xserver 1.19.3

Signed-off-by: Adam Jackson <ajax@redhat.com>

Xi/exevents.c

@@ -1798,15 +1798,19 @@ ProcessDeviceEvent(InternalEvent *ev, DeviceIntPtr device)
         break;
     }
 
-    if (grab)
-        DeliverGrabbedEvent((InternalEvent *) event, device,
-                            deactivateDeviceGrab);
-    else if (device->focus && !IsPointerEvent(ev))
-        DeliverFocusedEvent(device, (InternalEvent *) event,
-                            GetSpriteWindow(device));
-    else
-        DeliverDeviceEvents(GetSpriteWindow(device), (InternalEvent *) event,
-                            NullGrab, NullWindow, device);
+    /* Don't deliver focus events (e.g. from KeymapNotify when running
+     * nested) to clients. */
+    if (event->source_type != EVENT_SOURCE_FOCUS) {
+        if (grab)
+            DeliverGrabbedEvent((InternalEvent *) event, device,
+                                deactivateDeviceGrab);
+        else if (device->focus && !IsPointerEvent(ev))
+            DeliverFocusedEvent(device, (InternalEvent *) event,
+                                GetSpriteWindow(device));
+        else
+            DeliverDeviceEvents(GetSpriteWindow(device), (InternalEvent *) event,
+                                NullGrab, NullWindow, device);
+    }
 
     if (deactivateDeviceGrab == TRUE) {
         (*device->deviceGrab.DeactivateGrab) (device);

Xi/xichangehierarchy.c

@@ -194,7 +194,8 @@ add_master(ClientPtr client, xXIAddMasterInfo * c, int flags[MAXDEVICES])
     flags[XTestptr->id] |= XISlaveAttached;
     flags[XTestkeybd->id] |= XISlaveAttached;
 
-    XIBarrierNewMasterDevice(client, ptr->id);
+    for (int i = 0; i < currentMaxClients; i++)
+        XIBarrierNewMasterDevice(clients[i], ptr->id);
 
  unwind:
     free(name);
@@ -300,7 +301,8 @@ remove_master(ClientPtr client, xXIRemoveMasterInfo * r, int flags[MAXDEVICES])
         }
     }
 
-    XIBarrierRemoveMasterDevice(client, ptr->id);
+    for (int i = 0; i < currentMaxClients; i++)
+        XIBarrierRemoveMasterDevice(clients[i], ptr->id);
 
     /* disable the remove the devices, XTest devices must be done first
        else the sprites they rely on will be destroyed  */

composite/compalloc.c

@@ -612,7 +612,7 @@ compAllocPixmap(WindowPtr pWin)
     else
         pWin->redirectDraw = RedirectDrawManual;
 
-    compSetPixmap(pWin, pPixmap);
+    compSetPixmap(pWin, pPixmap, bw);
     cw->oldx = COMP_ORIGIN_INVALID;
     cw->oldy = COMP_ORIGIN_INVALID;
     cw->damageRegistered = FALSE;
@@ -651,7 +651,7 @@ compSetParentPixmap(WindowPtr pWin)
     RegionCopy(&pWin->borderClip, &cw->borderClip);
     pParentPixmap = (*pScreen->GetWindowPixmap) (pWin->parent);
     pWin->redirectDraw = RedirectDrawNone;
-    compSetPixmap(pWin, pParentPixmap);
+    compSetPixmap(pWin, pParentPixmap, pWin->borderWidth);
 }
 
 /*
@@ -682,7 +682,7 @@ compReallocPixmap(WindowPtr pWin, int draw_x, int draw_y,
         if (!pNew)
             return FALSE;
         cw->pOldPixmap = pOld;
-        compSetPixmap(pWin, pNew);
+        compSetPixmap(pWin, pNew, bw);
     }
     else {
         pNew = pOld;

composite/compint.h

@@ -274,7 +274,7 @@ void
 #endif
 
 void
- compSetPixmap(WindowPtr pWin, PixmapPtr pPixmap);
+ compSetPixmap(WindowPtr pWin, PixmapPtr pPixmap, int bw);
 
 Bool
  compCheckRedirect(WindowPtr pWin);

composite/compwindow.c

@@ -89,6 +89,7 @@ compCheckTree(ScreenPtr pScreen)
 typedef struct _compPixmapVisit {
     WindowPtr pWindow;
     PixmapPtr pPixmap;
+    int bw;
 } CompPixmapVisitRec, *CompPixmapVisitPtr;
 
 static Bool
@@ -126,19 +127,20 @@ compSetPixmapVisitWindow(WindowPtr pWindow, void *data)
      */
     SetWinSize(pWindow);
     SetBorderSize(pWindow);
-    if (HasBorder(pWindow))
+    if (pVisit->bw)
         QueueWorkProc(compRepaintBorder, serverClient,
                       (void *) (intptr_t) pWindow->drawable.id);
     return WT_WALKCHILDREN;
 }
 
 void
-compSetPixmap(WindowPtr pWindow, PixmapPtr pPixmap)
+compSetPixmap(WindowPtr pWindow, PixmapPtr pPixmap, int bw)
 {
     CompPixmapVisitRec visitRec;
 
     visitRec.pWindow = pWindow;
     visitRec.pPixmap = pPixmap;
+    visitRec.bw = bw;
     TraverseTree(pWindow, compSetPixmapVisitWindow, (void *) &visitRec);
     compCheckTree(pWindow->drawable.pScreen);
 }
@@ -463,7 +465,8 @@ compReparentWindow(WindowPtr pWin, WindowPtr pPriorParent)
      * Reset pixmap pointers as appropriate
      */
     if (pWin->parent && pWin->redirectDraw == RedirectDrawNone)
-        compSetPixmap(pWin, (*pScreen->GetWindowPixmap) (pWin->parent));
+        compSetPixmap(pWin, (*pScreen->GetWindowPixmap) (pWin->parent),
+                      pWin->borderWidth);
     /*
      * Call down to next function
      */

configure.ac

@@ -26,9 +26,9 @@ dnl
 dnl Process this file with autoconf to create configure.
 
 AC_PREREQ(2.60)
-AC_INIT([xorg-server], 1.19.0, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
-RELEASE_DATE="2016-11-15"
-RELEASE_NAME="Cioppino"
+AC_INIT([xorg-server], 1.19.3, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
+RELEASE_DATE="2017-03-15"
+RELEASE_NAME="Lobster Bisque"
 AC_CONFIG_SRCDIR([Makefile.am])
 AC_CONFIG_MACRO_DIR([m4])
 AM_INIT_AUTOMAKE([foreign dist-bzip2])
@@ -221,9 +221,13 @@ AC_CHECK_FUNCS([backtrace ffs geteuid getuid issetugid getresuid \
 	mmap posix_fallocate seteuid shmctl64 strncasecmp vasprintf vsnprintf \
 	walkcontext setitimer poll epoll_create1])
 AC_CONFIG_LIBOBJ_DIR([os])
-AC_REPLACE_FUNCS([reallocarray strcasecmp strcasestr strlcat strlcpy strndup])
+AC_REPLACE_FUNCS([reallocarray strcasecmp strcasestr strlcat strlcpy strndup\
+	timingsafe_memcmp])
 AM_CONDITIONAL(POLL, [test "x$ac_cv_func_poll" = "xyes"])
 
+AC_CHECK_LIB([bsd], [arc4random_buf])
+AC_CHECK_FUNCS([arc4random_buf])
+
 AC_CHECK_DECLS([program_invocation_short_name], [], [], [[#include <errno.h>]])
 
 dnl Check for SO_PEERCRED #define
@@ -1844,7 +1848,7 @@ if test "x$XNEST" = xyes; then
 	if test "x$have_xnest" = xno; then
 		AC_MSG_ERROR([Xnest build explicitly requested, but required modules not found.])
 	fi
-	XNEST_LIBS="$FB_LIB $FIXES_LIB $MI_LIB $XEXT_LIB $DBE_LIB $RECORD_LIB $GLX_LIBS $RANDR_LIB $RENDER_LIB $DAMAGE_LIB  $DRI3_LIB $PRESENT_LIB $MIEXT_SYNC_LIB $MIEXT_DAMAGE_LIB $MIEXT_SHADOW_LIB $XI_LIB $XKB_LIB $XKB_STUB_LIB $COMPOSITE_LIB $MAIN_LIB $DIX_LIB $OS_LIB"
+	XNEST_LIBS="$FB_LIB $FIXES_LIB $MI_LIB $XEXT_LIB $DBE_LIB $RECORD_LIB $GLX_LIBS $RANDR_LIB $DAMAGE_LIB  $DRI3_LIB $PRESENT_LIB $MIEXT_SYNC_LIB $MIEXT_DAMAGE_LIB $RENDER_LIB $MIEXT_SHADOW_LIB $XI_LIB $XKB_LIB $XKB_STUB_LIB $COMPOSITE_LIB $MAIN_LIB $DIX_LIB $OS_LIB"
 	XNEST_SYS_LIBS="$XNESTMODULES_LIBS $GLX_SYS_LIBS"
 	AC_SUBST([XNEST_LIBS])
 	AC_SUBST([XNEST_SYS_LIBS])
@@ -2330,7 +2334,7 @@ if test "x$DMX" = xyes; then
 	fi
 	DMX_INCLUDES="$XEXT_INC $RENDER_INC $RECORD_INC"
 	XDMX_CFLAGS="$DMXMODULES_CFLAGS"
-	XDMX_LIBS="$FB_LIB $MI_LIB $XEXT_LIB $RENDER_LIB $RECORD_LIB $XI_LIB $XKB_LIB $XKB_STUB_LIB $DRI3_LIB $PRESENT_LIB $MIEXT_SYNC_LIB $MIEXT_SHADOW_LIB $MIEXT_DAMAGE_LIB $COMPOSITE_LIB $DAMAGE_LIB $MAIN_LIB $DIX_LIB $RANDR_LIB $CONFIG_LIB $OS_LIB $FIXES_LIB"
+	XDMX_LIBS="$FB_LIB $MI_LIB $XEXT_LIB $PRESENT_LIB $RANDR_LIB $RENDER_LIB $RECORD_LIB $XI_LIB $XKB_LIB $XKB_STUB_LIB $DRI3_LIB $MIEXT_SYNC_LIB $MIEXT_SHADOW_LIB $MIEXT_DAMAGE_LIB $COMPOSITE_LIB $DAMAGE_LIB $MAIN_LIB $DIX_LIB $CONFIG_LIB $OS_LIB $FIXES_LIB"
 	XDMX_SYS_LIBS="$DMXMODULES_LIBS"
 	AC_SUBST([XDMX_CFLAGS])
 	AC_SUBST([XDMX_LIBS])

dix/Makefile.am

@@ -61,13 +61,13 @@ endif
 
 if SPECIAL_DTRACE_OBJECTS
 # Generate dtrace object code for probes in libdix
-dtrace-dix.o: $(top_srcdir)/dix/Xserver.d $(am_libdix_la_OBJECTS)
+dtrace-dix.o: $(top_srcdir)/dix/Xserver.d libdix.la
 	$(AM_V_GEN)$(DTRACE) -G -C -o $@ -s $(top_srcdir)/dix/Xserver.d $(am_libdix_la_OBJECTS:%.lo=.libs/%.o)
 
 noinst_PROGRAMS = dix.O
 
 dix_O_SOURCES =
-dix.O: dtrace-dix.o $(am_libdix_la_OBJECTS)
+dix.O: dtrace-dix.o libdix.la
 	$(AM_V_GEN)ld -r -o $@ $(am_libdix_la_OBJECTS:%.lo=.libs/%.o)
 endif
 

dix/dispatch.c

@@ -266,6 +266,16 @@ mark_client_ready(ClientPtr client)
         xorg_list_append(&client->ready, &ready_clients);
 }
 
+/*
+ * Client has requests queued or data on the network, but awaits a
+ * server grab release
+ */
+void mark_client_saved_ready(ClientPtr client)
+{
+    if (xorg_list_is_empty(&client->ready))
+        xorg_list_append(&client->ready, &saved_ready_clients);
+}
+
 /* Client has no requests queued and no data on network */
 void
 mark_client_not_ready(ClientPtr client)

dix/getevents.c

@@ -1101,9 +1101,12 @@ GetKeyboardEvents(InternalEvent *events, DeviceIntPtr pDev, int type,
     }
 #endif
 
-    if (type == KeymapNotify) {
+    if (type == EnterNotify) {
         source_type = EVENT_SOURCE_FOCUS;
         type = KeyPress;
+    } else if (type == LeaveNotify) {
+        source_type = EVENT_SOURCE_FOCUS;
+        type = KeyRelease;
     }
 
     /* refuse events from disabled devices */

dix/pixmap.c

@@ -172,6 +172,14 @@ PixmapPtr PixmapShareToSlave(PixmapPtr pixmap, ScreenPtr slave)
     return spix;
 }
 
+static void
+PixmapDirtyDamageDestroy(DamagePtr damage, void *closure)
+{
+    PixmapDirtyUpdatePtr dirty = closure;
+
+    dirty->damage = NULL;
+}
+
 Bool
 PixmapStartDirtyTracking(PixmapPtr src,
                          PixmapPtr slave_dst,
@@ -195,10 +203,10 @@ PixmapStartDirtyTracking(PixmapPtr src,
     dirty_update->dst_x = dst_x;
     dirty_update->dst_y = dst_y;
     dirty_update->rotation = rotation;
-    dirty_update->damage = DamageCreate(NULL, NULL,
+    dirty_update->damage = DamageCreate(NULL, PixmapDirtyDamageDestroy,
                                         DamageReportNone,
                                         TRUE, src->drawable.pScreen,
-                                        src->drawable.pScreen);
+                                        dirty_update);
 
     if (rotation != RR_Rotate_0) {
         RRTransformCompute(x, y,
@@ -246,7 +254,8 @@ PixmapStopDirtyTracking(PixmapPtr src, PixmapPtr slave_dst)
 
     xorg_list_for_each_entry_safe(ent, safe, &screen->pixmap_dirty_list, ent) {
         if (ent->src == src && ent->slave_dst == slave_dst) {
-            DamageDestroy(ent->damage);
+            if (ent->damage)
+                DamageDestroy(ent->damage);
             xorg_list_del(&ent->ent);
             free(ent);
         }

glamor/glamor.c

@@ -470,7 +470,7 @@ glamor_init(ScreenPtr screen, unsigned int flags)
         LogMessage(X_WARNING,
                    "glamor%d: Failed to allocate screen private\n",
                    screen->myNum);
-        goto fail;
+        goto free_glamor_private;
     }
 
     glamor_set_screen_private(screen, glamor_priv);
@@ -480,7 +480,7 @@ glamor_init(ScreenPtr screen, unsigned int flags)
         LogMessage(X_WARNING,
                    "glamor%d: Failed to allocate pixmap private\n",
                    screen->myNum);
-        goto fail;
+        goto free_glamor_private;
     }
 
     if (!dixRegisterPrivateKey(&glamor_gc_private_key, PRIVATE_GC,
@@ -488,7 +488,7 @@ glamor_init(ScreenPtr screen, unsigned int flags)
         LogMessage(X_WARNING,
                    "glamor%d: Failed to allocate gc private\n",
                    screen->myNum);
-        goto fail;
+        goto free_glamor_private;
     }
 
     glamor_priv->saved_procs.close_screen = screen->CloseScreen;
@@ -731,6 +731,11 @@ glamor_init(ScreenPtr screen, unsigned int flags)
     return TRUE;
 
  fail:
+    /* Restore default CloseScreen and DestroyPixmap handlers */
+    screen->CloseScreen = glamor_priv->saved_procs.close_screen;
+    screen->DestroyPixmap = glamor_priv->saved_procs.destroy_pixmap;
+
+ free_glamor_private:
     free(glamor_priv);
     glamor_set_screen_private(screen, NULL);
     return FALSE;

glamor/glamor_dash.c

@@ -32,6 +32,7 @@ static const char dash_vs_vars[] =
 
 static const char dash_vs_exec[] =
     "       dash_offset = primitive.z / dash_length;\n"
+    "       vec2 pos = vec2(0,0);\n"
     GLAMOR_POS(gl_Position, primitive.xy);
 
 static const char dash_fs_vars[] =

glamor/glamor_egl.c

@@ -769,6 +769,10 @@ glamor_egl_init(ScrnInfoPtr scrn, int fd)
 
     glamor_egl->display = glamor_egl_get_display(EGL_PLATFORM_GBM_MESA,
                                                  glamor_egl->gbm);
+    if (!glamor_egl->display) {
+        xf86DrvMsg(scrn->scrnIndex, X_ERROR, "eglGetDisplay() failed\n");
+        goto error;
+    }
 #else
     glamor_egl->display = eglGetDisplay((EGLNativeDisplayType) (intptr_t) fd);
 #endif

glamor/glamor_egl.h

@@ -60,16 +60,12 @@
 static inline EGLDisplay
 glamor_egl_get_display(EGLint type, void *native)
 {
-    EGLDisplay dpy = NULL;
-
     /* In practise any EGL 1.5 implementation would support the EXT extension */
     if (epoxy_has_egl_extension(NULL, "EGL_EXT_platform_base")) {
         PFNEGLGETPLATFORMDISPLAYEXTPROC getPlatformDisplayEXT =
             (void *) eglGetProcAddress("eglGetPlatformDisplayEXT");
         if (getPlatformDisplayEXT)
-            dpy = getPlatformDisplayEXT(type, native, NULL);
-        if (dpy)
-            return dpy;
+            return getPlatformDisplayEXT(type, native, NULL);
     }
 
     /* Welp, everything is awful. */

glamor/glamor_render.c

@@ -1494,6 +1494,10 @@ glamor_composite_clipped_region(CARD8 op,
             ca_state = CA_DUAL_BLEND;
         } else {
             if (op == PictOpOver) {
+                if (glamor_pixmap_is_memory(mask_pixmap)) {
+                    glamor_fallback("two pass not supported on memory pximaps\n");
+                    goto out;
+                }
                 ca_state = CA_TWO_PASS;
                 op = PictOpOutReverse;
             }

hw/xfree86/common/xf86AutoConfig.c

@@ -149,6 +149,15 @@ xf86AutoConfig(void)
     char buf[1024];
     ConfigStatus ret;
 
+    /* Make sure config rec is there */
+    if (xf86allocateConfig() != NULL) {
+        ret = CONFIG_OK;    /* OK so far */
+    }
+    else {
+        xf86Msg(X_ERROR, "Couldn't allocate Config record.\n");
+        return FALSE;
+    }
+
     listPossibleVideoDrivers(deviceList, 20);
 
     for (p = deviceList; *p; p++) {

hw/xfree86/common/xf86Option.c

@@ -84,7 +84,7 @@ xf86CollectOptions(ScrnInfoPtr pScrn, XF86OptionPtr extraOpts)
         if (device && device->options) {
             tmp = xf86optionListDup(device->options);
             if (pScrn->options)
-                xf86optionListMerge(pScrn->options, tmp);
+                pScrn->options = xf86optionListMerge(pScrn->options, tmp);
             else
                 pScrn->options = tmp;
         }

hw/xfree86/modes/xf86EdidModes.c

@@ -153,6 +153,11 @@ quirk_detailed_v_in_cm(int scrnIndex, xf86MonPtr DDC)
 static Bool
 quirk_detailed_use_maximum_size(int scrnIndex, xf86MonPtr DDC)
 {
+    /* ADA 1024x600 7" display */
+    if (memcmp(DDC->vendor.name, "ADA", 4) == 0 &&
+        DDC->vendor.prod_id == 4)
+        return TRUE;
+
     /* Bug #21324: Iiyama Vision Master 450 */
     if (memcmp(DDC->vendor.name, "IVM", 4) == 0 && DDC->vendor.prod_id == 6400)
         return TRUE;

hw/xfree86/parser/read.c

@@ -56,6 +56,7 @@
 #include <xorg-config.h>
 #endif
 
+#include "xf86Config.h"
 #include "xf86Parser.h"
 #include "xf86tokens.h"
 #include "Configint.h"
@@ -91,7 +92,7 @@ xf86readConfigFile(void)
     int token;
     XF86ConfigPtr ptr = NULL;
 
-    if ((ptr = calloc(1, sizeof(XF86ConfigRec))) == NULL) {
+    if ((ptr = xf86allocateConfig()) == NULL) {
         return NULL;
     }
 
@@ -270,6 +271,19 @@ xf86itemNotSublist(GenericListPtr list_1, GenericListPtr list_2)
     return (!(last_1 == last_2));
 }
 
+/*
+ * Conditionally allocate config struct, but only allocate it
+ * if it's not already there.  In either event, return the pointer
+ * to the global config struct.
+ */
+XF86ConfigPtr xf86allocateConfig(void)
+{
+    if (!xf86configptr) {
+        xf86configptr = calloc(1, sizeof(XF86ConfigRec));
+    }
+    return xf86configptr;
+}
+
 void
 xf86freeConfig(XF86ConfigPtr p)
 {

hw/xfree86/parser/xf86Parser.h

@@ -449,6 +449,7 @@ extern char *xf86openConfigDirFiles(const char *path, const char *cmdline,
 extern void xf86setBuiltinConfig(const char *config[]);
 extern XF86ConfigPtr xf86readConfigFile(void);
 extern void xf86closeConfigFile(void);
+extern XF86ConfigPtr xf86allocateConfig(void);
 extern void xf86freeConfig(XF86ConfigPtr p);
 extern int xf86writeConfigFile(const char *, XF86ConfigPtr);
 extern _X_EXPORT XF86ConfDevicePtr xf86findDevice(const char *ident,

hw/xfree86/ramdac/xf86HWCurs.c

@@ -22,6 +22,9 @@
 
 #include "servermd.h"
 
+static void
+xf86RecolorCursor_locked(xf86CursorScreenPtr ScreenPriv, CursorPtr pCurs);
+
 static CARD32
 xf86ReverseBitOrder(CARD32 v)
 {
@@ -136,9 +139,14 @@ Bool
 xf86CheckHWCursor(ScreenPtr pScreen, CursorPtr cursor, xf86CursorInfoPtr infoPtr)
 {
     ScreenPtr pSlave;
+    Bool use_hw_cursor = TRUE;
 
-    if (!xf86ScreenCheckHWCursor(pScreen, cursor, infoPtr))
-        return FALSE;
+    input_lock();
+
+    if (!xf86ScreenCheckHWCursor(pScreen, cursor, infoPtr)) {
+        use_hw_cursor = FALSE;
+	goto unlock;
+    }
 
     /* ask each driver consuming a pixmap if it can support HW cursor */
     xorg_list_for_each_entry(pSlave, &pScreen->slave_list, slave_head) {
@@ -148,14 +156,22 @@ xf86CheckHWCursor(ScreenPtr pScreen, CursorPtr cursor, xf86CursorInfoPtr infoPtr
             continue;
 
         sPriv = dixLookupPrivate(&pSlave->devPrivates, xf86CursorScreenKey);
-        if (!sPriv) /* NULL if Option "SWCursor", possibly other conditions */
-            return FALSE;
+        if (!sPriv) { /* NULL if Option "SWCursor", possibly other conditions */
+            use_hw_cursor = FALSE;
+	    break;
+	}
 
         /* FALSE if HWCursor not supported by slave */
-        if (!xf86ScreenCheckHWCursor(pSlave, cursor, sPriv->CursorInfoPtr))
-            return FALSE;
+        if (!xf86ScreenCheckHWCursor(pSlave, cursor, sPriv->CursorInfoPtr)) {
+            use_hw_cursor = FALSE;
+	    break;
+	}
     }
-    return TRUE;
+
+unlock:
+    input_unlock();
+
+    return use_hw_cursor;
 }
 
 static Bool
@@ -204,7 +220,7 @@ xf86ScreenSetCursor(ScreenPtr pScreen, CursorPtr pCurs, int x, int y)
         if (!xf86DriverLoadCursorImage (infoPtr, bits))
             return FALSE;
 
-    xf86RecolorCursor(pScreen, pCurs, 1);
+    xf86RecolorCursor_locked (ScreenPriv, pCurs);
 
     (*infoPtr->SetCursorPosition) (infoPtr->pScrn, x, y);
 
@@ -258,6 +274,8 @@ xf86SetTransparentCursor(ScreenPtr pScreen)
                                                xf86CursorScreenKey);
     xf86CursorInfoPtr infoPtr = ScreenPriv->CursorInfoPtr;
 
+    input_lock();
+
     if (!ScreenPriv->transparentData)
         ScreenPriv->transparentData =
             (*infoPtr->RealizeCursor) (infoPtr, NullCursor);
@@ -270,6 +288,8 @@ xf86SetTransparentCursor(ScreenPtr pScreen)
                                    ScreenPriv->transparentData);
 
     (*infoPtr->ShowCursor) (infoPtr->pScrn);
+
+    input_unlock();
 }
 
 static void
@@ -312,12 +332,9 @@ xf86MoveCursor(ScreenPtr pScreen, int x, int y)
     input_unlock();
 }
 
-void
-xf86RecolorCursor(ScreenPtr pScreen, CursorPtr pCurs, Bool displayed)
+static void
+xf86RecolorCursor_locked(xf86CursorScreenPtr ScreenPriv, CursorPtr pCurs)
 {
-    xf86CursorScreenPtr ScreenPriv =
-        (xf86CursorScreenPtr) dixLookupPrivate(&pScreen->devPrivates,
-                                               xf86CursorScreenKey);
     xf86CursorInfoPtr infoPtr = ScreenPriv->CursorInfoPtr;
 
     /* recoloring isn't applicable to ARGB cursors and drivers
@@ -357,6 +374,18 @@ xf86RecolorCursor(ScreenPtr pScreen, CursorPtr pCurs, Bool displayed)
     }
 }
 
+void
+xf86RecolorCursor(ScreenPtr pScreen, CursorPtr pCurs, Bool displayed)
+{
+    xf86CursorScreenPtr ScreenPriv =
+        (xf86CursorScreenPtr) dixLookupPrivate(&pScreen->devPrivates,
+                                               xf86CursorScreenKey);
+
+    input_lock();
+    xf86RecolorCursor_locked (ScreenPriv, pCurs);
+    input_unlock();
+}
+
 /* These functions assume that MaxWidth is a multiple of 32 */
 static unsigned char *
 RealizeCursorInterleave0(xf86CursorInfoPtr infoPtr, CursorPtr pCurs)

hw/xwayland/xwayland-cursor.c

@@ -95,6 +95,15 @@ xwl_unrealize_cursor(DeviceIntPtr device, ScreenPtr screen, CursorPtr cursor)
     return xwl_shm_destroy_pixmap(pixmap);
 }
 
+static void
+clear_cursor_frame_callback(struct xwl_seat *xwl_seat)
+{
+   if (xwl_seat->cursor_frame_cb) {
+       wl_callback_destroy (xwl_seat->cursor_frame_cb);
+       xwl_seat->cursor_frame_cb = NULL;
+   }
+}
+
 static void
 frame_callback(void *data,
                struct wl_callback *callback,
@@ -102,8 +111,7 @@ frame_callback(void *data,
 {
     struct xwl_seat *xwl_seat = data;
 
-    wl_callback_destroy (xwl_seat->cursor_frame_cb);
-    xwl_seat->cursor_frame_cb = NULL;
+    clear_cursor_frame_callback(xwl_seat);
     if (xwl_seat->cursor_needs_update) {
         xwl_seat->cursor_needs_update = FALSE;
         xwl_seat_set_cursor(xwl_seat);
@@ -127,6 +135,8 @@ xwl_seat_set_cursor(struct xwl_seat *xwl_seat)
     if (!xwl_seat->x_cursor) {
         wl_pointer_set_cursor(xwl_seat->wl_pointer,
                               xwl_seat->pointer_enter_serial, NULL, 0, 0);
+        clear_cursor_frame_callback(xwl_seat);
+        xwl_seat->cursor_needs_update = FALSE;
         return;
     }
 

hw/xwayland/xwayland-cvt.c

@@ -296,6 +296,13 @@ xwayland_cvt(int HDisplay, int VDisplay, float VRefresh, Bool Reduced,
     if (Interlaced)
         modeinfo.modeFlags |= RR_Interlace;
 
+    /* FWXGA hack adapted from hw/xfree86/modes/xf86EdidModes.c, because you can't say 1366 */
+    if (HDisplay == 1366 && VDisplay == 768) {
+         modeinfo.width = 1366;
+         modeinfo.hSyncStart--;
+         modeinfo.hSyncEnd--;
+    }
+
     snprintf(name, sizeof name, "%dx%d",
              modeinfo.width, modeinfo.height);
     modeinfo.nameLength = strlen(name);

hw/xwayland/xwayland-glamor.c

@@ -38,6 +38,8 @@
 #include <dri3.h>
 #include "drm-client-protocol.h"
 
+static DevPrivateKeyRec xwl_auth_state_private_key;
+
 struct xwl_pixmap {
     struct wl_buffer *buffer;
     struct gbm_bo *bo;
@@ -429,17 +431,49 @@ glamor_egl_dri3_fd_name_from_tex(ScreenPtr screen,
 struct xwl_auth_state {
     int fd;
     ClientPtr client;
+    struct wl_callback *callback;
 };
 
+static void
+free_xwl_auth_state(ClientPtr pClient, struct xwl_auth_state *state)
+{
+    dixSetPrivate(&pClient->devPrivates, &xwl_auth_state_private_key, NULL);
+    if (state) {
+        wl_callback_destroy(state->callback);
+        free(state);
+    }
+}
+
+static void
+xwl_auth_state_client_callback(CallbackListPtr *pcbl, void *unused, void *data)
+{
+    NewClientInfoRec *clientinfo = (NewClientInfoRec *) data;
+    ClientPtr pClient = clientinfo->client;
+    struct xwl_auth_state *state;
+
+    switch (pClient->clientState) {
+    case ClientStateGone:
+    case ClientStateRetained:
+        state = dixLookupPrivate(&pClient->devPrivates, &xwl_auth_state_private_key);
+        free_xwl_auth_state(pClient, state);
+        break;
+    default:
+        break;
+    }
+}
+
 static void
 sync_callback(void *data, struct wl_callback *callback, uint32_t serial)
 {
     struct xwl_auth_state *state = data;
+    ClientPtr client = state->client;
 
-    dri3_send_open_reply(state->client, state->fd);
-    AttendClient(state->client);
-    free(state);
-    wl_callback_destroy(callback);
+    /* if the client is gone, the callback is cancelled so it's safe to
+     * assume the client is still in ClientStateRunning at this point...
+     */
+    dri3_send_open_reply(client, state->fd);
+    AttendClient(client);
+    free_xwl_auth_state(client, state);
 }
 
 static const struct wl_callback_listener sync_listener = {
@@ -454,7 +488,6 @@ xwl_dri3_open_client(ClientPtr client,
 {
     struct xwl_screen *xwl_screen = xwl_screen_get(screen);
     struct xwl_auth_state *state;
-    struct wl_callback *callback;
     drm_magic_t magic;
     int fd;
 
@@ -482,8 +515,9 @@ xwl_dri3_open_client(ClientPtr client,
     }
 
     wl_drm_authenticate(xwl_screen->drm, magic);
-    callback = wl_display_sync(xwl_screen->display);
-    wl_callback_add_listener(callback, &sync_listener, state);
+    state->callback = wl_display_sync(xwl_screen->display);
+    wl_callback_add_listener(state->callback, &sync_listener, state);
+    dixSetPrivate(&client->devPrivates, &xwl_auth_state_private_key, state);
 
     IgnoreClient(client);
 
@@ -565,6 +599,16 @@ xwl_glamor_init(struct xwl_screen *xwl_screen)
         return FALSE;
     }
 
+    if (!dixRegisterPrivateKey(&xwl_auth_state_private_key, PRIVATE_CLIENT, 0)) {
+        ErrorF("Failed to register private key\n");
+        return FALSE;
+    }
+
+    if (!AddCallback(&ClientStateCallback, xwl_auth_state_client_callback, NULL)) {
+        ErrorF("Failed to add client state callback\n");
+        return FALSE;
+    }
+
     xwl_screen->CreateScreenResources = screen->CreateScreenResources;
     screen->CreateScreenResources = xwl_glamor_create_screen_resources;
     screen->CreatePixmap = xwl_glamor_create_pixmap;

hw/xwayland/xwayland-input.c

@@ -318,6 +318,9 @@ pointer_handle_enter(void *data, struct wl_pointer *pointer,
     dx = xwl_seat->focus_window->window->drawable.x;
     dy = xwl_seat->focus_window->window->drawable.y;
 
+    /* We just entered a new xwindow, forget about the old last xwindow */
+    xwl_seat->last_xwindow = NullWindow;
+
     master = GetMaster(dev, POINTER_OR_FLOAT);
     (*pScreen->SetCursorPosition) (dev, pScreen, dx + sx, dy + sy, TRUE);
 
@@ -366,8 +369,14 @@ pointer_handle_leave(void *data, struct wl_pointer *pointer,
 
     xwl_seat->xwl_screen->serial = serial;
 
-    xwl_seat->focus_window = NULL;
-    CheckMotion(NULL, GetMaster(dev, POINTER_OR_FLOAT));
+    /* The pointer has left a known xwindow, save it for a possible match
+     * in sprite_check_lost_focus()
+     */
+    if (xwl_seat->focus_window) {
+        xwl_seat->last_xwindow = xwl_seat->focus_window->window;
+        xwl_seat->focus_window = NULL;
+        CheckMotion(NULL, GetMaster(dev, POINTER_OR_FLOAT));
+    }
 }
 
 static void
@@ -507,6 +516,9 @@ pointer_handle_frame(void *data, struct wl_pointer *wl_pointer)
 {
     struct xwl_seat *xwl_seat = data;
 
+    if (!xwl_seat->focus_window)
+        return;
+
     dispatch_pointer_motion_event(xwl_seat);
 }
 
@@ -557,6 +569,9 @@ relative_pointer_handle_relative_motion(void *data,
     xwl_seat->pending_pointer_event.dx_unaccel = wl_fixed_to_double(dx_unaccelf);
     xwl_seat->pending_pointer_event.dy_unaccel = wl_fixed_to_double(dy_unaccelf);
 
+    if (!xwl_seat->focus_window)
+        return;
+
     if (wl_proxy_get_version((struct wl_proxy *) xwl_seat->wl_pointer) < 5)
         dispatch_pointer_motion_event(xwl_seat);
 }
@@ -646,7 +661,7 @@ keyboard_handle_enter(void *data, struct wl_keyboard *keyboard,
 
     wl_array_copy(&xwl_seat->keys, keys);
     wl_array_for_each(k, &xwl_seat->keys)
-        QueueKeyboardEvents(xwl_seat->keyboard, KeymapNotify, *k + 8);
+        QueueKeyboardEvents(xwl_seat->keyboard, EnterNotify, *k + 8);
 }
 
 static void
@@ -658,12 +673,8 @@ keyboard_handle_leave(void *data, struct wl_keyboard *keyboard,
 
     xwl_seat->xwl_screen->serial = serial;
 
-    /* Unlike keymap_handle_enter above, this time we _do_ want to trigger
-     * full release, as we don't know how long we'll be out of focus for.
-     * Notify clients that the keys have been released, disable autorepeat,
-     * etc. */
     wl_array_for_each(k, &xwl_seat->keys)
-        QueueKeyboardEvents(xwl_seat->keyboard, KeyRelease, *k + 8);
+        QueueKeyboardEvents(xwl_seat->keyboard, LeaveNotify, *k + 8);
 
     xwl_seat->keyboard_focus = NULL;
 }
@@ -1022,8 +1033,6 @@ release_relative_pointer(struct xwl_seat *xwl_seat)
 static void
 init_keyboard(struct xwl_seat *xwl_seat)
 {
-    DeviceIntPtr master;
-
     xwl_seat->wl_keyboard = wl_seat_get_keyboard(xwl_seat->seat);
     wl_keyboard_add_listener(xwl_seat->wl_keyboard,
                              &keyboard_listener, xwl_seat);
@@ -1035,9 +1044,6 @@ init_keyboard(struct xwl_seat *xwl_seat)
     }
     EnableDevice(xwl_seat->keyboard, TRUE);
     xwl_seat->keyboard->key->xkbInfo->checkRepeat = keyboard_check_repeat;
-    master = GetMaster(xwl_seat->keyboard, MASTER_KEYBOARD);
-    if (master)
-        master->key->xkbInfo->checkRepeat = keyboard_check_repeat;
 }
 
 static void
@@ -1262,10 +1268,10 @@ sprite_check_lost_focus(SpritePtr sprite, WindowPtr window)
      */
     if (master->lastSlave == xwl_seat->pointer &&
         xwl_seat->focus_window == NULL &&
-        xwl_seat->last_xwindow == window)
+        xwl_seat->last_xwindow != NullWindow &&
+        IsParent(xwl_seat->last_xwindow, window))
         return TRUE;
 
-    xwl_seat->last_xwindow = window;
     return FALSE;
 }
 

hw/xwayland/xwayland-output.c

@@ -31,6 +31,12 @@
 #include <randrstr.h>
 
 #define DEFAULT_DPI 96
+#define ALL_ROTATIONS (RR_Rotate_0   | \
+                       RR_Rotate_90  | \
+                       RR_Rotate_180 | \
+                       RR_Rotate_270 | \
+                       RR_Reflect_X  | \
+                       RR_Reflect_Y)
 
 static Rotation
 wl_transform_to_xrandr(enum wl_output_transform transform)
@@ -102,14 +108,8 @@ output_handle_mode(void *data, struct wl_output *wl_output, uint32_t flags,
     if (!(flags & WL_OUTPUT_MODE_CURRENT))
         return;
 
-    if (xwl_output->rotation & (RR_Rotate_0 | RR_Rotate_180)) {
-        xwl_output->width = width;
-        xwl_output->height = height;
-    } else {
-        xwl_output->width = height;
-        xwl_output->height = width;
-    }
-
+    xwl_output->width = width;
+    xwl_output->height = height;
     xwl_output->refresh = refresh;
 }
 
@@ -117,11 +117,21 @@ static inline void
 output_get_new_size(struct xwl_output *xwl_output,
                     int *height, int *width)
 {
-    if (*width < xwl_output->x + xwl_output->width)
-        *width = xwl_output->x + xwl_output->width;
+    int output_width, output_height;
 
-    if (*height < xwl_output->y + xwl_output->height)
-        *height = xwl_output->y + xwl_output->height;
+    if (xwl_output->rotation & (RR_Rotate_0 | RR_Rotate_180)) {
+        output_width = xwl_output->width;
+        output_height = xwl_output->height;
+    } else {
+        output_width = xwl_output->height;
+        output_height = xwl_output->width;
+    }
+
+    if (*width < xwl_output->x + output_width)
+        *width = xwl_output->x + output_width;
+
+    if (*height < xwl_output->y + output_height)
+        *height = xwl_output->y + output_height;
 }
 
 /* Approximate some kind of mmpd (m.m. per dot) of the screen given the outputs
@@ -266,6 +276,7 @@ xwl_output_create(struct xwl_screen *xwl_screen, uint32_t id)
         ErrorF("Failed creating RandR CRTC\n");
         goto err;
     }
+    RRCrtcSetRotations (xwl_output->randr_crtc, ALL_ROTATIONS);
 
     xwl_output->randr_output = RROutputCreate(xwl_screen->screen, name,
                                               strlen(name), xwl_output);
@@ -317,7 +328,7 @@ xwl_output_remove(struct xwl_output *xwl_output)
 static Bool
 xwl_randr_get_info(ScreenPtr pScreen, Rotation * rotations)
 {
-    *rotations = 0;
+    *rotations = ALL_ROTATIONS;
 
     return TRUE;
 }

include/dix-config.h.in

@@ -125,6 +125,9 @@
 /* Build a standalone xpbproxy */
 #undef STANDALONE_XPBPROXY
 
+/* Define to 1 if you have the `bsd' library (-lbsd). */
+#undef HAVE_LIBBSD
+
 /* Define to 1 if you have the `m' library (-lm). */
 #undef HAVE_LIBM
 
@@ -161,6 +164,9 @@
 /* Define to 1 if you have the <rpcsvc/dbm.h> header file. */
 #undef HAVE_RPCSVC_DBM_H
 
+/* Define to 1 if you have the `arc4random_buf' function. */
+#undef HAVE_ARC4RANDOM_BUF
+
 /* Define to use libc SHA1 functions */
 #undef HAVE_SHA1_IN_LIBC
 
@@ -238,6 +244,9 @@
 /* Define to 1 if you have the <sys/utsname.h> header file. */
 #undef HAVE_SYS_UTSNAME_H
 
+/* Define to 1 if you have the `timingsafe_memcmp' function. */
+#undef HAVE_TIMINGSAFE_MEMCMP
+
 /* Define to 1 if you have the <tslib.h> header file. */
 #undef HAVE_TSLIB_H
 

include/dixstruct.h

@@ -143,6 +143,12 @@ extern void SmartScheduleStopTimer(void);
 /* Client has requests queued or data on the network */
 void mark_client_ready(ClientPtr client);
 
+/*
+ * Client has requests queued or data on the network, but awaits a
+ * server grab release
+ */
+void mark_client_saved_ready(ClientPtr client);
+
 /* Client has no requests queued and no data on network */
 void mark_client_not_ready(ClientPtr client);
 

include/input.h

@@ -722,6 +722,7 @@ extern _X_HIDDEN void input_constrain_cursor(DeviceIntPtr pDev, ScreenPtr screen
 extern _X_EXPORT void input_lock(void);
 extern _X_EXPORT void input_unlock(void);
 extern _X_EXPORT void input_force_unlock(void);
+extern _X_EXPORT int in_input_thread(void);
 
 extern void InputThreadPreInit(void);
 extern void InputThreadInit(void);

include/os.h

@@ -590,6 +590,11 @@ extern _X_EXPORT char *
 strndup(const char *str, size_t n);
 #endif
 
+#ifndef HAVE_TIMINGSAFE_MEMCMP
+extern _X_EXPORT int
+timingsafe_memcmp(const void *b1, const void *b2, size_t len);
+#endif
+
 /* Logging. */
 typedef enum _LogParameter {
     XLOG_FLUSH,

miext/damage/damage.c

@@ -34,6 +34,7 @@
 #include    <X11/fonts/fontstruct.h>
 #include    <X11/fonts/libxfont2.h>
 #include    "mi.h"
+#include    "mipict.h"
 #include    "regionstr.h"
 #include    "globals.h"
 #include    "gcstruct.h"
@@ -282,8 +283,10 @@ damageRegionAppend(DrawablePtr pDrawable, RegionPtr pRegion, Bool clip,
 }
 
 static void
-damageRegionProcessPending(DamagePtr pDamage)
+damageRegionProcessPending(DrawablePtr pDrawable)
 {
+    drawableDamage(pDrawable);
+
     for (; pDamage != NULL; pDamage = pDamage->pNext) {
         if (pDamage->reportAfter) {
             /* It's possible that there is only interest in postRendering reporting. */
@@ -358,7 +361,6 @@ damageCreateGC(GCPtr pGC)
 
 #define DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable) \
     damageGCPriv(pGC);  \
-    drawableDamage(pDrawable); \
     const GCFuncs *oldFuncs = pGC->funcs; \
     unwrap(pGCPriv, pGC, funcs);  \
     unwrap(pGCPriv, pGC, ops); \
@@ -456,7 +458,7 @@ damageDestroyClip(GCPtr pGC)
 #define BOX_NOT_EMPTY(box) \
     (((box.x2 - box.x1) > 0) && ((box.y2 - box.y1) > 0))
 
-#define checkGCDamage(d,g)	(d && \
+#define checkGCDamage(d,g)	(getDrawableDamage(d) && \
 				 (!g->pCompositeClip ||\
 				  RegionNotEmpty(g->pCompositeClip)))
 
@@ -468,7 +470,8 @@ damageDestroyClip(GCPtr pGC)
     if(box.y2 > extents->y2) box.y2 = extents->y2; \
     }
 
-#define checkPictureDamage(d, p) (d && RegionNotEmpty(p->pCompositeClip))
+#define checkPictureDamage(p)	(getDrawableDamage(p->pDrawable) && \
+				 RegionNotEmpty(p->pCompositeClip))
 
 static void
 damageComposite(CARD8 op,
@@ -485,9 +488,8 @@ damageComposite(CARD8 op,
     PictureScreenPtr ps = GetPictureScreen(pScreen);
 
     damageScrPriv(pScreen);
-    drawableDamage(pDst->pDrawable);
 
-    if (checkPictureDamage(pDamage, pDst)) {
+    if (checkPictureDamage(pDst)) {
         BoxRec box;
 
         box.x1 = xDst + pDst->pDrawable->x;
@@ -498,13 +500,22 @@ damageComposite(CARD8 op,
         if (BOX_NOT_EMPTY(box))
             damageDamageBox(pDst->pDrawable, &box, pDst->subWindowMode);
     }
+    /*
+     * Validating a source picture bound to a window may trigger other
+     * composite operations. Do it before unwrapping to make sure damage
+     * is reported correctly.
+     */
+    if (pSrc->pDrawable && WindowDrawable(pSrc->pDrawable->type))
+        miCompositeSourceValidate(pSrc);
+    if (pMask && pMask->pDrawable && WindowDrawable(pMask->pDrawable->type))
+        miCompositeSourceValidate(pMask);
     unwrap(pScrPriv, ps, Composite);
     (*ps->Composite) (op,
                       pSrc,
                       pMask,
                       pDst,
                       xSrc, ySrc, xMask, yMask, xDst, yDst, width, height);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDst->pDrawable);
     wrap(pScrPriv, ps, Composite, damageComposite);
 }
 
@@ -520,9 +531,8 @@ damageGlyphs(CARD8 op,
     PictureScreenPtr ps = GetPictureScreen(pScreen);
 
     damageScrPriv(pScreen);
-    drawableDamage(pDst->pDrawable);
 
-    if (checkPictureDamage(pDamage, pDst)) {
+    if (checkPictureDamage(pDst)) {
         int nlistTmp = nlist;
         GlyphListPtr listTmp = list;
         GlyphPtr *glyphsTmp = glyphs;
@@ -567,7 +577,7 @@ damageGlyphs(CARD8 op,
     }
     unwrap(pScrPriv, ps, Glyphs);
     (*ps->Glyphs) (op, pSrc, pDst, maskFormat, xSrc, ySrc, nlist, list, glyphs);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDst->pDrawable);
     wrap(pScrPriv, ps, Glyphs, damageGlyphs);
 }
 
@@ -579,9 +589,8 @@ damageAddTraps(PicturePtr pPicture,
     PictureScreenPtr ps = GetPictureScreen(pScreen);
 
     damageScrPriv(pScreen);
-    drawableDamage(pPicture->pDrawable);
 
-    if (checkPictureDamage(pDamage, pPicture)) {
+    if (checkPictureDamage(pPicture)) {
         BoxRec box;
         int i;
         int x, y;
@@ -616,7 +625,7 @@ damageAddTraps(PicturePtr pPicture,
     }
     unwrap(pScrPriv, ps, AddTraps);
     (*ps->AddTraps) (pPicture, x_off, y_off, ntrap, traps);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pPicture->pDrawable);
     wrap(pScrPriv, ps, AddTraps, damageAddTraps);
 }
 
@@ -628,7 +637,7 @@ damageFillSpans(DrawablePtr pDrawable,
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
 
-    if (npt && checkGCDamage(pDamage, pGC)) {
+    if (npt && checkGCDamage(pDrawable, pGC)) {
         int nptTmp = npt;
         DDXPointPtr pptTmp = ppt;
         int *pwidthTmp = pwidth;
@@ -664,7 +673,7 @@ damageFillSpans(DrawablePtr pDrawable,
 
     (*pGC->ops->FillSpans) (pDrawable, pGC, npt, ppt, pwidth, fSorted);
 
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -676,7 +685,7 @@ damageSetSpans(DrawablePtr pDrawable,
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
 
-    if (npt && checkGCDamage(pDamage, pGC)) {
+    if (npt && checkGCDamage(pDrawable, pGC)) {
         DDXPointPtr pptTmp = ppt;
         int *pwidthTmp = pwidth;
         int nptTmp = npt;
@@ -710,7 +719,7 @@ damageSetSpans(DrawablePtr pDrawable,
             damageDamageBox(pDrawable, &box, pGC->subWindowMode);
     }
     (*pGC->ops->SetSpans) (pDrawable, pGC, pcharsrc, ppt, pwidth, npt, fSorted);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -722,7 +731,7 @@ damagePutImage(DrawablePtr pDrawable,
                int y, int w, int h, int leftPad, int format, char *pImage)
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
-    if (checkGCDamage(pDamage, pGC)) {
+    if (checkGCDamage(pDrawable, pGC)) {
         BoxRec box;
 
         box.x1 = x + pDrawable->x;
@@ -736,7 +745,7 @@ damagePutImage(DrawablePtr pDrawable,
     }
     (*pGC->ops->PutImage) (pDrawable, pGC, depth, x, y, w, h,
                            leftPad, format, pImage);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -750,7 +759,7 @@ damageCopyArea(DrawablePtr pSrc,
 
     DAMAGE_GC_OP_PROLOGUE(pGC, pDst);
 
-    if (checkGCDamage(pDamage, pGC)) {
+    if (checkGCDamage(pDst, pGC)) {
         BoxRec box;
 
         box.x1 = dstx + pDst->x;
@@ -765,7 +774,7 @@ damageCopyArea(DrawablePtr pSrc,
 
     ret = (*pGC->ops->CopyArea) (pSrc, pDst,
                                  pGC, srcx, srcy, width, height, dstx, dsty);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDst);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDst);
     return ret;
 }
@@ -783,7 +792,7 @@ damageCopyPlane(DrawablePtr pSrc,
 
     DAMAGE_GC_OP_PROLOGUE(pGC, pDst);
 
-    if (checkGCDamage(pDamage, pGC)) {
+    if (checkGCDamage(pDst, pGC)) {
         BoxRec box;
 
         box.x1 = dstx + pDst->x;
@@ -799,7 +808,7 @@ damageCopyPlane(DrawablePtr pSrc,
     ret = (*pGC->ops->CopyPlane) (pSrc, pDst,
                                   pGC, srcx, srcy, width, height, dstx, dsty,
                                   bitPlane);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDst);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDst);
     return ret;
 }
@@ -810,7 +819,7 @@ damagePolyPoint(DrawablePtr pDrawable,
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
 
-    if (npt && checkGCDamage(pDamage, pGC)) {
+    if (npt && checkGCDamage(pDrawable, pGC)) {
         BoxRec box;
         int nptTmp = npt;
         xPoint *pptTmp = ppt;
@@ -840,7 +849,7 @@ damagePolyPoint(DrawablePtr pDrawable,
             damageDamageBox(pDrawable, &box, pGC->subWindowMode);
     }
     (*pGC->ops->PolyPoint) (pDrawable, pGC, mode, npt, ppt);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -850,7 +859,7 @@ damagePolylines(DrawablePtr pDrawable,
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
 
-    if (npt && checkGCDamage(pDamage, pGC)) {
+    if (npt && checkGCDamage(pDrawable, pGC)) {
         int nptTmp = npt;
         DDXPointPtr pptTmp = ppt;
         BoxRec box;
@@ -913,7 +922,7 @@ damagePolylines(DrawablePtr pDrawable,
             damageDamageBox(pDrawable, &box, pGC->subWindowMode);
     }
     (*pGC->ops->Polylines) (pDrawable, pGC, mode, npt, ppt);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -922,7 +931,7 @@ damagePolySegment(DrawablePtr pDrawable, GCPtr pGC, int nSeg, xSegment * pSeg)
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
 
-    if (nSeg && checkGCDamage(pDamage, pGC)) {
+    if (nSeg && checkGCDamage(pDrawable, pGC)) {
         BoxRec box;
         int extra = pGC->lineWidth;
         int nsegTmp = nSeg;
@@ -992,7 +1001,7 @@ damagePolySegment(DrawablePtr pDrawable, GCPtr pGC, int nSeg, xSegment * pSeg)
             damageDamageBox(pDrawable, &box, pGC->subWindowMode);
     }
     (*pGC->ops->PolySegment) (pDrawable, pGC, nSeg, pSeg);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -1002,7 +1011,7 @@ damagePolyRectangle(DrawablePtr pDrawable,
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
 
-    if (nRects && checkGCDamage(pDamage, pGC)) {
+    if (nRects && checkGCDamage(pDrawable, pGC)) {
         BoxRec box;
         int offset1, offset2, offset3;
         int nRectsTmp = nRects;
@@ -1051,7 +1060,7 @@ damagePolyRectangle(DrawablePtr pDrawable,
         }
     }
     (*pGC->ops->PolyRectangle) (pDrawable, pGC, nRects, pRects);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -1060,7 +1069,7 @@ damagePolyArc(DrawablePtr pDrawable, GCPtr pGC, int nArcs, xArc * pArcs)
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
 
-    if (nArcs && checkGCDamage(pDamage, pGC)) {
+    if (nArcs && checkGCDamage(pDrawable, pGC)) {
         int extra = pGC->lineWidth >> 1;
         BoxRec box;
         int nArcsTmp = nArcs;
@@ -1098,7 +1107,7 @@ damagePolyArc(DrawablePtr pDrawable, GCPtr pGC, int nArcs, xArc * pArcs)
             damageDamageBox(pDrawable, &box, pGC->subWindowMode);
     }
     (*pGC->ops->PolyArc) (pDrawable, pGC, nArcs, pArcs);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -1108,7 +1117,7 @@ damageFillPolygon(DrawablePtr pDrawable,
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
 
-    if (npt > 2 && checkGCDamage(pDamage, pGC)) {
+    if (npt > 2 && checkGCDamage(pDrawable, pGC)) {
         DDXPointPtr pptTmp = ppt;
         int nptTmp = npt;
         BoxRec box;
@@ -1157,7 +1166,7 @@ damageFillPolygon(DrawablePtr pDrawable,
     }
 
     (*pGC->ops->FillPolygon) (pDrawable, pGC, shape, mode, npt, ppt);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -1166,7 +1175,7 @@ damagePolyFillRect(DrawablePtr pDrawable,
                    GCPtr pGC, int nRects, xRectangle *pRects)
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
-    if (nRects && checkGCDamage(pDamage, pGC)) {
+    if (nRects && checkGCDamage(pDrawable, pGC)) {
         BoxRec box;
         xRectangle *pRectsTmp = pRects;
         int nRectsTmp = nRects;
@@ -1193,7 +1202,7 @@ damagePolyFillRect(DrawablePtr pDrawable,
             damageDamageBox(pDrawable, &box, pGC->subWindowMode);
     }
     (*pGC->ops->PolyFillRect) (pDrawable, pGC, nRects, pRects);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -1202,7 +1211,7 @@ damagePolyFillArc(DrawablePtr pDrawable, GCPtr pGC, int nArcs, xArc * pArcs)
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
 
-    if (nArcs && checkGCDamage(pDamage, pGC)) {
+    if (nArcs && checkGCDamage(pDrawable, pGC)) {
         BoxRec box;
         int nArcsTmp = nArcs;
         xArc *pArcsTmp = pArcs;
@@ -1229,7 +1238,7 @@ damagePolyFillArc(DrawablePtr pDrawable, GCPtr pGC, int nArcs, xArc * pArcs)
             damageDamageBox(pDrawable, &box, pGC->subWindowMode);
     }
     (*pGC->ops->PolyFillArc) (pDrawable, pGC, nArcs, pArcs);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -1278,9 +1287,12 @@ damageDamageChars(DrawablePtr pDrawable,
 #define TT_IMAGE16 3
 
 static void
-damageText(DrawablePtr pDrawable, GCPtr pGC, int x, int y, unsigned long count,
-           char *chars, FontEncoding fontEncoding, DamagePtr pDamage,
-           Bool textType)
+damageText(DrawablePtr pDrawable,
+           GCPtr pGC,
+           int x,
+           int y,
+           unsigned long count,
+           char *chars, FontEncoding fontEncoding, Bool textType)
 {
     CharInfoPtr *charinfo;
     unsigned long i;
@@ -1289,7 +1301,7 @@ damageText(DrawablePtr pDrawable, GCPtr pGC, int x, int y, unsigned long count,
 
     imageblt = (textType == TT_IMAGE8) || (textType == TT_IMAGE16);
 
-    if (!pDamage)
+    if (!checkGCDamage(pDrawable, pGC))
         return;
 
     charinfo = xallocarray(count, sizeof(CharInfoPtr));
@@ -1314,9 +1326,9 @@ damagePolyText8(DrawablePtr pDrawable,
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
     damageText(pDrawable, pGC, x, y, (unsigned long) count, chars, Linear8Bit,
-               pDamage, TT_POLY8);
+               TT_POLY8);
     x = (*pGC->ops->PolyText8) (pDrawable, pGC, x, y, count, chars);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
     return x;
 }
@@ -1328,9 +1340,9 @@ damagePolyText16(DrawablePtr pDrawable,
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
     damageText(pDrawable, pGC, x, y, (unsigned long) count, (char *) chars,
                FONTLASTROW(pGC->font) == 0 ? Linear16Bit : TwoD16Bit,
-               pDamage, TT_POLY16);
+               TT_POLY16);
     x = (*pGC->ops->PolyText16) (pDrawable, pGC, x, y, count, chars);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
     return x;
 }
@@ -1341,9 +1353,9 @@ damageImageText8(DrawablePtr pDrawable,
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
     damageText(pDrawable, pGC, x, y, (unsigned long) count, chars, Linear8Bit,
-               pDamage, TT_IMAGE8);
+               TT_IMAGE8);
     (*pGC->ops->ImageText8) (pDrawable, pGC, x, y, count, chars);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -1354,9 +1366,9 @@ damageImageText16(DrawablePtr pDrawable,
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
     damageText(pDrawable, pGC, x, y, (unsigned long) count, (char *) chars,
                FONTLASTROW(pGC->font) == 0 ? Linear16Bit : TwoD16Bit,
-               pDamage, TT_IMAGE16);
+               TT_IMAGE16);
     (*pGC->ops->ImageText16) (pDrawable, pGC, x, y, count, chars);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -1371,7 +1383,7 @@ damageImageGlyphBlt(DrawablePtr pDrawable,
     damageDamageChars(pDrawable, pGC->font, x + pDrawable->x, y + pDrawable->y,
                       nglyph, ppci, TRUE, pGC->subWindowMode);
     (*pGC->ops->ImageGlyphBlt) (pDrawable, pGC, x, y, nglyph, ppci, pglyphBase);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -1386,7 +1398,7 @@ damagePolyGlyphBlt(DrawablePtr pDrawable,
     damageDamageChars(pDrawable, pGC->font, x + pDrawable->x, y + pDrawable->y,
                       nglyph, ppci, FALSE, pGC->subWindowMode);
     (*pGC->ops->PolyGlyphBlt) (pDrawable, pGC, x, y, nglyph, ppci, pglyphBase);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -1396,7 +1408,7 @@ damagePushPixels(GCPtr pGC,
                  DrawablePtr pDrawable, int dx, int dy, int xOrg, int yOrg)
 {
     DAMAGE_GC_OP_PROLOGUE(pGC, pDrawable);
-    if (checkGCDamage(pDamage, pGC)) {
+    if (checkGCDamage(pDrawable, pGC)) {
         BoxRec box;
 
         box.x1 = xOrg;
@@ -1415,7 +1427,7 @@ damagePushPixels(GCPtr pGC,
             damageDamageBox(pDrawable, &box, pGC->subWindowMode);
     }
     (*pGC->ops->PushPixels) (pGC, pBitMap, pDrawable, dx, dy, xOrg, yOrg);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
     DAMAGE_GC_OP_EPILOGUE(pGC, pDrawable);
 }
 
@@ -1480,7 +1492,6 @@ damageCopyWindow(WindowPtr pWindow, DDXPointRec ptOldOrg, RegionPtr prgnSrc)
     ScreenPtr pScreen = pWindow->drawable.pScreen;
 
     damageScrPriv(pScreen);
-    drawableDamage(&pWindow->drawable);
 
     if (getWindowDamage(pWindow)) {
         int dx = pWindow->drawable.x - ptOldOrg.x;
@@ -1496,7 +1507,7 @@ damageCopyWindow(WindowPtr pWindow, DDXPointRec ptOldOrg, RegionPtr prgnSrc)
     }
     unwrap(pScrPriv, pScreen, CopyWindow);
     (*pScreen->CopyWindow) (pWindow, ptOldOrg, prgnSrc);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(&pWindow->drawable);
     wrap(pScrPriv, pScreen, CopyWindow, damageCopyWindow);
 }
 
@@ -1870,22 +1881,20 @@ DamageRegionAppend(DrawablePtr pDrawable, RegionPtr pRegion)
 void
 DamageRegionProcessPending(DrawablePtr pDrawable)
 {
-    drawableDamage(pDrawable);
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
 }
 
 /* This call is very odd, i'm leaving it intact for API sake, but please don't use it. */
 void
 DamageDamageRegion(DrawablePtr pDrawable, RegionPtr pRegion)
 {
-    drawableDamage(pDrawable);
     damageRegionAppend(pDrawable, pRegion, FALSE, -1);
 
     /* Go back and report this damage for DamagePtrs with reportAfter set, since
      * this call isn't part of an in-progress drawing op in the call chain and
      * the DDX probably just wants to know about it right away.
      */
-    damageRegionProcessPending(pDamage);
+    damageRegionProcessPending(pDrawable);
 }
 
 void

os/Makefile.am

@@ -58,12 +58,12 @@ EXTRA_DIST = $(SECURERPC_SRCS) $(XDMCP_SRCS)
 
 if SPECIAL_DTRACE_OBJECTS
 # Generate dtrace object code for probes in libos & libdix
-dtrace.o: $(top_srcdir)/dix/Xserver.d $(am_libos_la_OBJECTS)
+dtrace.o: $(top_srcdir)/dix/Xserver.d libos.la
 	$(AM_V_GEN)$(DTRACE) -G -C -o $@ -s $(top_srcdir)/dix/Xserver.d .libs/*.o ../dix/.libs/*.o
 
 noinst_PROGRAMS = os.O
 
 os_O_SOURCES =
-os.O: dtrace.o $(am_libos_la_OBJECTS)
+os.O: dtrace.o libos.la
 	$(AM_V_GEN)ld -r -o $@ dtrace.o .libs/*.o
 endif

os/WaitFor.c

@@ -143,7 +143,7 @@ check_timers(void)
 {
     OsTimerPtr timer;
 
-    while ((timer = first_timer()) != NULL) {
+    if ((timer = first_timer()) != NULL) {
         CARD32 now = GetTimeInMillis();
         int timeout = timer->expires - now;
 
@@ -157,6 +157,8 @@ check_timers(void)
             /* time has rewound.  reset the timers. */
             CheckAllTimers();
         }
+
+        return 0;
     }
     return -1;
 }

os/auth.c

@@ -45,6 +45,9 @@ from The Open Group.
 #ifdef WIN32
 #include    <X11/Xw32defs.h>
 #endif
+#ifdef HAVE_LIBBSD
+#include   <bsd/stdlib.h>       /* for arc4random_buf() */
+#endif
 
 struct protocol {
     unsigned short name_length;
@@ -52,7 +55,6 @@ struct protocol {
     AuthAddCFunc Add;           /* new authorization data */
     AuthCheckFunc Check;        /* verify client authorization data */
     AuthRstCFunc Reset;         /* delete all authorization data entries */
-    AuthToIDFunc ToID;          /* convert cookie to ID */
     AuthFromIDFunc FromID;      /* convert ID to cookie */
     AuthRemCFunc Remove;        /* remove a specific cookie */
 #ifdef XCSECURITY
@@ -63,7 +65,7 @@ struct protocol {
 static struct protocol protocols[] = {
     {(unsigned short) 18, "MIT-MAGIC-COOKIE-1",
      MitAddCookie, MitCheckCookie, MitResetCookie,
-     MitToID, MitFromID, MitRemoveCookie,
+     MitFromID, MitRemoveCookie,
 #ifdef XCSECURITY
      MitGenerateCookie
 #endif
@@ -71,7 +73,7 @@ static struct protocol protocols[] = {
 #ifdef HASXDMAUTH
     {(unsigned short) 19, "XDM-AUTHORIZATION-1",
      XdmAddCookie, XdmCheckCookie, XdmResetCookie,
-     XdmToID, XdmFromID, XdmRemoveCookie,
+     XdmFromID, XdmRemoveCookie,
 #ifdef XCSECURITY
      NULL
 #endif
@@ -80,7 +82,7 @@ static struct protocol protocols[] = {
 #ifdef SECURE_RPC
     {(unsigned short) 9, "SUN-DES-1",
      SecureRPCAdd, SecureRPCCheck, SecureRPCReset,
-     SecureRPCToID, SecureRPCFromID, SecureRPCRemove,
+     SecureRPCFromID, SecureRPCRemove,
 #ifdef XCSECURITY
      NULL
 #endif
@@ -303,11 +305,15 @@ GenerateAuthorization(unsigned name_length,
 void
 GenerateRandomData(int len, char *buf)
 {
+#ifdef HAVE_ARC4RANDOM_BUF
+    arc4random_buf(buf, len);
+#else
     int fd;
 
     fd = open("/dev/urandom", O_RDONLY);
     read(fd, buf, len);
     close(fd);
+#endif
 }
 
 #endif                          /* XCSECURITY */

os/busfault.c

@@ -98,15 +98,16 @@ static void
 busfault_sigaction(int sig, siginfo_t *info, void *param)
 {
     void                *fault = info->si_addr;
-    struct busfault     *busfault = NULL;
+    struct busfault     *iter, *busfault = NULL;
     void                *new_addr;
 
     /* Locate the faulting address in our list of shared segments
      */
-    xorg_list_for_each_entry(busfault, &busfaults, list) {
-        if ((char *) busfault->addr <= (char *) fault && (char *) fault < (char *) busfault->addr + busfault->size) {
-            break;
-        }
+    xorg_list_for_each_entry(iter, &busfaults, list) {
+	if ((char *) iter->addr <= (char *) fault && (char *) fault < (char *) iter->addr + iter->size) {
+	    busfault = iter;
+	    break;
+	}
     }
     if (!busfault)
         goto panic;
@@ -132,7 +133,7 @@ panic:
     if (previous_busfault_sigaction)
         (*previous_busfault_sigaction)(sig, info, param);
     else
-        FatalError("bus error");
+        FatalError("bus error\n");
 }
 
 Bool

os/connection.c

@@ -1067,6 +1067,10 @@ AttendClient(ClientPtr client)
     set_poll_client(client);
     if (listen_to_client(client))
         mark_client_ready(client);
+    else {
+        /* grab active, mark ready when grab goes away */
+        mark_client_saved_ready(client);
+    }
 }
 
 /* make client impervious to grabs; assume only executing client calls this */

os/inputthread.c

@@ -90,6 +90,13 @@ static pthread_mutex_t input_mutex;
 static Bool input_mutex_initialized;
 #endif
 
+int
+in_input_thread(void)
+{
+    return inputThreadInfo &&
+           pthread_equal(pthread_self(), inputThreadInfo->thread);
+}
+
 void
 input_lock(void)
 {
@@ -529,6 +536,7 @@ void input_force_unlock(void) {}
 void InputThreadPreInit(void) {}
 void InputThreadInit(void) {}
 void InputThreadFini(void) {}
+int in_input_thread(void) { return 0; }
 
 int InputThreadRegisterDev(int fd,
                            NotifyFdProcPtr readInputProc,

os/io.c

@@ -652,6 +652,9 @@ WriteToClient(ClientPtr who, int count, const void *__buf)
     int padBytes;
     const char *buf = __buf;
 
+    BUG_RETURN_VAL_MSG(in_input_thread(), 0,
+                       "******** %s called from input thread *********\n", __func__);
+
 #ifdef DEBUG_COMMUNICATION
     Bool multicount = FALSE;
 #endif

os/mitauth.c

@@ -76,7 +76,7 @@ MitCheckCookie(unsigned short data_length,
 
     for (auth = mit_auth; auth; auth = auth->next) {
         if (data_length == auth->len &&
-            memcmp(data, auth->data, (int) data_length) == 0)
+            timingsafe_memcmp(data, auth->data, (int) data_length) == 0)
             return auth->id;
     }
     *reason = "Invalid MIT-MAGIC-COOKIE-1 key";
@@ -97,19 +97,6 @@ MitResetCookie(void)
     return 0;
 }
 
-XID
-MitToID(unsigned short data_length, char *data)
-{
-    struct auth *auth;
-
-    for (auth = mit_auth; auth; auth = auth->next) {
-        if (data_length == auth->len &&
-            memcmp(data, auth->data, data_length) == 0)
-            return auth->id;
-    }
-    return (XID) -1;
-}
-
 int
 MitFromID(XID id, unsigned short *data_lenp, char **datap)
 {

os/osdep.h

@@ -113,9 +113,6 @@ typedef int (*AuthRemCFunc) (AuthRemCArgs);
 #define AuthRstCArgs void
 typedef int (*AuthRstCFunc) (AuthRstCArgs);
 
-#define AuthToIDArgs unsigned short data_length, char *data
-typedef XID (*AuthToIDFunc) (AuthToIDArgs);
-
 typedef void (*OsCloseFunc) (ClientPtr);
 
 typedef int (*OsFlushFunc) (ClientPtr who, struct _osComm * oc, char *extraBuf,
@@ -185,7 +182,6 @@ extern void GenerateRandomData(int len, char *buf);
 /* in mitauth.c */
 extern XID MitCheckCookie(AuthCheckArgs);
 extern XID MitGenerateCookie(AuthGenCArgs);
-extern XID MitToID(AuthToIDArgs);
 extern int MitAddCookie(AuthAddCArgs);
 extern int MitFromID(AuthFromIDArgs);
 extern int MitRemoveCookie(AuthRemCArgs);
@@ -194,7 +190,6 @@ extern int MitResetCookie(AuthRstCArgs);
 /* in xdmauth.c */
 #ifdef HASXDMAUTH
 extern XID XdmCheckCookie(AuthCheckArgs);
-extern XID XdmToID(AuthToIDArgs);
 extern int XdmAddCookie(AuthAddCArgs);
 extern int XdmFromID(AuthFromIDArgs);
 extern int XdmRemoveCookie(AuthRemCArgs);
@@ -205,7 +200,6 @@ extern int XdmResetCookie(AuthRstCArgs);
 #ifdef SECURE_RPC
 extern void SecureRPCInit(AuthInitArgs);
 extern XID SecureRPCCheck(AuthCheckArgs);
-extern XID SecureRPCToID(AuthToIDArgs);
 extern int SecureRPCAdd(AuthAddCArgs);
 extern int SecureRPCFromID(AuthFromIDArgs);
 extern int SecureRPCRemove(AuthRemCArgs);

os/rpcauth.c

@@ -175,12 +175,6 @@ SecureRPCReset(void)
     return 1;
 }
 
-_X_HIDDEN XID
-SecureRPCToID(unsigned short data_length, char *data)
-{
-    return rpc_id;
-}
-
 _X_HIDDEN int
 SecureRPCFromID(XID id, unsigned short *data_lenp, char **datap)
 {

os/timingsafe_memcmp.c

@@ -0,0 +1,48 @@
+/*
+ * Copyright (c) 2014 Google Inc.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <limits.h>
+#include <string.h>
+#include <X11/Xfuncproto.h>
+#include <dix-config.h>
+#include "os.h"
+
+int
+timingsafe_memcmp(const void *b1, const void *b2, size_t len)
+{
+        const unsigned char *p1 = b1, *p2 = b2;
+        size_t i;
+        int res = 0, done = 0;
+
+        for (i = 0; i < len; i++) {
+                /* lt is -1 if p1[i] < p2[i]; else 0. */
+                int lt = (p1[i] - p2[i]) >> CHAR_BIT;
+
+                /* gt is -1 if p1[i] > p2[i]; else 0. */
+                int gt = (p2[i] - p1[i]) >> CHAR_BIT;
+
+                /* cmp is 1 if p1[i] > p2[i]; -1 if p1[i] < p2[i]; else 0. */
+                int cmp = lt - gt;
+
+                /* set res = cmp if !done. */
+                res |= cmp & ~done;
+
+                /* set done if p1[i] != p2[i]. */
+                done |= lt | gt;
+        }
+
+        return (res);
+}

os/xdmauth.c

@@ -411,33 +411,6 @@ XdmResetCookie(void)
     return 1;
 }
 
-XID
-XdmToID(unsigned short cookie_length, char *cookie)
-{
-    XdmAuthorizationPtr auth;
-    XdmClientAuthPtr client;
-    unsigned char *plain;
-
-    plain = malloc(cookie_length);
-    if (!plain)
-        return (XID) -1;
-    for (auth = xdmAuth; auth; auth = auth->next) {
-        XdmcpUnwrap((unsigned char *) cookie, (unsigned char *) &auth->key,
-                    plain, cookie_length);
-        if ((client =
-             XdmAuthorizationValidate(plain, cookie_length, &auth->rho, NULL,
-                                      NULL)) != NULL) {
-            free(client);
-            free(cookie);
-            free(plain);
-            return auth->id;
-        }
-    }
-    free(cookie);
-    free(plain);
-    return (XID) -1;
-}
-
 int
 XdmFromID(XID id, unsigned short *data_lenp, char **datap)
 {

present/present.c

@@ -117,6 +117,18 @@ present_flip_pending_pixmap(ScreenPtr screen)
     return screen_priv->flip_pending->pixmap;
 }
 
+static Bool
+present_check_output_slaves_active(ScreenPtr pScreen)
+{
+    ScreenPtr pSlave;
+
+    xorg_list_for_each_entry(pSlave, &pScreen->slave_list, slave_head) {
+        if (RRHasScanoutPixmap(pSlave))
+            return TRUE;
+    }
+    return FALSE;
+}
+
 static Bool
 present_check_flip(RRCrtcPtr    crtc,
                    WindowPtr    window,
@@ -145,7 +157,7 @@ present_check_flip(RRCrtcPtr    crtc,
         return FALSE;
 
     /* Fail to flip if we have slave outputs */
-    if (screen->output_slaves)
+    if (screen->output_slaves && present_check_output_slaves_active(screen))
         return FALSE;
 
     /* Make sure the window hasn't been redirected with Composite */
@@ -536,7 +548,10 @@ present_event_notify(uint64_t event_id, uint64_t ust, uint64_t msc)
     }
     xorg_list_for_each_entry(vblank, &present_flip_queue, event_queue) {
         if (vblank->event_id == event_id) {
-            present_flip_notify(vblank, ust, msc);
+            if (vblank->queued)
+                present_execute(vblank, ust, msc);
+            else
+                present_flip_notify(vblank, ust, msc);
             return;
         }
     }

randr/rrcrtc.c

@@ -686,8 +686,14 @@ rrCheckPixmapBounding(ScreenPtr pScreen,
     }
 
     newsize = RegionExtents(&total_region);
-    new_width = newsize->x2 - newsize->x1;
-    new_height = newsize->y2 - newsize->y1;
+    new_width = newsize->x2;
+    new_height = newsize->y2;
+
+    if (new_width < screen_pixmap->drawable.width)
+        new_width = screen_pixmap->drawable.width;
+
+    if (new_height < screen_pixmap->drawable.height)
+        new_height = screen_pixmap->drawable.height;
 
     if (new_width == screen_pixmap->drawable.width &&
         new_height == screen_pixmap->drawable.height) {

randr/rrprovider.c

@@ -338,6 +338,9 @@ ProcRRSetProviderOutputSource(ClientPtr client)
     pScreen = provider->pScreen;
     pScrPriv = rrGetScrPriv(pScreen);
 
+    if (!pScreen->isGPU)
+        return BadValue;
+
     pScrPriv->rrProviderSetOutputSource(pScreen, provider, source_provider);
 
     RRInitPrimeSyncProps(pScreen);

randr/rrxinerama.c

@@ -260,6 +260,13 @@ RRXineramaWriteMonitor(ClientPtr client, RRMonitorPtr monitor)
     scratch.width = monitor->geometry.box.x2 - monitor->geometry.box.x1;
     scratch.height = monitor->geometry.box.y2 - monitor->geometry.box.y1;
 
+    if (client->swapped) {
+        swaps(&scratch.x_org);
+        swaps(&scratch.y_org);
+        swaps(&scratch.width);
+        swaps(&scratch.height);
+    }
+
     WriteToClient(client, sz_XineramaScreenInfo, &scratch);
 }
 

render/render.c

@@ -1908,6 +1908,8 @@ ProcRenderCreateRadialGradient(ClientPtr client)
     LEGAL_NEW_RESOURCE(stuff->pid, client);
 
     len = (client->req_len << 2) - sizeof(xRenderCreateRadialGradientReq);
+    if (stuff->nStops > UINT32_MAX / (sizeof(xFixed) + sizeof(xRenderColor)))
+        return BadLength;
     if (len != stuff->nStops * (sizeof(xFixed) + sizeof(xRenderColor)))
         return BadLength;
 
@@ -1946,6 +1948,8 @@ ProcRenderCreateConicalGradient(ClientPtr client)
     LEGAL_NEW_RESOURCE(stuff->pid, client);
 
     len = (client->req_len << 2) - sizeof(xRenderCreateConicalGradientReq);
+    if (stuff->nStops > UINT32_MAX / (sizeof(xFixed) + sizeof(xRenderColor)))
+        return BadLength;
     if (len != stuff->nStops * (sizeof(xFixed) + sizeof(xRenderColor)))
         return BadLength;
 

test/Makefile.am

@@ -66,7 +66,6 @@ xfree86_LDADD=$(TEST_LDADD)
 touch_LDADD=$(TEST_LDADD)
 signal_logging_LDADD=$(TEST_LDADD)
 hashtabletest_LDADD=$(TEST_LDADD)
-os_LDADD=$(TEST_LDADD)
 
 libxservertest_la_LIBADD = $(XSERVER_LIBS)
 if XORG
@@ -167,7 +166,8 @@ libxservertest_la_DEPENDENCIES = $(libxservertest_la_LIBADD)
 endif
 
 EXTRA_DIST = \
-	$(SCRIPT_TESTS) \
+	scripts/xvfb-piglit.sh \
+	scripts/xephyr-glamor-piglit.sh \
 	scripts/xinit-piglit-session.sh \
 	scripts/run-piglit.sh \
 	ddxstubs.c \