a)

diff --git a/include/input.h b/include/input.h
index 5377a0c..0d995f5 100644
--- a/include/input.h
+++ b/include/input.h
@@ -464,13 +464,13 @@ extern _X_EXPORT void QueueKeyboardEvents(
     int key_code,
     const ValuatorMask *mask);
 
-extern int GetProximityEvents(
+extern _X_EXPORT int GetProximityEvents(
     InternalEvent *events,
     DeviceIntPtr pDev,
     int type,
     const ValuatorMask *mask);
 
-extern void QueueProximityEvents(
+extern _X_EXPORT void QueueProximityEvents(
     DeviceIntPtr pDev,
     int type,
     const ValuatorMask *mask);
commit a6a21f84bbdd4e3c6218f7b4c04a2d947a784f9f
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Thu Nov 3 08:58:58 2011 +1000

    dix: Don't let a driver without a ProximityClassRec post events
    
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    Reviewed-by: Jeremy Huddleston <jeremyhu at apple.com>
    (cherry picked from commit 11840595a1be9f2df7390bcc708cc176e60d3ef2)

diff --git a/dix/getevents.c b/dix/getevents.c
index a12462a..058fa8a 100644
--- a/dix/getevents.c
+++ b/dix/getevents.c
@@ -1309,7 +1309,7 @@ GetProximityEvents(InternalEvent *events, DeviceIntPtr pDev, int type, const Val
     /* Sanity checks. */
     if ((type != ProximityIn && type != ProximityOut) || !mask_in)
         return 0;
-    if (!pDev->valuator)
+    if (!pDev->valuator || !pDev->proximity)
         return 0;
 
     valuator_mask_copy(&mask, mask_in);
commit 2f2d871ccdfb256831ae487c5916054a3d29d126
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Thu Oct 27 11:03:39 2011 +1000

    Xi: allow passive keygrabs on the XIAll(Master)Devices fake devices
    
    They don't have a KeyClassRec, but we must still allow passive grabs on
    them.
    
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    Tested-by: Bastien Nocera <hadess at hadess.net>
    Reviewed-by: Daniel Stone <daniel at fooishbar.org>
    (cherry picked from commit 22715e465b415b3351b83b8279a4f44157f63199)

diff --git a/Xi/exevents.c b/Xi/exevents.c
index 3e3c67b..dcb496f 100644
--- a/Xi/exevents.c
+++ b/Xi/exevents.c
@@ -1441,7 +1441,7 @@ GrabKey(ClientPtr client, DeviceIntPtr dev, DeviceIntPtr modifier_device,
     rc = CheckGrabValues(client, param);
     if (rc != Success)
         return rc;
-    if (k == NULL)
+    if ((dev->id != XIAllDevices && dev->id != XIAllMasterDevices) && k == NULL)
 	return BadMatch;
     if (grabtype == GRABTYPE_XI)
     {
commit 34bb83b9df20ff63dbb147ed661f39efb8bae8e4
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Mon Oct 24 12:00:32 2011 +1000

    dix: block signals when closing all devices
    
    When closing down all devices, we manually unset master for all attached
    devices, but the device's sprite info still points to the master's sprite
    info. This leaves us a window where the master is freed already but the
    device isn't yet. A signal during that window causes dereference of the
    already freed spriteInfo in mieqEnqueue's EnqueueScreen macro.
    
    Simply block signals when removing all devices. It's not like we're really
    worrying about high-responsive input at this stage.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=737031
    
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    Reviewed-by: Julien Cristau <jcristau at debian.org>
    (cherry picked from commit d7c44a7c9760449bef263413ad3b20f19b1dc95a)

diff --git a/dix/devices.c b/dix/devices.c
index 0ccf252..cbdd4ea 100644
--- a/dix/devices.c
+++ b/dix/devices.c
@@ -982,6 +982,8 @@ CloseDownDevices(void)
 {
     DeviceIntPtr dev;
 
+    OsBlockSignals();
+
     /* Float all SDs before closing them. Note that at this point resources
      * (e.g. cursors) have been freed already, so we can't just call
      * AttachDevice(NULL, dev, NULL). Instead, we have to forcibly set master
@@ -1004,6 +1006,8 @@ CloseDownDevices(void)
     inputInfo.keyboard = NULL;
     inputInfo.pointer = NULL;
     XkbDeleteRulesDflts();
+
+    OsReleaseSignals();
 }
 
 /**
commit 97f2ae60fc0cc755abd8b88df826fcb1a20464fe
Author: Christopher Yeleighton <giecrilj at stegny.2a.pl>
Date:   Mon Oct 24 18:47:06 2011 -0700

    Bug 38420: Xvfb crashes in miInitVisuals() when started with depth=2
    
    https://bugs.freedesktop.org/show_bug.cgi?id=38420
    
    Exit with fatal error message, not segfault.
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Jeremy Huddleston <jeremyhu at apple.com>
    Signed-off-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit 7d50211ab57a35910d79fc3f67ae89aff91fa995)

diff --git a/hw/vfb/InitOutput.c b/hw/vfb/InitOutput.c
index 31ed505..dce3f84 100644
--- a/hw/vfb/InitOutput.c
+++ b/hw/vfb/InitOutput.c
@@ -864,6 +864,8 @@ vfbScreenInit(int index, ScreenPtr pScreen, int argc, char **argv)
 				   (1 << DirectColor)),
 				  10, TrueColor, 0x3ff00000, 0x000ffc00, 0x000003ff);
 	break;
+    default:
+	return FALSE;
     }
 
     miSetPixmapDepths ();
commit 89626304ea1ad316c5b7145a40f09377148cff21
Author: Dave Airlie <airlied at redhat.com>
Date:   Thu Oct 20 14:43:01 2011 +0100

    xf86Crtc: handle no outputs with no modes harder.
    
    If you started an X server with no connected outputs, we pick a default
    1024x768 mode, however if you then ran an xvidmode using app against that
    server it would segfault the server due to not finding any valid modes.
    
    This was due to the no output mode set code, only adding the modes to the
    scrn->modes once, when something called randr 1.2 xf86SetScrnInfoModes would
    get called and remove all the modes and we'd end up with 0.
    
    This change fixes xf86SetScrnInfoModes to always report a scrn mode of at
    least 1024x768, and pushes the initial configuration to just call it instead
    of setting up the mode itself.
    
    Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=746926
    
    I've seen other bugs like this on other distros so it might also actually fix them.
    
    Signed-off-by: Dave Airlie <airlied at redhat.com>
    Reviewed-by: Keith Packard <keithp at keithp.com>
    Signed-off-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit 17416e88dcfcc584fe5f87580d5d2b719b3521c3)

diff --git a/hw/xfree86/modes/xf86Crtc.c b/hw/xfree86/modes/xf86Crtc.c
index d75cd77..8906806 100644
--- a/hw/xfree86/modes/xf86Crtc.c
+++ b/hw/xfree86/modes/xf86Crtc.c
@@ -1915,19 +1915,25 @@ xf86SetScrnInfoModes (ScrnInfoPtr scrn)
 		break;
     }
 
-    if (scrn->modes != NULL) {
-	/* For some reason, scrn->modes is circular, unlike the other mode
-	 * lists.  How great is that?
-	 */
-	for (last = scrn->modes; last && last->next; last = last->next)
-	    ;
-	last->next = scrn->modes;
-	scrn->modes->prev = last;
-	if (mode) {
-	    while (scrn->modes != mode)
-		scrn->modes = scrn->modes->next;
-	}
+    if (!scrn->modes) {
+	scrn->modes = xf86ModesAdd(scrn->modes,
+				   xf86CVTMode(scrn->display->virtualX,
+					       scrn->display->virtualY,
+					       60, 0, 0));
+    }
+
+    /* For some reason, scrn->modes is circular, unlike the other mode
+     * lists.  How great is that?
+     */
+    for (last = scrn->modes; last && last->next; last = last->next)
+	;
+    last->next = scrn->modes;
+    scrn->modes->prev = last;
+    if (mode) {
+	while (scrn->modes != mode)
+	    scrn->modes = scrn->modes->next;
     }
+
     scrn->currentMode = scrn->modes;
 #ifdef XFreeXDGA
     if (scrn->pScreen)
@@ -2529,16 +2535,7 @@ xf86InitialConfiguration (ScrnInfoPtr scrn, Bool canGrow)
 			      width, height);
     }
 
-    if (have_outputs) {
-	/* Mirror output modes to scrn mode list */
-	xf86SetScrnInfoModes (scrn);
-    } else {
-	/* Clear any existing modes from scrn->modes */
-	while (scrn->modes != NULL)
-	    xf86DeleteMode(&scrn->modes, scrn->modes);
-	scrn->modes = xf86ModesAdd(scrn->modes,
-				   xf86CVTMode(width, height, 60, 0, 0));
-    }
+    xf86SetScrnInfoModes (scrn);
 
     success = TRUE;
  bailout:
commit c68a84e73d1ebb2f75cdc4c3d8576a15b31ab3f7
Author: Jeremy Huddleston <jeremyhu at apple.com>
Date:   Fri Nov 4 10:24:08 2011 -0700

    configure.ac: Bump to 1.11.2
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>

diff --git a/configure.ac b/configure.ac
index 5b6e39c..f0a14c4 100644
--- a/configure.ac
+++ b/configure.ac
@@ -26,8 +26,8 @@ dnl
 dnl Process this file with autoconf to create configure.
 
 AC_PREREQ(2.57)
-AC_INIT([xorg-server], 1.11.1.902, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
-RELEASE_DATE="2011-10-28"
+AC_INIT([xorg-server], 1.11.2, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
+RELEASE_DATE="2011-11-04"
 AC_CONFIG_SRCDIR([Makefile.am])
 AM_INIT_AUTOMAKE([foreign dist-bzip2])
 AM_MAINTAINER_MODE
commit 2d6760f591a4138b2f4a32220e6a5aa855c123ca
Author: Jeremy Huddleston <jeremyhu at apple.com>
Date:   Thu Nov 3 15:01:35 2011 -0700

    Revert "dix: don't XWarpPointer through the last slave anymore (#38313)"
    
    This reverts commit bbe6a69da398dba93679c23c3c50f9916cb562ca.
    
    This commit caused a regression.
    
    See: http://xquartz.macosforge.org/trac/ticket/517#comment:10

diff --git a/dix/events.c b/dix/events.c
index 8068fc7..8e7f9c3 100644
--- a/dix/events.c
+++ b/dix/events.c
@@ -3351,21 +3351,16 @@ XineramaWarpPointer(ClientPtr client)
 {
     WindowPtr	dest = NULL;
     int		x, y, rc;
-    DeviceIntPtr dev;
-    SpritePtr   pSprite;
+    SpritePtr   pSprite = PickPointer(client)->spriteInfo->sprite;
 
     REQUEST(xWarpPointerReq);
 
+
     if (stuff->dstWid != None) {
 	rc = dixLookupWindow(&dest, stuff->dstWid, client, DixReadAccess);
 	if (rc != Success)
 	    return rc;
     }
-
-    /* Post through the XTest device */
-    dev = PickPointer(client);
-    dev = GetXTestDevice(dev);
-    pSprite = dev->spriteInfo->sprite;
     x = pSprite->hotPhys.x;
     y = pSprite->hotPhys.y;
 
@@ -3415,9 +3410,9 @@ XineramaWarpPointer(ClientPtr client)
     else if (y >= pSprite->physLimits.y2)
 	y = pSprite->physLimits.y2 - 1;
     if (pSprite->hotShape)
-	ConfineToShape(dev, pSprite->hotShape, &x, &y);
+	ConfineToShape(PickPointer(client), pSprite->hotShape, &x, &y);
 
-    XineramaSetCursorPosition(dev, x, y, TRUE);
+    XineramaSetCursorPosition(PickPointer(client), x, y, TRUE);
 
     return Success;
 }
@@ -3435,7 +3430,7 @@ ProcWarpPointer(ClientPtr client)
     WindowPtr	dest = NULL;
     int		x, y, rc;
     ScreenPtr	newScreen;
-    DeviceIntPtr dev, tmp, xtest_dev = NULL;
+    DeviceIntPtr dev, tmp;
     SpritePtr   pSprite;
 
     REQUEST(xWarpPointerReq);
@@ -3448,13 +3443,11 @@ ProcWarpPointer(ClientPtr client)
 	    rc = XaceHook(XACE_DEVICE_ACCESS, client, dev, DixWriteAccess);
 	    if (rc != Success)
 		return rc;
-            if (IsXTestDevice(tmp, dev))
-                xtest_dev = tmp;
 	}
     }
 
-    /* Use the XTest device to actually move the pointer */
-    dev = xtest_dev;
+    if (dev->lastSlave)
+        dev = dev->lastSlave;
     pSprite = dev->spriteInfo->sprite;
 
 #ifdef PANORAMIX
commit 0bffe6b38cdf6b21d9ec9b0abf0092d4d4eaef86
Author: Jeremy Huddleston <jeremyhu at apple.com>
Date:   Fri Oct 28 18:32:28 2011 -0700

    configure.ac: Bump to 1.11.1.902 (1.11.2 RC2)
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>

diff --git a/configure.ac b/configure.ac
index cc4292b..5b6e39c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -26,8 +26,8 @@ dnl
 dnl Process this file with autoconf to create configure.
 
 AC_PREREQ(2.57)
-AC_INIT([xorg-server], 1.11.1.901, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
-RELEASE_DATE="2011-10-14"
+AC_INIT([xorg-server], 1.11.1.902, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
+RELEASE_DATE="2011-10-28"
 AC_CONFIG_SRCDIR([Makefile.am])
 AM_INIT_AUTOMAKE([foreign dist-bzip2])
 AM_MAINTAINER_MODE
commit a1d638da0d12c82c944bfecb996903210879f426
Author: Jeremy Huddleston <jeremyhu at apple.com>
Date:   Tue Oct 25 23:53:43 2011 -0700

    XWin: windowswm: Correct byte swapping in event notifications
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>
    Reviewed-by: Jon TURNEY <jon.turney at dronecode.org.uk>
    (cherry picked from commit 286fa9bf9b4ffb0f9dbd3f1cae46ddcb27ee9318)

diff --git a/hw/xwin/winwindowswm.c b/hw/xwin/winwindowswm.c
index 7138409..f5d27e5 100644
--- a/hw/xwin/winwindowswm.c
+++ b/hw/xwin/winwindowswm.c
@@ -629,9 +629,11 @@ winWindowsWMExtensionInit (void)
 			       NULL,
 			       StandardMinorOpcode)))
     {
+      size_t i;
       WMReqCode = (unsigned char)extEntry->base;
       WMErrorBase = extEntry->errorBase;
       WMEventBase = extEntry->eventBase;
-      EventSwapVector[WMEventBase] = (EventSwapPtr) SNotifyEvent;
+      for (i=0; i < WindowsWMNumberEvents; i++)
+        EventSwapVector[WMEventBase + i] = (EventSwapPtr) SNotifyEvent;
     }
 }
commit 0715469f1cb150261b51867df75892d26916ea05
Author: Jeremy Huddleston <jeremyhu at apple.com>
Date:   Tue Oct 25 23:49:33 2011 -0700

    XQuartz: appledri: Correct byte swapping in event notifications
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>
    (cherry picked from commit dc054fefc586c5b404fe0f949dbd456e5267c647)

diff --git a/hw/xquartz/xpr/appledri.c b/hw/xquartz/xpr/appledri.c
index 129fc78..80955fe 100644
--- a/hw/xquartz/xpr/appledri.c
+++ b/hw/xquartz/xpr/appledri.c
@@ -541,9 +541,11 @@ AppleDRIExtensionInit(void)
                                  SProcAppleDRIDispatch,
                                  AppleDRIResetProc,
                                  StandardMinorOpcode))) {
+        size_t i;
         DRIReqCode = (unsigned char)extEntry->base;
         DRIErrorBase = extEntry->errorBase;
         DRIEventBase = extEntry->eventBase;
-        EventSwapVector[DRIEventBase] = (EventSwapPtr) SNotifyEvent;
+        for (i=0; i < AppleDRINumberEvents; i++)
+            EventSwapVector[DRIEventBase + i] = (EventSwapPtr) SNotifyEvent;
     }
 }
commit bc2600466eea2af2d6a81fe1592d908565995cb2
Author: Jeremy Huddleston <jeremyhu at apple.com>
Date:   Tue Oct 25 23:48:16 2011 -0700

    XQuartz: applewm: Correct byte swapping in event notifications
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>
    (cherry picked from commit d5fee2b638fabeb8bec31a24e57d5c2a232d0893)

diff --git a/hw/xquartz/applewm.c b/hw/xquartz/applewm.c
index 2f26e61..2dfc35a 100644
--- a/hw/xquartz/applewm.c
+++ b/hw/xquartz/applewm.c
@@ -727,10 +727,12 @@ AppleWMExtensionInit(
                                  NULL,
                                  StandardMinorOpcode)))
     {
+        size_t i;
         WMReqCode = (unsigned char)extEntry->base;
         WMErrorBase = extEntry->errorBase;
         WMEventBase = extEntry->eventBase;
-        EventSwapVector[WMEventBase] = (EventSwapPtr) SNotifyEvent;
+        for (i=0; i < AppleWMNumberEvents; i++)
+            EventSwapVector[WMEventBase + i] = (EventSwapPtr) SNotifyEvent;
         appleWMProcs = procsPtr;
     }
 }
commit 7be5492bcfab540676d6f849b85ad3db64a5ada0
Author: Jeremy Huddleston <jeremyhu at apple.com>
Date:   Fri Oct 21 10:27:16 2011 -0700

    XQuartz: appledri: Allow byte swapped requests
    
    Even though it's only valid when local, it is possible for a local
    client and the server to not match endianness, such as when running
    a ppc application under Rosetta.
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>
    (cherry picked from commit 1c8bda798b4480bab0f0da6f531e4770c7a1f771)

diff --git a/hw/xquartz/xpr/appledri.c b/hw/xquartz/xpr/appledri.c
index 1d37de2..129fc78 100644
--- a/hw/xquartz/xpr/appledri.c
+++ b/hw/xquartz/xpr/appledri.c
@@ -2,7 +2,7 @@
 
 Copyright 1998-1999 Precision Insight, Inc., Cedar Park, Texas.
 Copyright 2000 VA Linux Systems, Inc.
-Copyright (c) 2002, 2009 Apple Computer, Inc.
+Copyright (c) 2002, 2009-2011 Apple Inc.
 All Rights Reserved.
 
 Permission is hereby granted, free of charge, to any person obtaining a
@@ -416,21 +416,113 @@ SProcAppleDRIQueryVersion(
 }
 
 static int
+SProcAppleDRIQueryDirectRenderingCapable(
+    register ClientPtr client
+)
+{
+    register int n;
+    REQUEST(xAppleDRIQueryDirectRenderingCapableReq);
+    swaps(&stuff->length, n);
+    swapl(&stuff->screen, n);
+    return ProcAppleDRIQueryDirectRenderingCapable(client);
+}
+
+static int
+SProcAppleDRIAuthConnection(
+    register ClientPtr client
+)
+{
+    register int n;
+    REQUEST(xAppleDRIAuthConnectionReq);
+    swaps(&stuff->length, n);
+    swapl(&stuff->screen, n);
+    swapl(&stuff->magic, n);
+    return ProcAppleDRIAuthConnection(client);
+}
+
+static int
+SProcAppleDRICreateSurface(
+    register ClientPtr client
+)
+{
+    register int n;
+    REQUEST(xAppleDRICreateSurfaceReq);
+    swaps(&stuff->length, n);
+    swapl(&stuff->screen, n);
+    swapl(&stuff->drawable, n);
+    swapl(&stuff->client_id, n);
+    return ProcAppleDRICreateSurface(client);
+}
+
+static int
+SProcAppleDRIDestroySurface(
+    register ClientPtr client
+)
+{
+    register int n;
+    REQUEST(xAppleDRIDestroySurfaceReq);
+    swaps(&stuff->length, n);
+    swapl(&stuff->screen, n);
+    swapl(&stuff->drawable, n);
+    return ProcAppleDRIDestroySurface(client);
+}
+
+static int
+SProcAppleDRICreatePixmap(
+    register ClientPtr client
+)
+{
+    register int n;
+    REQUEST(xAppleDRICreatePixmapReq);
+    swaps(&stuff->length, n);
+    swapl(&stuff->screen, n);
+    swapl(&stuff->drawable, n);
+    return ProcAppleDRICreatePixmap(client);
+}
+
+static int
+SProcAppleDRIDestroyPixmap(
+    register ClientPtr client
+)
+{
+    register int n;
+    REQUEST(xAppleDRIDestroyPixmapReq);
+    swaps(&stuff->length, n);
+    swapl(&stuff->drawable, n);
+    return ProcAppleDRIDestroyPixmap(client);
+}
+
+static int
 SProcAppleDRIDispatch (
     register ClientPtr client
 )
 {
     REQUEST(xReq);
 
-    /* It is bound to be non-local when there is byte swapping */
+    switch (stuff->data)
+    {
+    case X_AppleDRIQueryVersion:
+        return SProcAppleDRIQueryVersion(client);
+    case X_AppleDRIQueryDirectRenderingCapable:
+        return SProcAppleDRIQueryDirectRenderingCapable(client);
+    }
+
     if (!LocalClient(client))
         return DRIErrorBase + AppleDRIClientNotLocal;
 
-    /* only local clients are allowed DRI access */
     switch (stuff->data)
     {
-    case X_AppleDRIQueryVersion:
-        return SProcAppleDRIQueryVersion(client);
+    case X_AppleDRIAuthConnection:
+        return SProcAppleDRIAuthConnection(client);
+    case X_AppleDRICreateSurface:
+        return SProcAppleDRICreateSurface(client);
+    case X_AppleDRIDestroySurface:
+        return SProcAppleDRIDestroySurface(client);
+    case X_AppleDRICreatePixmap:
+	return SProcAppleDRICreatePixmap(client);
+    case X_AppleDRIDestroyPixmap:
+	return SProcAppleDRIDestroyPixmap(client);
+
     default:
         return BadRequest;
     }
commit 0ad049706d2fa8ff2758c42bdd412fb62bb1e86a
Author: Jeremy Huddleston <jeremyhu at apple.com>
Date:   Thu Oct 20 22:34:44 2011 -0700

    XQuartz: appledri: Fix byte swapping in replies
    
    Even though it's only valid when local, it is possible for a local
    client and the server to not match endianness, such as when running
    a ppc application under Rosetta.
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>
    Reviewed-by: Jamey Sharp <jamey at minilop.net>
    (cherry picked from commit 14205ade0c750191bf43fba8bd55c65dba912cf4)
    
    Conflicts:
    
    	hw/xquartz/xpr/appledri.c
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>

diff --git a/hw/xquartz/xpr/appledri.c b/hw/xquartz/xpr/appledri.c
index e1b4134..1d37de2 100644
--- a/hw/xquartz/xpr/appledri.c
+++ b/hw/xquartz/xpr/appledri.c
@@ -91,7 +91,6 @@ ProcAppleDRIQueryVersion(
 )
 {
     xAppleDRIQueryVersionReply rep;
-    register int n;
 
     REQUEST_SIZE_MATCH(xAppleDRIQueryVersionReq);
     rep.type = X_Reply;
@@ -101,8 +100,12 @@ ProcAppleDRIQueryVersion(
     rep.minorVersion = SERVER_APPLEDRI_MINOR_VERSION;
     rep.patchVersion = SERVER_APPLEDRI_PATCH_VERSION;
     if (client->swapped) {
+        register int n;
         swaps(&rep.sequenceNumber, n);
         swapl(&rep.length, n);
+        swaps(&rep.majorVersion, n);
+        swaps(&rep.minorVersion, n);
+        swapl(&rep.patchVersion, n);
     }
     WriteToClient(client, sizeof(xAppleDRIQueryVersionReply), (char *)&rep);
     return Success;
@@ -134,6 +137,12 @@ ProcAppleDRIQueryDirectRenderingCapable(
     if (!LocalClient(client))
         rep.isCapable = 0;
 
+    if (client->swapped) {
+        register int n;
+        swaps(&rep.sequenceNumber, n);
+        swapl(&rep.length, n);
+    }
+
     WriteToClient(client, 
         sizeof(xAppleDRIQueryDirectRenderingCapableReply), (char *)&rep);
     return Success;
@@ -158,6 +167,14 @@ ProcAppleDRIAuthConnection(
         ErrorF("Failed to authenticate %u\n", (unsigned int)stuff->magic);
         rep.authenticated = 0;
     }
+
+    if (client->swapped) {
+        register int n;
+        swaps(&rep.sequenceNumber, n);
+        swapl(&rep.length, n);
+        swapl(&rep.authenticated, n); /* Yes, this is a CARD32 ... sigh */
+    }
+
     WriteToClient(client, sizeof(xAppleDRIAuthConnectionReply), (char *)&rep);
     return Success;
 }
@@ -217,6 +234,15 @@ ProcAppleDRICreateSurface(
     rep.key_1 = key[1];
     rep.uid = sid;
 
+    if (client->swapped) {
+        register int n;
+        swaps(&rep.sequenceNumber, n);
+        swapl(&rep.length, n);
+        swapl(&rep.key_0, n);
+        swapl(&rep.key_1, n);
+        swapl(&rep.uid, n);
+    }
+
     WriteToClient(client, sizeof(xAppleDRICreateSurfaceReply), (char *)&rep);
     return Success;
 }
@@ -278,7 +304,6 @@ ProcAppleDRICreatePixmap(ClientPtr client)
 	
     rep.stringLength = strlen(path) + 1;
 		
-    /* No need for swapping, because this only runs if LocalClient is true. */
     rep.type = X_Reply;
     rep.length = bytes_to_int32(rep.stringLength);
     rep.sequenceNumber = client->sequence;
@@ -291,8 +316,20 @@ ProcAppleDRICreatePixmap(ClientPtr client)
     if(sizeof(rep) != sz_xAppleDRICreatePixmapReply)
 	ErrorF("error sizeof(rep) is %zu\n", sizeof(rep)); 
     
-    WriteReplyToClient(client, sizeof(rep), &rep);
-    (void)WriteToClient(client, rep.stringLength, path);
+    if (client->swapped) {
+        register int n;
+        swaps(&rep.sequenceNumber, n);
+        swapl(&rep.length, n);
+        swapl(&rep.stringLength, n);
+        swapl(&rep.width, n);
+        swapl(&rep.height, n);
+        swapl(&rep.pitch, n);
+        swapl(&rep.bpp, n);
+        swapl(&rep.size, n);
+    }
+
+    WriteToClient(client, sizeof(rep), &rep);
+    WriteToClient(client, rep.stringLength, path);
 
     return Success;
 }
commit 3b931c92764fc4e6417f1f38a67114b8c7442fc2
Author: Jeremy Huddleston <jeremyhu at apple.com>
Date:   Thu Oct 20 22:23:07 2011 -0700

    XQuartz: appledri: Set the correct reply length for XAppleDRICreatePixmap
    
    http://xquartz.macosforge.org/trac/ticket/508
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>
    Reviewed-by: Jamey Sharp <jamey at minilop.net>
    (cherry picked from commit 2ba0ac202ad64eb4a555715980ba538de19c9fd7)

diff --git a/hw/xquartz/xpr/appledri.c b/hw/xquartz/xpr/appledri.c
index ff70a38..e1b4134 100644
--- a/hw/xquartz/xpr/appledri.c
+++ b/hw/xquartz/xpr/appledri.c
@@ -280,7 +280,7 @@ ProcAppleDRICreatePixmap(ClientPtr client)
 		
     /* No need for swapping, because this only runs if LocalClient is true. */
     rep.type = X_Reply;
-    rep.length = sizeof(rep) + rep.stringLength;
+    rep.length = bytes_to_int32(rep.stringLength);
     rep.sequenceNumber = client->sequence;
     rep.width = width;
     rep.height = height;
commit f22a41416b9795c778deeae6406cd33d18f13fa3
Author: Jeremy Huddleston <jeremyhu at apple.com>
Date:   Sun Oct 16 02:12:38 2011 -0700

    Xnest: Match the host's keymap
    
    This was a regression.
    
    Introduced by: 08363c5830bdea34012dcd954b45ccfdc79a3a7e and
                   32db27a7f867b503c2840ca7b815e96d10be9210
    Masked by: 1e69fd4a60147287b31e53bfc61543fb17bb82c8
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>
    Reviewed-by: Jamey Sharp <jamey at minilop.net>
    (cherry picked from commit 83fef4235db86343477b4ec9858c6ba35e1aa7d9)

diff --git a/hw/xnest/Keyboard.c b/hw/xnest/Keyboard.c
index ec629dc..5ef376b 100644
--- a/hw/xnest/Keyboard.c
+++ b/hw/xnest/Keyboard.c
@@ -114,11 +114,13 @@ xnestChangeKeyboardControl(DeviceIntPtr pDev, KeybdCtrl *ctrl)
 int
 xnestKeyboardProc(DeviceIntPtr pDev, int onoff)
 {
+  XModifierKeymap *modifier_keymap;
   KeySym *keymap;
   int mapWidth;
   int min_keycode, max_keycode;
   KeySymsRec keySyms;
-  int i;
+  CARD8 modmap[MAP_LENGTH];
+  int i, j;
   XKeyboardState values;
   XkbDescPtr xkb;
   int op, event, error, major, minor;
@@ -130,7 +132,7 @@ xnestKeyboardProc(DeviceIntPtr pDev, int onoff)
 #ifdef _XSERVER64
       {
 	KeySym64 *keymap64;
-	int i, len;
+	int len;
 	keymap64 = XGetKeyboardMapping(xnestDisplay,
 				     min_keycode,
 				     max_keycode - min_keycode + 1,
@@ -147,7 +149,17 @@ xnestKeyboardProc(DeviceIntPtr pDev, int onoff)
 				   max_keycode - min_keycode + 1,
 				   &mapWidth);
 #endif
-      
+
+      memset(modmap, 0, sizeof(modmap));
+      modifier_keymap = XGetModifierMapping(xnestDisplay);
+      for (j = 0; j < 8; j++)
+            for(i = 0; i < modifier_keymap->max_keypermod; i++) {
+                  CARD8 keycode;
+                  if ((keycode = modifier_keymap->modifiermap[j * modifier_keymap->max_keypermod + i]))
+                      modmap[keycode] |= 1<<j;
+      }
+      XFreeModifiermap(modifier_keymap);
+
       keySyms.minKeyCode = min_keycode;
       keySyms.maxKeyCode = max_keycode;
       keySyms.mapWidth = mapWidth;
@@ -165,7 +177,12 @@ xnestKeyboardProc(DeviceIntPtr pDev, int onoff)
       XkbGetControls(xnestDisplay, XkbAllControlsMask, xkb);
 
       InitKeyboardDeviceStruct(pDev, NULL,
-			       xnestBell, xnestChangeKeyboardControl);
+                               xnestBell, xnestChangeKeyboardControl);
+
+      XkbApplyMappingChange(pDev, &keySyms, keySyms.minKeyCode,
+                            keySyms.maxKeyCode - keySyms.minKeyCode + 1,
+                            modmap, serverClient);
+
       XkbDDXChangeControls(pDev, xkb->ctrls, xkb->ctrls);
       XkbFreeKeyboard(xkb, 0, False);
       free(keymap);
commit 82445286d56fdac36f21ec5eed436646bda768dd
Author: Tomáš Trnka <tomastrnka at gmx.com>
Date:   Tue Oct 11 09:11:18 2011 +0200

    Fix drain_console unregistration
    
    Bug introduced by 9dca441670d261a9a9fb6108960ed48f3d58fb7f
    xfree86: add a hook to replace the new console handler.
    
    console_handler was not being set, making the server eat up CPU spinning
    in WaitForSomething selecting consoleFd over and over again, every time
    trying to unregister drain_console without success due to
    console_handler being NULL.
    
    Let's just fix the unregistration in xf86SetConsoleHandler() and use that.
    
    But wait, there could be a catch: If some driver replaced the handler using
    xf86SetConsoleHandler(), the unregistration in xf86CloseConsole will unregister
    that one. I don't understand Xorg well enough to know whether this poses a
    problem (could mess up driver deinit somehow or something like that). As it is,
    xf86SetConsoleHandler() doesn't offer any way to prevent this (i.e. check which
    handler is currently registered).
    
    I had been using it for two days on my machine that previously hit 100% CPU
    several times a day. That has now gone away without any new problems appearing.
    
    Signed-off-by: Tomas Trnka <tomastrnka at gmx.com>
    Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    (cherry picked from commit 323869f3298cbbfe864af9404a8aed1bf7995d79)

diff --git a/hw/xfree86/common/xf86Events.c b/hw/xfree86/common/xf86Events.c
index c4a4db9..41ffabd 100644
--- a/hw/xfree86/common/xf86Events.c
+++ b/hw/xfree86/common/xf86Events.c
@@ -601,16 +601,15 @@ xf86AddGeneralHandler(int fd, InputHandlerProc proc, pointer data)
 InputHandlerProc
 xf86SetConsoleHandler(InputHandlerProc proc, pointer data)
 {
-    static InputHandlerProc handler = NULL;
-    InputHandlerProc old_handler = handler;
+    static IHPtr handler = NULL;
+    IHPtr old_handler = handler;
 
     if (old_handler)
         xf86RemoveGeneralHandler(old_handler);
 
-    xf86AddGeneralHandler(xf86Info.consoleFd, proc, data);
-    handler = proc;
+    handler = xf86AddGeneralHandler(xf86Info.consoleFd, proc, data);
 
-    return old_handler;
+    return (old_handler) ? old_handler->ihproc : NULL;
 }
 
 static void
diff --git a/hw/xfree86/os-support/linux/lnx_init.c b/hw/xfree86/os-support/linux/lnx_init.c
index 77dfb2f..e098e14 100644
--- a/hw/xfree86/os-support/linux/lnx_init.c
+++ b/hw/xfree86/os-support/linux/lnx_init.c
@@ -47,15 +47,12 @@ static char vtname[11];
 static struct termios tty_attr; /* tty state to restore */
 static int tty_mode; /* kbd mode to restore */
 
-static void *console_handler;
-
 static void
 drain_console(int fd, void *closure)
 {
     errno = 0;
     if (tcflush(fd, TCIOFLUSH) == -1 && errno == EIO) {
-	xf86RemoveGeneralHandler(console_handler);
-	console_handler = NULL;
+        xf86SetConsoleHandler(NULL, NULL);
     }
 }
 
@@ -259,10 +256,11 @@ xf86CloseConsole(void)
         return;
     }
 
-    if (console_handler) {
-	xf86RemoveGeneralHandler(console_handler);
-	console_handler = NULL;
-    };
+    /*
+     * unregister the drain_console handler
+     * - what to do if someone else changed it in the meantime?
+     */
+    xf86SetConsoleHandler(NULL, NULL);
 
     /* Back to text mode ... */
     SYSCALL(ret = ioctl(xf86Info.consoleFd, KDSETMODE, KD_TEXT));
commit c8c5ed998aac2c91dbec1f86af3395e08ddab373
Author: Jesse Barnes <jbarnes at virtuousgeek.org>
Date:   Thu Oct 13 12:01:10 2011 -0700

    crtc: match full preferred modes if possible when choosing an initial config
    
    It's fairly common to have multiple, identical monitors plugged in.  In
    that case, it's preferable to run the monitor's preferred mode on each
    output, rather than just matching the width & height and end up with
    different timings or refresh rates.
    
    Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>
    Reviewed-by: Keith Packard <keithp at keithp.com>
    Signed-off-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit 3e145d3d67b472cb5d74cb8078b614160c4722b7)

diff --git a/hw/xfree86/modes/xf86Crtc.c b/hw/xfree86/modes/xf86Crtc.c
index 3fae039..d75cd77 100644
--- a/hw/xfree86/modes/xf86Crtc.c
+++ b/hw/xfree86/modes/xf86Crtc.c
@@ -2060,13 +2060,28 @@ xf86TargetPreferred(ScrnInfoPtr scrn, xf86CrtcConfigPtr config,
 		if (o == p)
 		    continue;
 
-		for (mode = output->probed_modes; mode; mode = mode->next) {
-		    Rotation r = output->initial_rotation;
-		    if (xf86ModeWidth(mode, r) == pref_width &&
-			    xf86ModeHeight(mode, r) == pref_height) {
+		/*
+		 * First see if the preferred mode matches on the next
+		 * output as well.  This catches the common case of identical
+		 * monitors and makes sure they all have the same timings
+		 * and refresh.  If that fails, we fall back to trying to
+		 * match just width & height.
+		 */
+		mode = xf86OutputHasPreferredMode(output, pref_width,
+						  pref_height);
+		if (mode && xf86ModesEqual(mode, preferred[p])) {
 			preferred[o] = mode;
 			match = TRUE;
-		    }
+		} else {
+			for (mode = output->probed_modes; mode;
+			     mode = mode->next) {
+				Rotation r = output->initial_rotation;
+				if (xf86ModeWidth(mode, r) == pref_width &&
+				    xf86ModeHeight(mode, r) == pref_height) {
+					preferred[o] = mode;
+					match = TRUE;
+				}
+			}
 		}
 
 		all_match &= match;
commit d780c6f6301ed2263b21ac7d327a1b2e8d3e76df
Author: Ville Syrjala <syrjala at sci.fi>
Date:   Sun Oct 9 01:11:04 2011 +0300

    composite: Update borderClip in compAllocPixmap()
    
    Previously the parent constrained borderClip was copied over
    when compRedirectWindow() is called. That is insufficient eg. in
    case the window was already redirected, but not yet realized. So
    copy the borderClip over in compAllocPixmap() instead.
    
    Example:
    Window 1 is below an automatically redirect window 2. Window 2 is
    unmapped and moved outside the extents of window 1. Window 2 is
    then mapped again, and MarkOverlappedWindows() uses the up to
    date borderSize of window 2 to mark windows, which leaves
    window 1 unmarked. Then exposures are calculated using the stale
    borderClip of window 2, which causes the window below window 2,
    to be exposed through an apparent hole in window 1.
    
    Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=22566
    
    Signed-off-by: Ville Syrjala <syrjala at sci.fi>
    Reviewed-by: Keith Packard <keithp at keithp.com>
    Signed-off-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit a5266dcb3a60587e1877f90c18552baf60b597a0)

diff --git a/composite/compalloc.c b/composite/compalloc.c
index f00bf4e..9857a92 100644
--- a/composite/compalloc.c
+++ b/composite/compalloc.c
@@ -196,11 +196,7 @@ compRedirectWindow (ClientPtr pClient, WindowPtr pWin, int update)
 
 	anyMarked = compMarkWindows (pWin, &pLayerWin);
 
-	/* Make sure our borderClip is correct for ValidateTree */
 	RegionNull(&cw->borderClip);
-	RegionCopy(&cw->borderClip, &pWin->borderClip);
-	cw->borderClipX = pWin->drawable.x;
-	cw->borderClipY = pWin->drawable.y;
 	cw->update = CompositeRedirectAutomatic;
 	cw->clients = 0;
 	cw->oldx = COMP_ORIGIN_INVALID;
@@ -658,6 +654,13 @@ compAllocPixmap (WindowPtr pWin)
 	DamageRegister (&pWin->drawable, cw->damage);
 	cw->damageRegistered = TRUE;
     }
+
+    /* Make sure our borderClip is up to date */
+    RegionUninit(&cw->borderClip);
+    RegionCopy(&cw->borderClip, &pWin->borderClip);
+    cw->borderClipX = pWin->drawable.x;
+    cw->borderClipY = pWin->drawable.y;
+
     return TRUE;
 }
 
commit 12f65819ffb04103f170ecd7e281348de618fc4c
Author: Matthieu Herrb <matthieu.herrb at laas.fr>
Date:   Mon Oct 17 22:27:35 2011 +0200

    Fix CVE-2011-4029: File permission change vulnerability.
    
    Use fchmod() to change permissions of the lock file instead
    of chmod(), thus avoid the race that can be exploited to set
    a symbolic link to any file or directory in the system.
    
    Signed-off-by: Matthieu Herrb <matthieu.herrb at laas.fr>
    Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    (cherry picked from commit b67581cf825940fdf52bf2e0af4330e695d724a4)

diff --git a/os/utils.c b/os/utils.c
index 9e0acb6..d9aa65e 100644
--- a/os/utils.c
+++ b/os/utils.c
@@ -295,7 +295,7 @@ LockServer(void)
     FatalError("Could not create lock file in %s\n", tmp);
   (void) sprintf(pid_str, "%10ld\n", (long)getpid());
   (void) write(lfd, pid_str, 11);
-  (void) chmod(tmp, 0444);
+  (void) fchmod(lfd, 0444);
   (void) close(lfd);
 
   /*
commit f80d23357874db19bc124dee70239fb182977883
Author: Matthieu Herrb <matthieu.herrb at laas.fr>
Date:   Mon Oct 17 22:26:12 2011 +0200

    Fix CVE-2011-4028: File disclosure vulnerability.
    
    use O_NOFOLLOW to open the existing lock file, so symbolic links
    aren't followed, thus avoid revealing if it point to an existing
    file.
    
    Signed-off-by: Matthieu Herrb <matthieu.herrb at laas.fr>
    Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    (cherry picked from commit 6ba44b91e37622ef8c146d8f2ac92d708a18ed34)

diff --git a/os/utils.c b/os/utils.c
index 36cb46f..9e0acb6 100644
--- a/os/utils.c
+++ b/os/utils.c
@@ -316,7 +316,7 @@ LockServer(void)
       /*
        * Read the pid from the existing file
        */
-      lfd = open(LockFile, O_RDONLY);
+      lfd = open(LockFile, O_RDONLY|O_NOFOLLOW);
       if (lfd < 0) {
         unlink(tmp);
         FatalError("Can't read lock file %s\n", LockFile);
commit 374be44d13bc8f04a2413b6d5b2006e73d5a8f53
Author: Jeremy Huddleston <jeremyhu at apple.com>
Date:   Fri Oct 14 16:29:54 2011 -0700

    configure.ac: Bump to 1.11.1.901 (1.11.2 RC1)
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>

diff --git a/configure.ac b/configure.ac
index 51d01e4..cc4292b 100644
--- a/configure.ac
+++ b/configure.ac
@@ -26,8 +26,8 @@ dnl
 dnl Process this file with autoconf to create configure.
 
 AC_PREREQ(2.57)
-AC_INIT([xorg-server], 1.11.1, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
-RELEASE_DATE="2011-09-24"
+AC_INIT([xorg-server], 1.11.1.901, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
+RELEASE_DATE="2011-10-14"
 AC_CONFIG_SRCDIR([Makefile.am])
 AM_INIT_AUTOMAKE([foreign dist-bzip2])
 AM_MAINTAINER_MODE
commit bbe6a69da398dba93679c23c3c50f9916cb562ca
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Fri Jul 29 16:33:54 2011 +1000

    dix: don't XWarpPointer through the last slave anymore (#38313)
    
    This line was introduced pre-1.6 to fix Bug 19297. The effect of warping
    through the VCP then was that if a device had custom valuator ranges, the
    warp position would be wrong. The better device for this effect is the the
    XTest device.
    
    This fixes a server crash where the lastSlave is a pointer device without
    valuators (Bug 38313#0).
    
    And while we're at it, make sure the Xinerama code-path does the same.
    
    X.Org Bug 38313 <http://bugs.freedesktop.org/show_bug.cgi?id=38313>
    
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    Reviewed-by: Daniel Stone <daniel at fooishbar.org>
    (cherry picked from commit 2bfb802839688ecf328119c4c6979390fc60348d)

diff --git a/dix/events.c b/dix/events.c
index 8e7f9c3..8068fc7 100644
--- a/dix/events.c
+++ b/dix/events.c
@@ -3351,16 +3351,21 @@ XineramaWarpPointer(ClientPtr client)
 {
     WindowPtr	dest = NULL;
     int		x, y, rc;
-    SpritePtr   pSprite = PickPointer(client)->spriteInfo->sprite;
+    DeviceIntPtr dev;
+    SpritePtr   pSprite;
 
     REQUEST(xWarpPointerReq);
 
-
     if (stuff->dstWid != None) {
 	rc = dixLookupWindow(&dest, stuff->dstWid, client, DixReadAccess);
 	if (rc != Success)
 	    return rc;
     }
+
+    /* Post through the XTest device */
+    dev = PickPointer(client);
+    dev = GetXTestDevice(dev);
+    pSprite = dev->spriteInfo->sprite;
     x = pSprite->hotPhys.x;
     y = pSprite->hotPhys.y;
 
@@ -3410,9 +3415,9 @@ XineramaWarpPointer(ClientPtr client)
     else if (y >= pSprite->physLimits.y2)
 	y = pSprite->physLimits.y2 - 1;
     if (pSprite->hotShape)
-	ConfineToShape(PickPointer(client), pSprite->hotShape, &x, &y);
+	ConfineToShape(dev, pSprite->hotShape, &x, &y);
 
-    XineramaSetCursorPosition(PickPointer(client), x, y, TRUE);
+    XineramaSetCursorPosition(dev, x, y, TRUE);
 
     return Success;
 }
@@ -3430,7 +3435,7 @@ ProcWarpPointer(ClientPtr client)
     WindowPtr	dest = NULL;
     int		x, y, rc;
     ScreenPtr	newScreen;
-    DeviceIntPtr dev, tmp;
+    DeviceIntPtr dev, tmp, xtest_dev = NULL;
     SpritePtr   pSprite;
 
     REQUEST(xWarpPointerReq);
@@ -3443,11 +3448,13 @@ ProcWarpPointer(ClientPtr client)
 	    rc = XaceHook(XACE_DEVICE_ACCESS, client, dev, DixWriteAccess);
 	    if (rc != Success)
 		return rc;
+            if (IsXTestDevice(tmp, dev))
+                xtest_dev = tmp;
 	}
     }
 
-    if (dev->lastSlave)
-        dev = dev->lastSlave;
+    /* Use the XTest device to actually move the pointer */
+    dev = xtest_dev;
     pSprite = dev->spriteInfo->sprite;
 
 #ifdef PANORAMIX
commit 2e28ff155ffc30707d42d885d5f6fc891bc82252
Author: Nobuhiro Iwamatsu <iwamatsu at nigauri.org>
Date:   Tue Aug 9 11:00:34 2011 +0900

    Disable check of double-aligned in test/input.c on Renesas SH
    
    Renesas SH is not aligned at size of double.
    When structure has double value, It is aligned in 4byte (long).
    
    Signed-off-by: Nobuhiro Iwamatsu <iwamatsu at nigauri.org>
    Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    (cherry picked from commit b29ce0726d55ec41cfbce0814e21b0217ef64efe)

diff --git a/test/input.c b/test/input.c
index 837ce49..6a0c523 100644
--- a/test/input.c
+++ b/test/input.c
@@ -1223,7 +1223,7 @@ static void dix_valuator_alloc(void)
 
         assert(v);
         assert(v->numAxes == num_axes);
-#ifndef __i386__
+#if !defined(__i386__) && !defined(__sh__)
         /* must be double-aligned on 64 bit */
         assert(((void*)v->axisVal - (void*)v) % sizeof(double) == 0);
         assert(((void*)v->axes - (void*)v) % sizeof(double) == 0);
commit 79ac611d3121801c34f111c91b5ace5769719695
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Mon Aug 1 14:12:41 2011 +1000

    dix: don't use the pointer as modifier device in UngrabKey.
    
    Modifier device is always the keyboard.
    
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    Reviewed-by: Daniel Stone <daniel at fooishbar.org>
    (cherry picked from commit 8c5a4d6fbecf79f2dc4f2d836d741203b2d5e856)

diff --git a/dix/events.c b/dix/events.c
index 89f6810..8e7f9c3 100644
--- a/dix/events.c
+++ b/dix/events.c
@@ -5372,7 +5372,7 @@ ProcUngrabKey(ClientPtr client)
     tempGrab.window = pWin;
     tempGrab.modifiersDetail.exact = stuff->modifiers;
     tempGrab.modifiersDetail.pMask = NULL;
-    tempGrab.modifierDevice = GetPairedDevice(keybd);
+    tempGrab.modifierDevice = keybd;
     tempGrab.type = KeyPress;
     tempGrab.grabtype = GRABTYPE_CORE;
     tempGrab.detail.exact = stuff->key;
commit 843737b4f979fed3a6d74cdfc7047ce5ca886639
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Thu Jul 28 15:56:08 2011 +1000

    dix: ignore devices when adding passive core grabs to list (#39545)
    
    Passive core grabs are mostly device-independent. In an MPX scenario, they
    may change to reflect whichever master pair activated the grab last. For
    adding new grabs to the list, ignore the device for core grabs to return
    failures when trying to set the same grab combo twice on a window.
    
    X.Org Bug 39545 <http://bugs.freedesktop.org/show_bug.cgi?id=39545>
    
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    Reviewed-by: Daniel Stone <daniel at fooishbar.org>
    (cherry picked from commit 09496996accfdaf7bc01097a25db400912004d97)

diff --git a/dix/grabs.c b/dix/grabs.c
index 85ca9ee..c28356d 100644
--- a/dix/grabs.c
+++ b/dix/grabs.c
@@ -479,7 +479,7 @@ AddPassiveGrabToList(ClientPtr client, GrabPtr pGrab)
 
     for (grab = wPassiveGrabs(pGrab->window); grab; grab = grab->next)
     {
-	if (GrabMatchesSecond(pGrab, grab, FALSE))
+	if (GrabMatchesSecond(pGrab, grab, (pGrab->grabtype == GRABTYPE_CORE)))
 	{
 	    if (CLIENT_BITS(pGrab->resource) != CLIENT_BITS(grab->resource))
 	    {
commit cb9c1d6d6cb25f55b1e4ac382e5af72a044e06aa
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Thu Jul 28 15:43:10 2011 +1000

    dix: avoid using the VCP as modifier device
    
    Core grabs may change device when they're activated to reflect the master
    they apply to. If the device is a keyboard, modifierDevice is erroneously
    set to the Virtual Core Pointer.
    
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    Reviewed-by: Daniel Stone <daniel at fooishbar.org>
    (cherry picked from commit 80c37048539daa1d257d127d66502bde45c97c85)

diff --git a/dix/events.c b/dix/events.c
index 9e58edb..89f6810 100644
--- a/dix/events.c
+++ b/dix/events.c
@@ -3678,7 +3678,7 @@ CheckPassiveGrabsOnWindow(
             if (tempGrab.type < GenericEvent)
             {
                 grab->device = device;
-                grab->modifierDevice = GetPairedDevice(device);
+                grab->modifierDevice = GetMaster(device, MASTER_KEYBOARD);
             }
 
             for (other = inputInfo.devices; other; other = other->next)
commit ef5c31430c891cf44148ea31058ed4cfb9bec21a
Author: Peter Hutterer <peter.hutterer at who-t.net>
Date:   Wed Jul 20 16:21:28 2011 +1000

    config: fix a log message
    
    PRODUCT was taken from the parent, hence ppath.
    
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    Reviewed-by: Daniel Stone <daniel at fooishbar.org>
    (cherry picked from commit e684e816acb617b4dc66a68e2b0ba8f80399170a)

diff --git a/config/udev.c b/config/udev.c
index e7383dc..42713e9 100644
--- a/config/udev.c
+++ b/config/udev.c
@@ -114,7 +114,7 @@ device_added(struct udev_device *udev_device)
                 == -1)
                 attrs.usb_id = NULL;
             else
-                LOG_PROPERTY(path, "PRODUCT", product);
+                LOG_PROPERTY(ppath, "PRODUCT", product);
         }
     }
     if (!name)
commit ec8ee3a9f76cc94d6fa4e7245c1a8fb68a42783c
Author: Peter Harris <pharris at opentext.com>
Date:   Fri Sep 2 18:45:16 2011 -0400

    xkb: add missing swaps for xkbGetDeviceInfoReply
    
    Caught during review of e095369bf.
    
    Signed-off-by: Peter Harris <pharris at opentext.com>
    Reviewed-by-by: Matt Turner <mattst88 at gmail.com>
    Signed-off-by: Matt Turner <mattst88 at gmail.com>
    (cherry picked from commit c90903b4f7a826ae6826a8dd0a901c8362500e46)
    
    Conflicts:
    
    	xkb/xkb.c
    
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>

diff --git a/xkb/xkb.c b/xkb/xkb.c
index 9c66955..6e0f542 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -6240,6 +6240,9 @@ char *			str;
 	swaps(&rep.unsupported,n);
 	swaps(&rep.nDeviceLedFBs,n);
 	swapl(&rep.type,n);
+	swaps(&rep.dfltKbdFB, n);
+	swaps(&rep.dfltLedFB, n);
+	swapl(&rep.devType, n);
     }
     WriteToClient(client,SIZEOF(xkbGetDeviceInfoReply), (char *)&rep);
 
commit 603ad6608a0dbe2fb1bdc4bcd8b4117f2b0bc8b2
Author: Jeremy Huddleston <jeremyhu at apple.com>
Date:   Tue Oct 4 21:40:03 2011 -0700

    XQuartz: pbproxy: Add missing AM_OBJCFLAGS
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>
    (cherry picked from commit fae7ed62ad476114bd37b566202cf6b6546c0a1f)

diff --git a/hw/xquartz/pbproxy/Makefile.am b/hw/xquartz/pbproxy/Makefile.am
index b8b95d2..1b14dff 100644
--- a/hw/xquartz/pbproxy/Makefile.am
+++ b/hw/xquartz/pbproxy/Makefile.am
@@ -2,6 +2,7 @@ AM_CPPFLAGS=-F/System/Library/Frameworks/ApplicationServices.framework/Framework
 	-DBUNDLE_ID_PREFIX=\"$(BUNDLE_ID_PREFIX)\"
 
 AM_CFLAGS=$(XPBPROXY_CFLAGS) 
+AM_OBJCFLAGS=$(XPBPROXY_CFLAGS)
 
 noinst_LTLIBRARIES = libxpbproxy.la
 libxpbproxy_la_SOURCES = \
commit 65469f5ea98074ab27ce0a2d482157b9d5c2cbc7
Author: vdb at picaros.org <vdb at picaros.org>
Date:   Sat Sep 17 18:55:47 2011 +0200

    Fix a rare memory leak
    
    Signed-off-by: Servaas Vandenberghe <vdb at picaros.org>
    Reviewed-by: Jeremy Huddleston <jeremyhu at apple.com>
    (cherry picked from commit e4cddf509e1729e8ff40354275b65455111ad2bd)

diff --git a/hw/xfree86/modes/xf86Crtc.c b/hw/xfree86/modes/xf86Crtc.c
index c2814d4..3fae039 100644
--- a/hw/xfree86/modes/xf86Crtc.c
+++ b/hw/xfree86/modes/xf86Crtc.c
@@ -133,6 +133,7 @@ xf86CrtcCreate (ScrnInfoPtr		scrn,
 	crtcs = malloc((xf86_config->num_crtc + 1) * sizeof (xf86CrtcPtr));
     if (!crtcs)
     {
+	free(crtc->gamma_red);
 	free(crtc);
 	return NULL;
     }
commit bec15eb73a17fb47963ff6b747ea504f7dc05deb
Author: Kirill Elagin <kirelagin at gmail.com>
Date:   Tue Oct 4 23:02:20 2011 +0400

    Fix server crash due to invalid images
    
    See https://bugs.freedesktop.org/show_bug.cgi?id=39383
    
    Signed-off-by: Kirill Elagin <kirelagin at gmail.com>
    Reviewed-by: Jeremy Huddleston <jeremyhu at apple.com>
    (cherry picked from commit 53611213396479abfdce0f7752681572e0d26d78)

diff --git a/fb/fbpict.c b/fb/fbpict.c
index d1fd0cb..57c93fd 100644
--- a/fb/fbpict.c
+++ b/fb/fbpict.c
@@ -163,7 +163,9 @@ create_bits_picture (PicturePtr pict,
 	(pixman_format_code_t)pict->format,
 	pixmap->drawable.width, pixmap->drawable.height,
 	(uint32_t *)bits, stride * sizeof (FbStride));
-    
+
+    if (!image)
+	return NULL;
     
 #ifdef FB_ACCESS_WRAPPER
 #if FB_SHIFT==5
commit b45e22675364915c32560c26404cf30d77ab68aa
Author: Alan Hourihane <alanh at vmware.com>
Date:   Tue Oct 4 19:42:46 2011 -0700

    dixfonts: Don't overwrite local c variable until new_closure is safely initialized.
    
    Signed-off-by: Alan Hourihane <alanh at vmware.com>
    Reviewed-by: Jeremy Huddleston <jeremyhu at apple.com>
    (cherry picked from commit 7a33c5b934382b5554f41ab1502514e91c9bc52e)

diff --git a/dix/dixfonts.c b/dix/dixfonts.c
index fbac124..d2bcb84 100644
--- a/dix/dixfonts.c
+++ b/dix/dixfonts.c
@@ -1302,31 +1302,30 @@ doPolyText(ClientPtr client, PTclosurePtr c)
 			goto bail;
 		    }
 		    *new_closure = *c;
-		    c = new_closure;
 
-		    len = c->endReq - c->pElt;
-		    c->data = malloc(len);
-		    if (!c->data)
+		    len = new_closure->endReq - new_closure->pElt;
+		    new_closure->data = malloc(len);
+		    if (!new_closure->data)
 		    {
-			free(c);
+			free(new_closure);
 			err = BadAlloc;
 			goto bail;
 		    }
-		    memmove(c->data, c->pElt, len);
-		    c->pElt = c->data;
-		    c->endReq = c->pElt + len;
+		    memmove(new_closure->data, new_closure->pElt, len);
+		    new_closure->pElt = new_closure->data;
+		    new_closure->endReq = new_closure->pElt + len;
 
 		    /* Step 2 */
 
-		    pGC = GetScratchGC(c->pGC->depth, c->pGC->pScreen);
+		    pGC = GetScratchGC(new_closure->pGC->depth, new_closure->pGC->pScreen);
 		    if (!pGC)
 		    {
-			free(c->data);
-			free(c);
+			free(new_closure->data);
+			free(new_closure);
 			err = BadAlloc;
 			goto bail;
 		    }
-		    if ((err = CopyGC(c->pGC, pGC, GCFunction |
+		    if ((err = CopyGC(new_closure->pGC, pGC, GCFunction |
 				      GCPlaneMask | GCForeground |
 				      GCBackground | GCFillStyle |
 				      GCTile | GCStipple |
@@ -1337,15 +1336,16 @@ doPolyText(ClientPtr client, PTclosurePtr c)
 				      Success)
 		    {
 			FreeScratchGC(pGC);
-			free(c->data);
-			free(c);
+			free(new_closure->data);
+			free(new_closure);
 			err = BadAlloc;
 			goto bail;
 		    }
+		    c = new_closure;
 		    origGC = c->pGC;
 		    c->pGC = pGC;
 		    ValidateGC(c->pDraw, c->pGC);
-		    
+
 		    ClientSleep(client, (ClientSleepProcPtr)doPolyText, c);
 
 		    /* Set up to perform steps 3 and 4 */
commit e9ae33316012ffe9acfeeb7303ab3392c2ca2a2b
Author: Sam Spilsbury <sam.spilsbury at canonical.com>
Date:   Wed Sep 14 09:58:34 2011 +0800

    Remove the SendEvent bit (0x80) before doing range checks on event type.
    
    Some extension libraries may set this bit before converting the event to
    wire protocol and as such range checking the event will cause an invalid
    BadValue error to result. As the documentation suggests the the bit
    should be "forced on", remove it before doing range checks and continue
    to force it on in the server.
    
    Reviewed-by: Jamey Sharp <jamey at minilop.net>
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    (cherry picked from commit 2d2dce558d24eeea0eb011ec9ebaa6c5c2273c39)

diff --git a/dix/events.c b/dix/events.c
index 8a4c6b9..9e58edb 100644
--- a/dix/events.c
+++ b/dix/events.c
@@ -5224,6 +5224,8 @@ CloseDownEvents(void)
     InputEventList = NULL;
 }
 
+#define SEND_EVENT_BIT 0x80
+
 /**
  * Server-side protocol handling for SendEvent request.
  *
@@ -5241,6 +5243,16 @@ ProcSendEvent(ClientPtr client)
 
     REQUEST_SIZE_MATCH(xSendEventReq);
 
+    /* libXext and other extension libraries may set the bit indicating
+     * that this event came from a SendEvent request so remove it
+     * since otherwise the event type may fail the range checks
+     * and cause an invalid BadValue error to be returned.
+     *
+     * This is safe to do since we later add the SendEvent bit (0x80)
+     * back in once we send the event to the client */
+
+    stuff->event.u.u.type &= ~(SEND_EVENT_BIT);
+
     /* The client's event type must be a core event type or one defined by an
 	extension. */
 
@@ -5298,7 +5310,7 @@ ProcSendEvent(ClientPtr client)
 	client->errorValue = stuff->propagate;
 	return BadValue;
     }
-    stuff->event.u.u.type |= 0x80;
+    stuff->event.u.u.type |= SEND_EVENT_BIT;
     if (stuff->propagate)
     {
 	for (;pWin; pWin = pWin->parent)
commit 347f5610ca023fb31485aa19c20607af8bf9c834
Author: Carlos Garnacho <carlosg at gnome.org>
Date:   Wed Aug 31 00:46:52 2011 +0200

    Xi: Fix passive XI2 ungrabs on XIAll[Master]Devices
    
    The corresponding DeviceIntPtr wasn't being gotten properly,
    resulting in BadDevice from dixLookupDevice().
    
    Signed-off-by: Carlos Garnacho <carlosg at gnome.org>
    Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer at who-t.net>
    (cherry picked from commit f52d5cd374563544dafe29587411f345e31bbdf8)

diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
index ae43433..5cdd8ac 100644
--- a/Xi/xipassivegrab.c
+++ b/Xi/xipassivegrab.c
@@ -261,9 +261,16 @@ ProcXIPassiveUngrabDevice(ClientPtr client)
     REQUEST(xXIPassiveUngrabDeviceReq);
     REQUEST_AT_LEAST_SIZE(xXIPassiveUngrabDeviceReq);
 
-    rc = dixLookupDevice(&dev, stuff->deviceid, client, DixGrabAccess);
-    if (rc != Success)
-	return rc;
+    if (stuff->deviceid == XIAllDevices)
+        dev = inputInfo.all_devices;
+    else if (stuff->deviceid == XIAllMasterDevices)
+        dev = inputInfo.all_master_devices;
+    else
+    {
+        rc = dixLookupDevice(&dev, stuff->deviceid, client, DixGrabAccess);
+        if (rc != Success)
+	    return rc;
+    }
 
     if (stuff->grab_type != XIGrabtypeButton &&
         stuff->grab_type != XIGrabtypeKeycode &&
commit 7b74bb67528033bf2d2a1714a801c38e7822642e
Author: Jeremy Huddleston <jeremyhu at apple.com>
Date:   Tue Sep 20 20:39:06 2011 -0700

    XQuartz: Use set_front_process rather than X11ApplicationSetFrontProcess since we're already in the AppKit thread
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>
    (cherry picked from commit 38e9e28ba2fbffee52ad9889ef6d4e94c7af3e10)

diff --git a/hw/xquartz/X11Application.m b/hw/xquartz/X11Application.m
index 7fd7dab..12ff53c 100644
--- a/hw/xquartz/X11Application.m
+++ b/hw/xquartz/X11Application.m
@@ -356,7 +356,7 @@ static void message_kit_thread (SEL selector, NSObject *arg) {
                          */
                         _appFlags._active = YES;
 
-                        X11ApplicationSetFrontProcess();
+                        [self set_front_process:nil];
 
                         /* Get the Spaces preference for SwitchOnActivate */
                         (void)CFPreferencesAppSynchronize(CFSTR("com.apple.dock"));
commit bd6ea85209e5ab80375d4ec9994d10a89fd1374a
Author: Jamey Sharp <jamey at minilop.net>
Date:   Tue Sep 14 18:35:21 2010 -0700

    Fix pixmap double-frees on error paths.
    
    If AddResource fails, it will automatically free the object that was
    passed to it by calling the appropriate deleteFunc; and of course
    FreeResource also calls the deleteFunc. In both cases it's wrong to call
    the destroy hook manually.
    
    Commit by Jamey Sharp and Josh Triplett.
    
    Signed-off-by: Jamey Sharp <jamey at minilop.net>
    Signed-off-by: Josh Triplett <josh at joshtriplett.org>
    Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
    Reviewed-by: Aaron Plattner <aplattner at nvidia.com>
    (cherry picked from commit 0f380a5005f800572773cd4667ce43c7459cc467)

diff --git a/Xext/shm.c b/Xext/shm.c
index b08af82..4141a8f 100644
--- a/Xext/shm.c
+++ b/Xext/shm.c
@@ -991,7 +991,6 @@ CreatePmap:
 	    pMap->drawable.serialNumber = NEXT_SERIAL_NUMBER;
 	    pMap->drawable.id = newPix->info[j].id;
 	    if (!AddResource(newPix->info[j].id, RT_PIXMAP, (pointer)pMap)) {
-		(*pScreen->DestroyPixmap)(pMap);
 		result = BadAlloc;
 		break;
 	    }
@@ -1002,10 +1001,8 @@ CreatePmap:
     }
 
     if(result == BadAlloc) {
-	while(j--) {
-	    (*pScreen->DestroyPixmap)(pMap);
+	while(j--)
 	    FreeResource(newPix->info[j].id, RT_NONE);
-	}
 	free(newPix);
     } else 
 	AddResource(stuff->pid, XRT_PIXMAP, newPix);
@@ -1110,7 +1107,6 @@ CreatePmap:
 	{
 	    return Success;
 	}
-	pDraw->pScreen->DestroyPixmap(pMap);
     }
     return BadAlloc;
 }
diff --git a/dix/dispatch.c b/dix/dispatch.c
index 192c8c3..f8200b1 100644
--- a/dix/dispatch.c
+++ b/dix/dispatch.c
@@ -1419,7 +1419,6 @@ CreatePmap:
 	}
 	if (AddResource(stuff->pid, RT_PIXMAP, (pointer)pMap))
 	    return Success;
-	(*pDraw->pScreen->DestroyPixmap)(pMap);
     }
     return BadAlloc;
 }
commit aabd25bd0bd5f30e4ebbf1d48ef800b3ed2abcbe
Author: Jeremy Huddleston <jeremyhu at apple.com>
Date:   Sat Sep 24 00:06:32 2011 -0700

    configure.ac: Version bumped to 1.11.1
    
    Signed-off-by: Jeremy Huddleston <jeremyhu at apple.com>

diff --git a/configure.ac b/configure.ac
index 2ac1f2e..51d01e4 100644
--- a/configure.ac
+++ b/configure.ac
@@ -26,8 +26,8 @@ dnl
 dnl Process this file with autoconf to create configure.
 
 AC_PREREQ(2.57)
-AC_INIT([xorg-server], 1.11.0, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
-RELEASE_DATE="2011-08-26"
+AC_INIT([xorg-server], 1.11.1, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
+RELEASE_DATE="2011-09-24"
 AC_CONFIG_SRCDIR([Makefile.am])
 AM_INIT_AUTOMAKE([foreign dist-bzip2])
 AM_MAINTAINER_MODE
commit 89881051664209b5b2e2c4a7c2dd25f085581d43
Author: Aaron Plattner <aplattner at nvidia.com>
Date:   Wed Sep 14 15:25:06 2011 -0700

    fb: Rename wfbTriangles and wfbTrapezoids
    
    These symbols were not renamed when they were added to libfb:
    
     # nm -D libwfb.so | grep ' fb'
     0000000000028d00 T fbTrapezoids
     0000000000028d60 T fbTriangles
    
    This causes corruption and/or crashes on wfb-ful drivers like nvidia:
    
     Program received signal SIGABRT, Aborted.
     0x00007fd67f3a0405 in *__GI_raise (sig=<optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
     64      ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
         in ../nptl/sysdeps/unix/sysv/linux/raise.c
     (gdb) bt
     #0  0x00007fd67f3a0405 in *__GI_raise (sig=<optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
     #1  0x00007fd67f3a3680 in *__GI_abort () at abort.c:92
     #2  0x00007fd67f3995b1 in *__GI___assert_fail (assertion=0x7fd679ecb804 "key->initialized", file=<optimized out>, line=116, function=0x7fd679ecbbc0 "dixGetPrivateAddr")
         at assert.c:81
     #3  0x00007fd679ec55b6 in ?? () from /usr/lib/xorg/modules/libfb.so
     #4  0x00007fd679eca9ef in ?? () from /usr/lib/xorg/modules/libfb.so
     #5  0x00007fd679ecae20 in fbTriangles () from /usr/lib/xorg/modules/libfb.so
     #6  0x00007fd67a58fc55 in ?? () from /usr/lib/xorg/modules/drivers/nvidia_drv.so
     #7  0x00000000004f38d1 in ?? ()
     #8  0x0000000000437ae9 in ?? ()
     #9  0x0000000000426eaa in ?? ()
     #10 0x00007fd67f38cead in __libc_start_main (main=<optimized out>, argc=<optimized out>, ubp_av=<optimized out>, init=<optimized out>, fini=<optimized out>,
         rtld_fini=<optimized out>, stack_end=0x7fff99860d78) at libc-start.c:228
     #11 0x000000000042719d in _start ()
    
    Signed-off-by: Aaron Plattner <aplattner at nvidia.com>
    Reviewed-by: Jeremy Huddleston <jeremyhu at apple.com>
    Signed-off-by: Keith Packard <keithp at keithp.com>
    (cherry picked from commit 03d032991da21bf866ca30dcbb6b7f9f99df441a)

diff --git a/fb/wfbrename.h b/fb/wfbrename.h
index e855edd..8b896eb 100644
--- a/fb/wfbrename.h
+++ b/fb/wfbrename.h
@@ -160,6 +160,8 @@
 #define fbStippleTable wfbStippleTable
 #define fbTile wfbTile
 #define fbTransparentSpan wfbTransparentSpan
+#define fbTrapezoids wfbTrapezoids
+#define fbTriangles wfbTriangles
 #define fbUninstallColormap wfbUninstallColormap
 #define fbUnmapWindow wfbUnmapWindow
 #define fbUnrealizeFont wfbUnrealizeFont


More information about the Xquartz-changes mailing list