fb: fix screen pixmap leak on server reset

Call FreePixmap() instead of free() to destroy the screen pixmap in
fbCloseScreen().

Signed-off-by: Frank Binns <frank.binns@imgtec.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
dix: reference the cursor just once in InitializeSprite()

The new current cursor was being referenced twice, resulting in a
memory leak when the current server generation ended.

Signed-off-by: Frank Binns <frank.binns@imgtec.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
dix: fix pixmap leak on server reset

The server is leaking a pixmap (created by CreateDefaultStipple()) on
reset. The leak is caused by some X Server graphics contexts not being
freed on reset by the machine independent cursor code in the server,
which in turn is caused by the cursor cleanup code
(miSpriteDeviceCursorCleanup()) not being called.

Ensures the DeviceCursorCleanup() function is called when the associated
input device is closed on server reset.

Signed-off-by: Frank Binns <frank.binns@imgtec.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
xfixes: disable cursor on X server reset

The initial state of the cursor is set to disabled but this was
never be re-disabled during X server reset. This meant any
application run after an X server reset would have the cursor
displayed even if it hadn't requested this to be the case.

Signed-off-by: Frank Binns <frank.binns@imgtec.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
present: Queue flips for later execution

When a flip (or unflip) is pending and a flip request comes in, leave
it queued until the pending flip completes and then execute it.

This fixes a bug where an application submitting back-to-back
present_pixmap requests for sequential frames would alternate between
flipping and copying as the pending flip would cause the new
present_pixmap request to not use a flip.

Signed-off-by: Keith Packard <keithp@keithp.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Tested-by: Frank Binns <frank.binns@imgtec.com>
mi: don't process events from disabled devices (#77884)

Once a device is disabled, it doesn't have a sprite pointer anymore. If an
event is still in the queue and processed after DisableDevice finished, a
dereference causes a crash. Example backtrace (crash forced by injecting an
event at the right time):

(EE) 0: /opt/xorg/bin/Xorg (OsSigHandler+0x3c) [0x48d334]
(EE) 1: /lib64/libpthread.so.0 (__restore_rt+0x0) [0x37fcc0f74f]
(EE) 2: /opt/xorg/bin/Xorg (mieqMoveToNewScreen+0x38) [0x609240]
(EE) 3: /opt/xorg/bin/Xorg (mieqProcessDeviceEvent+0xd4) [0x609389]
(EE) 4: /opt/xorg/bin/Xorg (mieqProcessInputEvents+0x206) [0x609720]
(EE) 5: /opt/xorg/bin/Xorg (ProcessInputEvents+0xd) [0x4aeb58]
(EE) 6: /opt/xorg/bin/Xorg (xf86VTSwitch+0x1a6) [0x4af457]
(EE) 7: /opt/xorg/bin/Xorg (xf86Wakeup+0x2bf) [0x4af0a7]
(EE) 8: /opt/xorg/bin/Xorg (WakeupHandler+0x83) [0x4445cb]
(EE) 9: /opt/xorg/bin/Xorg (WaitForSomething+0x3fe) [0x491bf6]
(EE) 10: /opt/xorg/bin/Xorg (Dispatch+0x97) [0x435748]
(EE) 11: /opt/xorg/bin/Xorg (dix_main+0x61d) [0x4438a9]
(EE) 12: /opt/xorg/bin/Xorg (main+0x28) [0x49ba28]
(EE) 13: /lib64/libc.so.6 (__libc_start_main+0xf5) [0x37fc821d65]
(EE) 14: /opt/xorg/bin/Xorg (_start+0x29) [0x425e69]
(EE) 15: ? (?+0x29) [0x29]

xf86VTSwitch() calls ProcessInputEvents() before disabling a device, and
DisableDevice() calls mieqProcessInputEvents() again when flushing touches and
button events. Between that and disabling the device (which causes new events
to be refused) there is a window where events may be triggered and enqueued.
On the next call to PIE that event is processed on a now defunct device,
causing the crash.

The simplest fix to this is to discard events from disabled devices. We flush
the queue often enough before disabling that when we get here, we really don't
care about the events from this device.

X.Org Bug 77884 <http://bugs.freedesktop.org/show_bug.cgi?id=77884>

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reported-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Tested-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Reviewed-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Keith Packard <keithp@keithp.com>
Update to version 1.15.99.903

Signed-off-by: Keith Packard <keithp@keithp.com>