diff --git a/render/pixman/pass.c b/render/pixman/pass.c
index d3ee17dca..af738bb42 100644
--- a/render/pixman/pass.c
+++ b/render/pixman/pass.c
@@ -159,6 +159,7 @@ static void render_pass_add_texture(struct wlr_render_pass *wlr_pass,
 
 		switch (options->filter_mode) {
 		case WLR_SCALE_FILTER_BILINEAR:
+			pixman_image_set_repeat(texture->image, PIXMAN_REPEAT_PAD);
 			pixman_image_set_filter(texture->image, PIXMAN_FILTER_BILINEAR, NULL, 0);
 			break;
 		case WLR_SCALE_FILTER_NEAREST:
diff --git a/types/ext_image_capture_source_v1/foreign_toplevel.c b/types/ext_image_capture_source_v1/foreign_toplevel.c
index e5c75e280..b1110d155 100644
--- a/types/ext_image_capture_source_v1/foreign_toplevel.c
+++ b/types/ext_image_capture_source_v1/foreign_toplevel.c
@@ -34,18 +34,13 @@ static void foreign_toplevel_manager_handle_create_source(struct wl_client *clie
 		return;
 	}
 
-	struct wlr_ext_foreign_toplevel_image_capture_source_manager_v1_request *request =
-		calloc(1, sizeof(*request));
-	if (request == NULL) {
-		wl_resource_post_no_memory(manager_resource);
-		return;
-	}
+	struct wlr_ext_foreign_toplevel_image_capture_source_manager_v1_request request = {
+		.toplevel_handle = toplevel_handle,
+		.client = client,
+		.new_id = new_id,
+	};
 
-	request->toplevel_handle = toplevel_handle;
-	request->client = client;
-	request->new_id = new_id;
-
-	wl_signal_emit_mutable(&manager->events.new_request, request);
+	wl_signal_emit_mutable(&manager->events.new_request, &request);
 }
 
 static void foreign_toplevel_manager_handle_destroy(struct wl_client *client,
diff --git a/types/ext_image_capture_source_v1/scene.c b/types/ext_image_capture_source_v1/scene.c
index 99d34e012..7d4b8928a 100644
--- a/types/ext_image_capture_source_v1/scene.c
+++ b/types/ext_image_capture_source_v1/scene.c
@@ -34,13 +34,14 @@ struct scene_node_source_frame_event {
 
 static size_t last_output_num = 0;
 
-static void _get_scene_node_extents(struct wlr_scene_node *node, struct wlr_box *box, int lx, int ly) {
+static void _get_scene_node_extents(struct wlr_scene_node *node, int lx, int ly,
+		int *x_min, int *y_min, int *x_max, int *y_max) {
 	switch (node->type) {
 	case WLR_SCENE_NODE_TREE:;
 		struct wlr_scene_tree *scene_tree = wlr_scene_tree_from_node(node);
 		struct wlr_scene_node *child;
 		wl_list_for_each(child, &scene_tree->children, link) {
-			_get_scene_node_extents(child, box, lx + child->x, ly + child->y);
+			_get_scene_node_extents(child, lx + child->x, ly + child->y, x_min, y_min, x_max, y_max);
 		}
 		break;
 	case WLR_SCENE_NODE_RECT:
@@ -48,27 +49,30 @@ static void _get_scene_node_extents(struct wlr_scene_node *node, struct wlr_box
 		struct wlr_box node_box = { .x = lx, .y = ly };
 		scene_node_get_size(node, &node_box.width, &node_box.height);
 
-		if (node_box.x < box->x) {
-			box->x = node_box.x;
+		if (node_box.x < *x_min) {
+			*x_min = node_box.x;
 		}
-		if (node_box.y < box->y) {
-			box->y = node_box.y;
+		if (node_box.y < *y_min) {
+			*y_min = node_box.y;
 		}
-		if (node_box.x + node_box.width > box->x + box->width) {
-			box->width = node_box.x + node_box.width - box->x;
+		if (node_box.x + node_box.width > *x_max) {
+			*x_max = node_box.x + node_box.width;
 		}
-		if (node_box.y + node_box.height > box->y + box->height) {
-			box->height = node_box.y + node_box.height - box->y;
+		if (node_box.y + node_box.height > *y_max) {
+			*y_max = node_box.y + node_box.height;
 		}
 		break;
 	}
 }
 
 static void get_scene_node_extents(struct wlr_scene_node *node, struct wlr_box *box) {
-	*box = (struct wlr_box){ .x = INT_MAX, .y = INT_MAX };
 	int lx = 0, ly = 0;
 	wlr_scene_node_coords(node, &lx, &ly);
-	_get_scene_node_extents(node, box, lx, ly);
+	*box = (struct wlr_box){ .x = INT_MAX, .y = INT_MAX };
+	int x_max = INT_MIN, y_max = INT_MIN;
+	_get_scene_node_extents(node, lx, ly, &box->x, &box->y, &x_max, &y_max);
+	box->width = x_max - box->x;
+	box->height = y_max - box->y;
 }
 
 static void source_render(struct scene_node_source *source) {
diff --git a/types/scene/surface.c b/types/scene/surface.c
index e6ea1333a..a6958645c 100644
--- a/types/scene/surface.c
+++ b/types/scene/surface.c
@@ -361,10 +361,9 @@ static void handle_scene_surface_surface_commit(
 	// the surface anyway.
 	int lx, ly;
 	bool enabled = wlr_scene_node_coords(&scene_buffer->node, &lx, &ly);
-
-	if (!wl_list_empty(&surface->surface->current.frame_callback_list) &&
-			surface->buffer->primary_output != NULL && enabled) {
-		wlr_output_schedule_frame(surface->buffer->primary_output->output);
+	struct wlr_output *output = get_surface_frame_pacing_output(surface->surface);
+	if (!wl_list_empty(&surface->surface->current.frame_callback_list) && output && enabled) {
+		wlr_output_schedule_frame(output);
 	}
 }
 
diff --git a/types/wlr_compositor.c b/types/wlr_compositor.c
index 6b31ab857..75faed190 100644
--- a/types/wlr_compositor.c
+++ b/types/wlr_compositor.c
@@ -246,40 +246,40 @@ static void surface_finalize_pending(struct wlr_surface *surface) {
 }
 
 static void surface_update_damage(pixman_region32_t *buffer_damage,
-		struct wlr_surface_state *current, struct wlr_surface_state *pending) {
+		struct wlr_surface_state *state) {
 	pixman_region32_clear(buffer_damage);
 
 	// Copy over surface damage + buffer damage
 	pixman_region32_t surface_damage;
 	pixman_region32_init(&surface_damage);
 
-	pixman_region32_copy(&surface_damage, &pending->surface_damage);
+	pixman_region32_copy(&surface_damage, &state->surface_damage);
 
-	if (pending->viewport.has_dst) {
+	if (state->viewport.has_dst) {
 		int src_width, src_height;
-		surface_state_viewport_src_size(pending, &src_width, &src_height);
-		float scale_x = (float)pending->viewport.dst_width / src_width;
-		float scale_y = (float)pending->viewport.dst_height / src_height;
+		surface_state_viewport_src_size(state, &src_width, &src_height);
+		float scale_x = (float)state->viewport.dst_width / src_width;
+		float scale_y = (float)state->viewport.dst_height / src_height;
 		wlr_region_scale_xy(&surface_damage, &surface_damage,
 			1.0 / scale_x, 1.0 / scale_y);
 	}
-	if (pending->viewport.has_src) {
+	if (state->viewport.has_src) {
 		// This is lossy: do a best-effort conversion
 		pixman_region32_translate(&surface_damage,
-			floor(pending->viewport.src.x),
-			floor(pending->viewport.src.y));
+			floor(state->viewport.src.x),
+			floor(state->viewport.src.y));
 	}
 
-	wlr_region_scale(&surface_damage, &surface_damage, pending->scale);
+	wlr_region_scale(&surface_damage, &surface_damage, state->scale);
 
 	int width, height;
-	surface_state_transformed_buffer_size(pending, &width, &height);
+	surface_state_transformed_buffer_size(state, &width, &height);
 	wlr_region_transform(&surface_damage, &surface_damage,
-		wlr_output_transform_invert(pending->transform),
+		wlr_output_transform_invert(state->transform),
 		width, height);
 
 	pixman_region32_union(buffer_damage,
-		&pending->buffer_damage, &surface_damage);
+		&state->buffer_damage, &surface_damage);
 
 	pixman_region32_fini(&surface_damage);
 }
@@ -521,8 +521,6 @@ static void surface_commit_state(struct wlr_surface *surface,
 		surface->unmap_commit = false;
 	}
 
-	surface_update_damage(&surface->buffer_damage, &surface->current, next);
-
 	surface->previous.scale = surface->current.scale;
 	surface->previous.transform = surface->current.transform;
 	surface->previous.width = surface->current.width;
@@ -531,6 +529,7 @@ static void surface_commit_state(struct wlr_surface *surface,
 	surface->previous.buffer_height = surface->current.buffer_height;
 
 	surface_state_move(&surface->current, next, surface);
+	surface_update_damage(&surface->buffer_damage, &surface->current);
 
 	if (invalid_buffer) {
 		surface_apply_damage(surface);
diff --git a/types/wlr_ext_foreign_toplevel_list_v1.c b/types/wlr_ext_foreign_toplevel_list_v1.c
index f20ddc877..cb2f21272 100644
--- a/types/wlr_ext_foreign_toplevel_list_v1.c
+++ b/types/wlr_ext_foreign_toplevel_list_v1.c
@@ -168,7 +168,7 @@ wlr_ext_foreign_toplevel_handle_v1_create(struct wlr_ext_foreign_toplevel_list_v
 		return NULL;
 	}
 
-	wl_list_insert(&list->toplevels, &toplevel->link);
+	wl_list_insert(list->toplevels.prev, &toplevel->link);
 	toplevel->list = list;
 	if (state->app_id) {
 		toplevel->app_id = strdup(state->app_id);
diff --git a/types/wlr_ext_workspace_v1.c b/types/wlr_ext_workspace_v1.c
index 7aaf80338..95b8a4997 100644
--- a/types/wlr_ext_workspace_v1.c
+++ b/types/wlr_ext_workspace_v1.c
@@ -790,7 +790,7 @@ struct wlr_ext_workspace_handle_v1 *wlr_ext_workspace_handle_v1_create(
 	wl_array_init(&workspace->coordinates);
 	wl_signal_init(&workspace->events.destroy);
 
-	wl_list_insert(&manager->workspaces, &workspace->link);
+	wl_list_insert(manager->workspaces.prev, &workspace->link);
 
 	struct wlr_ext_workspace_manager_v1_resource *manager_res;
 	wl_list_for_each(manager_res, &manager->resources, link) {
diff --git a/types/wlr_foreign_toplevel_management_v1.c b/types/wlr_foreign_toplevel_management_v1.c
index c98457a3d..739e4c185 100644
--- a/types/wlr_foreign_toplevel_management_v1.c
+++ b/types/wlr_foreign_toplevel_management_v1.c
@@ -530,7 +530,7 @@ wlr_foreign_toplevel_handle_v1_create(
 		return NULL;
 	}
 
-	wl_list_insert(&manager->toplevels, &toplevel->link);
+	wl_list_insert(manager->toplevels.prev, &toplevel->link);
 	toplevel->manager = manager;
 
 	wl_list_init(&toplevel->resources);
diff --git a/types/wlr_keyboard.c b/types/wlr_keyboard.c
index a24335b3a..adc705db5 100644
--- a/types/wlr_keyboard.c
+++ b/types/wlr_keyboard.c
@@ -84,6 +84,16 @@ void wlr_keyboard_notify_modifiers(struct wlr_keyboard *keyboard,
 		uint32_t mods_depressed, uint32_t mods_latched, uint32_t mods_locked,
 		uint32_t group) {
 	if (keyboard->xkb_state == NULL) {
+		if (keyboard->modifiers.depressed != mods_depressed ||
+				keyboard->modifiers.latched != mods_latched ||
+				keyboard->modifiers.locked != mods_locked ||
+				keyboard->modifiers.group != group) {
+			keyboard->modifiers.depressed = mods_depressed;
+			keyboard->modifiers.latched = mods_latched;
+			keyboard->modifiers.locked = mods_locked;
+			keyboard->modifiers.group = group;
+			wl_signal_emit_mutable(&keyboard->events.modifiers, keyboard);
+		}
 		return;
 	}
 	xkb_state_update_mask(keyboard->xkb_state, mods_depressed, mods_latched,
diff --git a/types/wlr_virtual_keyboard_v1.c b/types/wlr_virtual_keyboard_v1.c
index 011fbfec7..465b97dd3 100644
--- a/types/wlr_virtual_keyboard_v1.c
+++ b/types/wlr_virtual_keyboard_v1.c
@@ -52,7 +52,7 @@ static void virtual_keyboard_keymap(struct wl_client *client,
 	if (data == MAP_FAILED) {
 		goto fd_fail;
 	}
-	struct xkb_keymap *keymap = xkb_keymap_new_from_string(context, data,
+	struct xkb_keymap *keymap = xkb_keymap_new_from_buffer(context, data, size,
 		XKB_KEYMAP_FORMAT_TEXT_V1, XKB_KEYMAP_COMPILE_NO_FLAGS);
 	munmap(data, size);
 	if (!keymap) {
diff --git a/xwayland/xwm.c b/xwayland/xwm.c
index e44a11743..6d73c122a 100644
--- a/xwayland/xwm.c
+++ b/xwayland/xwm.c
@@ -1157,12 +1157,10 @@ bool wlr_xwayland_surface_fetch_icon(
 		return false;
 	}
 
-	if (!xcb_ewmh_get_wm_icon_from_reply(icon_reply, reply)) {
-		free(reply);
-		return false;
-	}
+	bool ok = xcb_ewmh_get_wm_icon_from_reply(icon_reply, reply);
+	free(reply);
 
-	return true;
+	return ok;
 }
 
 static xcb_get_property_cookie_t get_property(struct wlr_xwm *xwm,