commit dfc03ef3fda3572db590c2096272c990d434163e
Author: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
Date:   Sun Aug 26 22:11:00 2012 -0700

    configure.ac: Version bump to 1.12.4
    
    Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>

commit 8995fcf260895ad288146b78d4c42b6f3b838d4f
Author: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
Date:   Sun Aug 26 22:09:49 2012 -0700

    XQuartz: Bump version to 2.7.3
    
    Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>

commit a6d7400507f220d6f98b853def7904586fb1eadd
Author: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
Date:   Sun Aug 19 09:07:33 2012 -0700

    configure.ac: Version bump to 1.12.3.902 (1.12.4 RC2)
    
    Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>

commit 0754f74a538ca59e45a39fefa2d90b9d3bc822dd
Author: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
Date:   Thu Aug 16 19:42:54 2012 -0700

    XQuartz: console_redirect: Properly zero-out the tail of the array on realloc()
    
    We forgot to multiply by sizeof(), so it wasn't fully zeroed out.
    
    Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
    (cherry picked from commit 7c3d2e4828deb4e8ec38e8ef88d6f92b2d931033)

commit 2141f21d51b0787c8d287bb50d01a6a81e61a634
Author: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
Date:   Thu Aug 16 15:43:34 2012 -0700

    XQuartz: console_redirect: Set the correct location for reading into the buffer
    
    Prior to this change, it was possible that a large message would have some
    of its data prepended to subsequent messages due to our not incorrectly
    setting the location to write into the buffer.
    
    Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
    (cherry picked from commit a32e01802ff1c938c0afe0cc007a273b9ada8610)

commit 73d62f1aaea4a862cc512048cb6ca59586f4cdb6
Author: Keith Packard <keithp@keithp.com>
Date:   Tue Aug 7 17:49:46 2012 -0700

    Only free Render filter names on last screen close
    
    Hotplugging screens causes the render filter names to get freed while
    still in use; wait for the last core screen to be closed before
    freeing them. That only happens at server reset, when we want them to
    be freed.
    
    Signed-off-by: Keith Packard <keithp@keithp.com>
    Reviewed-by: Dave Airlie <airlied@redhat.com>
    (cherry picked from commit 19772670e3041fe1c7f5bbf32fa039a6d8245ccb)

commit 3e62f48edf47a59d923ac58b6d4262b02456a556
Author: Simon Schubert <2@0x2c.org>
Date:   Sun Aug 12 09:40:16 2012 -0700

    fb: reorder Bresenham error correction to avoid overshoot.
    
    When fbBresSolid draws a line, it can happen that after the last
    pixel, the Bresenham error term overflows, and fbBresSolid paints
    another pixel before adjusting the error term.
    
    However, if this happens on the last pixel (len=0), this extra pixel
    might overshoot the boundary, and, in rare cases, lead to a segfault.
    
    Fix this issue by adjusting for the Bresenham error term before
    drawing the main pixel, not after.
    
    Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=24274
    Signed-off-by: Simon Schubert <2@0x2c.or>
    Tested-by: Mitch Davis <mjd+freedesktop.org@afork.com>
    Signed-off-by: Matt Turner <mattst88@gmail.com>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit 863d528a9f76d0e8f122aebf19f8564a4c67a938)

commit f0823a057e4c80dbb18c16f066ad36e6459fcc85
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Tue Jul 31 16:09:38 2012 +1000

    dix: make sure the mask is set for emulated scroll events (#52508)
    
    If a device has smooth scrolling axes, but submits scroll button events, we
    convert those to motion events and update the valuators. For legacy button
    events, the valuator mask is likely unset though, causing
    add_to_scroll_valuator() to return early, leaving us with an empty mask.
    That again skipped the rest of the code and no events were generated.
    
    Fix it by making sure that the scroll valuator in the mask is at least
    initialized to 0.
    
    Broke evdev wheel emulation, introduced by
    54476b5e4461ff523e935961affabcf0de12c556.
    
    X.Org Bug 52508 <http://bugs.freedesktop.org/show_bug.cgi?id=52508>
    
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
    (cherry picked from commit cb306a8f174bec9ded95191b91797f59250e6808)

commit 1f8a958a12c1c7c684051e5679420fe3a02ce307
Author: Adam Jackson <ajax@redhat.com>
Date:   Mon Jul 23 16:34:28 2012 -0400

    sync: Fix logic error from b55bf248581dc66321b24b29f199f6dc8d02db1b
    
    That commit adds two hunks, and I _think_ they're backwards.  It adds
    code to modify bracket_greater on NegativeTransition triggers, and
    bracket_less on PositiveTransition triggers.  That breaks symmetry with
    the surrounding code; the code as of this commit could probably be
    simplified further.
    
    I can't keep the sync trigger rules in my head for more than about five
    minutes at a time, so I'm sending this on for more eyes.  RHEL 6.3's
    xserver is shipping with b55bf248 reverted:
    
        https://bugzilla.redhat.com/show_bug.cgi?id=748704#c33
    
    And there appear to be some upstream reports of the same issue:
    
        https://bugzilla.gnome.org/show_bug.cgi?id=658955
    
    So I'd like to get this sorted out.
    
    Signed-off-by: Adam Jackson <ajax@redhat.com>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit 4a6f42dda00ba3b5616f8a86f0d4c9a652c7d9d4)

commit 83cba78a0c858df4d5405783f3a1fb4bab128129
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Mon Jul 16 21:12:06 2012 -0700

    Make indentation of dix/tables.c much more consistent and readable
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    Acked-by: Daniel Stone <daniel@fooishbar.org>
    (cherry picked from commit c37c65052f674cd58894ad0b9ec22928a62c624e)

commit b6be94d89cab650ed73c5f3ca65f3a08bb79ebae
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Mon Jul 16 20:53:00 2012 -0700

    Fix up formatting of initializers for arrays of structs
    
    The indenter seems to have gotten confused by initializing arrays of
    structs with the struct defined inline - for predefined structs it did
    a better job, so match that.
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    (cherry picked from commit 9f7ef7f7f0566f6319d8328ce0a1e6d0fa866720)

commit afe8ef9043a0bc3b9322448c004b3f4ce203160a
Author: Adam Jackson <ajax@redhat.com>
Date:   Mon Jul 30 14:32:11 2012 -0400

    randr: Fix up yet another corner case in preferred mode selection
    
    Let's say - purely for the sake of argument, mind you - that you had a
    server GPU with anemic memory bandwidth, and you walked up to it and
    plugged in a monitor that was 1920x1080 because that's what happened to
    be on the crash cart.  Say the memory bandwidth is such that anything
    larger than 1280x1024 gets filtered away.  Now you're in trouble,
    because the established timings section includes a 720x400 mode because
    that's what DOS 80x25 is, and that happens to just about match the
    physical aspect ratio.
    
    Instead let's reuse the logic from the existing aspect-match path: pick
    the larger mode of either the physical aspect ratio or 4:3.
    
    Reviewed-by: Julien Cristau <jcristau@debian.org>
    Signed-off-by: Adam Jackson <ajax@redhat.com>
    Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit ff56f88616aa63797384c2c484b2bd0f194df96a)

commit af8ffefc070be8cb449812100b86501db17e8fd8
Author: Dave Airlie <airlied@redhat.com>
Date:   Mon Jul 30 14:32:10 2012 -0400

    kinput: allocate enough space for null character.
    
    This code wasn't allocating enough space and was assigning the NULL
    one past the end.
    
    Pointed out by coverity.
    
    Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
    Reviewed-by: Adam Jackson <ajax@redhat.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit 531785dd746d64ef7f473a83ca73bb20e74b6fca)

commit 3a2b67577cdf0d4e3aae28883e65cf782673198a
Author: Vic Lee <llyzs@163.com>
Date:   Mon Jul 30 14:32:09 2012 -0400

    ephyr: Resize screen automatically when parent window is resized
    
    Bugzilla: https://bugs.freedesktop.org/25804
    Reviewed-by: Adam Jackson <ajax@redhat.com>
    Signed-off-by: Vic Lee <llyzs@163.com>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit 8843aed82e7d69422e7763a35832a2be8f26723f)

commit 7749c58134022bc6718150c3bb81f18b07687674
Author: Adam Jackson <ajax@redhat.com>
Date:   Mon Jul 30 14:32:08 2012 -0400

    ephyr: Fix up some bizarre formatting
    
    Signed-off-by: Adam Jackson <ajax@redhat.com>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit b46bbafae6d0a8b3f2f7853d5c1475fc223b1ed6)

commit ab46bdec65b4b1150ffa0aa4d9f3142e7e89cef9
Author: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
Date:   Fri Aug 3 10:21:11 2012 -0700

    configure.ac: Version bump to 1.12.3.901 (1.12.4 RC1)
    
    Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>

commit 631715e12953a392066ca2a0787b37471747f879
Author: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
Date:   Wed Aug 1 18:46:08 2012 -0700

    XQuartz: Fix xp_window_bring_all_to_front linking on OS versions with older libXplugin
    
    Found-by: Tinderbox
    Signed-off-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
    (cherry picked from commit 884f51e9770c9ccd3b38a14ea393ea2c7a5ef235)

commit e2df31de390f58211029bd975e8af0169d121737
Author: Jon TURNEY <jon.turney@dronecode.org.uk>
Date:   Mon Jul 23 12:16:36 2012 +0100

    hw/xquartz: Various fixes for pseudoramiX.c
    
    Various fixes, applied to panoramiX.c in commit 2b266eda, also need applying to pseudoramiX.c:
     Fix panoramiX request and reply swapping
     Set window and screen values in panoramix replies
     Prevent buffer overrun in ProcPanoramiXGetScreenSize
    
    These fixes seem to be necessary in order to compile pseudoramiX.c with gcc
    
    pseudoramiX.c: In function 'ProcPseudoramiXGetState':
    pseudoramiX.c:221:56: error: call to 'wrong_size' declared with attribute error: wrong sized variable passed to swap
    pseudoramiX.c: In function 'ProcPseudoramiXGetScreenCount':
    pseudoramiX.c:250:62: error: call to 'wrong_size' declared with attribute error: wrong sized variable passed to swap
    pseudoramiX.c: In function 'ProcPseudoramiXGetScreenSize':
    pseudoramiX.c:283:56: error: call to 'wrong_size' declared with attribute error: wrong sized variable passed to swap
    pseudoramiX.c:284:57: error: call to 'wrong_size' declared with attribute error: wrong sized variable passed to swap
    
    Signed-off-by: Jon TURNEY <jon.turney@dronecode.org.uk>
    Reviewed-by: Jeremy Huddleston Sequoia <jeremyhu@apple.com>
    (cherry picked from commit 067931ccce592e319baffa26d4f7380d8d924537)

commit dfc943609acf73dc3946ba106bcdf6c66997a3b8
Author: Jeremy Huddleston <jeremyhu@apple.com>
Date:   Wed Jul 25 11:40:33 2012 -0700

    XQuartz: Call xp_window_bring_all_to_front if available in libXplugin
    
    Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
    (cherry picked from commit fd228d318428d0d9dea52ca560a9b66660dd2d02)

commit bfcc45861c7a2396c109fdac9b6db84d6b614db1
Author: Jeremy Huddleston <jeremyhu@apple.com>
Date:   Wed Jul 11 23:49:59 2012 -0700

    XQuartz: Fix incorrect PseudoramiXExtensionInit prototype
    
    Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
    (cherry picked from commit 1a64d3cc9c319d5e9ab2365b60469fb5b83407fc)

commit cb8fbccba79b30d0f8443d181016fa78ccce86e6
Author: Jeremy Huddleston <jeremyhu@apple.com>
Date:   Wed Jul 11 23:49:33 2012 -0700

    XQuartz: Silence an unused-variable warning
    
    Signed-off-by: Jeremy Huddleston <jeremyhu@apple.com>
    (cherry picked from commit 228f8bfe81890770f1ba109a0acca1c81a2ffee9)

commit 1b2ae1fd7a630c9100ed87bc785fa5d9a52661b0
Author: Daniel Stone <daniel@fooishbar.org>
Date:   Tue Jul 10 09:10:22 2012 +0100

    AllocDevicePair: Ensure XKB privates are initialised
    
    Since we call directly into XKB and may be doing so before the extension
    has been initialised, make sure its privates are set up first.  XTest
    had a hack to do this itself, but seems cleaner to just make sure we do
    it in AllocDevicePair.
    
    Signed-off-by: Daniel Stone <daniel@fooishbar.org>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit 59c2c4f645b4d782599c274f4bc752de9623d308)

commit fc13888f19cd068ee6485d5d7be54edfa17036a2
Author: Daniel Stone <daniel@fooishbar.org>
Date:   Tue Jul 10 02:02:52 2012 +0100

    Xinerama: Fix ExtensionInit prototype
    
    Huh, so I guess INITARGS used to be int argc, char *argv then.  Either
    way, it's now void, so fix that ...
    
    Signed-off-by: Daniel Stone <daniel@fooishbar.org>
    Reviewed-by: Cyril Brulebois <kibi@debian.org>
    Reviewed-by: Jamey Sharp <jamey@minilop.net>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit bddb8c6cbe52ba9923b1d36d01f5ac9391b0ec0e)

commit ce106ae299a5444ee7cca1b6f4b7bc3bdfe15888
Author: Daniel Stone <daniel@fooishbar.org>
Date:   Tue Jul 10 02:02:49 2012 +0100

    Xorg: Link XKB DDX library after core server libs
    
    libxorgxkb.a contains a number of libraries which are used by XKB action
    code to call back into the DDX, e.g. for VT switching, termination, grab
    breaking, et al.  Make sure libxkb.a comes first in the link order, so
    it can mark XkbDDX* as used in order for the linker to not discard them.
    
    Signed-off-by: Daniel Stone <daniel@fooishbar.org>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit 67953d6975ef2ee573b95e7641aaf3d72e9f8379)

commit 7b7db8ced263093bdcc1e57dfe7574e07cd5b63a
Author: Daniel Stone <daniel@fooishbar.org>
Date:   Tue Jul 10 02:02:46 2012 +0100

    Don't make failure to -nolisten fatal
    
    If failing to disable a protocol specified by -nolisten failed, we'd
    throw a FatalError and bomb startup entirely.  From poking at xtrans, it
    looks like the only way we can get a failure here is because we've
    specified a protocol name which doesn't exist, which probably doesn't
    constitute a security risk.
    
    And it makes it possible to start gdm even though you've built with
    --disable-tcp-transport.
    
    Signed-off-by: Daniel Stone <daniel@fooishbar.org>
    Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit 656af2c7e73d948338683675e14cd827b46a97c4)

commit af7ff8f1ccec722bc8690c6f512a986b0f3c7a9c
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Mon Jul 9 19:12:44 2012 -0700

    Initialize padding bits to 0 in ErrorConnMax()
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    Reviewed-by: Keith Packard <keithp@keithp.com>
    Tested-by: Daniel Stone <daniel@fooishbar.org>
    (cherry picked from commit 7a29f6878284e2d65e69fcd157aa9ec01d21b3c0)

commit f29c0ddd5afc4549e20d72a1d9e4c17276bb4bb1
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Mon Jul 9 19:12:44 2012 -0700

    Set padding bytes to 0 in WriteToClient
    
    Clear them out when needed instead of leaving whatever values were
    present in previously sent messages.
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    Reviewed-by: Keith Packard <keithp@keithp.com>
    Tested-by: Daniel Stone <daniel@fooishbar.org>
    (cherry picked from commit bed610fcae41ddfe21fa9acde599b17d1d15f5d1)

commit eeefadf95ed764755bfb04b107f636c6ae60bdde
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Mon Jul 9 19:12:42 2012 -0700

    Use calloc to zero fill buffers being allocated for replies & events
    
    Ensures padding bytes are zero-filled
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    Reviewed-by: Keith Packard <keithp@keithp.com>
    Tested-by: Daniel Stone <daniel@fooishbar.org>
    (cherry picked from commit cdf5bcd420e5bcf4a4a24a275d3133a4e16ce41e)

commit 8cefa9bf0766f10a1fc09a8d414e6ddfaa4addd9
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Mon Jul 9 19:12:42 2012 -0700

    xf86dga2.c & xf86vmode.c: Move REQUEST_SIZE_MATCH checks before using stuff
    
    Seems silly waiting to check if the client failed to send us enough bytes
    until after we've already tried using them.
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    Reviewed-by: Keith Packard <keithp@keithp.com>
    Tested-by: Daniel Stone <daniel@fooishbar.org>
    (cherry picked from commit ef0f701c9245b0373eb0c7a84dd804af4738bb29)

commit 18863154bdb0f4ff79b2c79eae73ddd7a6ddc764
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Mon Jul 9 19:12:42 2012 -0700

    ProcRRGetScreenInfo: swap configTimestamp as well
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    Reviewed-by: Keith Packard <keithp@keithp.com>
    Tested-by: Daniel Stone <daniel@fooishbar.org>
    (cherry picked from commit 15bc13c8d088e05f14c7262348e0066929c29251)

commit abffc882af655d2c8434e6eb7374dda472d6a8b0
Author: Jaroslav Šmíd <jardasmid@gmail.com>
Date:   Mon Jul 9 19:12:42 2012 -0700

    Bug 51375: Xorg doesn't set status for RRGetOutputInfo
    
    https://bugs.freedesktop.org/show_bug.cgi?id=51375
    https://bugs.freedesktop.org/attachment.cgi?id=63397
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    Reviewed-by: Keith Packard <keithp@keithp.com>
    Tested-by: Daniel Stone <daniel@fooishbar.org>
    (cherry picked from commit 3a013b8816bc0bb765c99e8a2bf2ea536dc62c3b)

commit 5c6c4fc0820b4f7845ec43a1b784fa566713e566
Author: Keith Packard <keithp@keithp.com>
Date:   Mon Jul 9 16:29:04 2012 -0700

    Add 'install-headers' target in the top-level Makefile
    
    This target recursively locates directories with sdk headers and
    installs them all. Useful when you want to build a complete new X
    server and drivers without having to install the X server before the
    drivers are actually working.
    
    Signed-off-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit d1c639c006526b8cab14dac582508f3f54848967)

commit 4060ebfea066693f9d9dd5fab63278ebd4951533
Author: Dave Airlie <airlied@redhat.com>
Date:   Tue Jun 19 16:01:08 2012 +0100

    xf86: cursor code got mangled by indenting
    
    This fixes some really ugly code that got mangled by the indenting.
    
    Reviewed-by: Keith Packard <keithp@keithp.com>
    Signed-off-by: Dave Airlie <airlied@redhat.com>
    (cherry picked from commit 2c52d776a42a28bb3e1463edf0cfe0672d0c08a9)

commit 31ca2e2d5d2f26826fe15d4537a57e1cbf863140
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Thu Jul 5 16:17:56 2012 +1000

    list.h: don't crash when removing an element from a NULL list
    
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit 167993254a5cbe11a1f44fad1e8ae042089c1619)

commit 7197c1c571dab1ecef2dc57b8e3bd2689b589f6d
Author: Michal Srb <msrb@suse.com>
Date:   Thu Jun 28 17:17:12 2012 +0200

    Look for ModuleData only in appropriate library
    
    LoaderSymbol calls dlsym with RTLD_DEFAULT pseudo handle making it search in
    every loaded library. In addition glibc adds NODELETE flag to the library
    containing the symbol.
    
    It's used in doLoadModule to locate <modulename>ModuleData symbol, the
    module's library gets the flag and is kept in memory even after it is
    unloaded.
    
    This patch adds LoaderSymbolFromModule function that looks for symbol only in
    library specified by handle. That way the NODELETE flag isn't added.
    
    This glibc behavior doesn't seem to be documented, but even if other
    implementations differ, there is no reason to search ModuleData symbol outside
    the module's library.
    
    Signed-off-by: Michal Srb <msrb@suse.com>
    Reviewed-by: Daniel Stone <daniel@fooishbar.org>
    
    v2: Switch LoaderSymbolFromModule arguments order.
        Correct description.
    Reviewed-by: Adam Jackson <ajax@redhat.com>
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    (cherry picked from commit 258abbf823f753757e4dddc13ef495f4024680db)

commit b0e3696e01ec69e17b74164f4b366baef316f86c
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Mon Jun 25 14:22:31 2012 +1000

    dix: fix dereference before null check
    
    Found by Coverity.
    
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Reviewed-by: Dave Airlie <airlied@redhat.com>
    (cherry picked from commit 55ff20eb37f00a3ad07b5acff19d4497ab513a97)

commit b99a4ac32cc613337af79eb130247364f478dd21
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Wed Jun 20 14:25:54 2012 +1000

    xkb: use local variable instead of casting arg
    
    No functional changes.
    
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    (cherry picked from commit 252a69b592001b34714d0fe7508e1898883f9d01)

commit 465a7a253ae36a35d2d85a990c6c50c2a26a861e
Author: Aaron Plattner <aplattner@nvidia.com>
Date:   Fri Jun 29 13:33:58 2012 -0700

    randr: Fix REQUEST vs. REQUEST_SIZE_MATCH mismatch
    
    ProcRRGetScreenSizeRange uses REQUEST(xRRGetScreenSizeRangeReq) followed by
    REQUEST_SIZE_MATCH(xRRGetScreenInfoReq).  This happens to work out because both
    requests have the same size, so this is not a functional change, just a cosmetic
    one.
    
    Signed-off-by: Aaron Plattner <aplattner@nvidia.com>
    Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit 212b9803238d2de2e77cbe5de62d3f616ae50daf)

commit 6f4b6bca4c8f823adf83519b40f02b39a0c271ed
Author: Keith Packard <keithp@keithp.com>
Date:   Thu Jun 21 18:45:18 2012 -0700

    randr: Catch two more potential unset rrScrPriv uses
    
    Ricardo Salveti <ricardo.salveti@linaro.org> found one place where the
    randr code could use the randr screen private data without checking
    for null first. This happens when the X server is running with
    multiple screens, some of which are randr enabled and some of which
    are not. Applications making protocol requests to the non-randr
    screens can cause segfaults where the server touches the unset private
    structure.
    
    I audited the code and found two more possible problem spots; the
    trick to auditing for this issue was to look for functions not taking
    a RandR data structure and where there was no null screen private
    check above them in the call graph.
    
    Signed-off-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit 855003c333a0ead1db912695bc9705ef2b3144b4)

commit 47c61c56472f885e355f4b5e932f5282c1a7b1f5
Author: Keith Packard <keithp@keithp.com>
Date:   Thu Jun 21 18:42:46 2012 -0700

    randr: Clean up compiler warnings about unused and shadowing variables
    
    set but not used variables
    shadowing a previous local
    
    A hidden problem was that the VERIFY_RR_* macros define local 'rc'
    variables, any other local definitions for those would be shadowed and
    generate warnings from gcc. I've renamed the other locals 'ret'
    instead of 'rc'.
    
    Signed-off-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit 4ba340cfaa8d430c808566495f8deda0ff1b4424)

commit ba0fe0092c25556e682d7b51fa94cafb75c00f3e
Author: Ricardo Salveti de Araujo <ricardo.salveti@linaro.org>
Date:   Thu Jun 21 00:55:53 2012 -0300

    randr: first check pScrPriv before using the pointer at RRFirstOutput
    
    Fix a seg fault in case pScrPriv is NULL at ProcRRGetScreenInfo,
    which later calls RRFirstOutput.
    
    Signed-off-by: Ricardo Salveti de Araujo <ricardo.salveti@linaro.org>
    Reviewed-by: Keith Packard <keithp@keithp.com>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit 32603f57ca03b6390b109960f8bb5ea53ac95ecb)

commit b348cfd4b85e10e1ff36344473758325201c3816
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Wed Jun 13 21:20:51 2012 -0700

    Remove obsolete tab stop comments from hw/xfree86/parser/*.c
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    (cherry picked from commit ff541e0a1f84bd98966148793f35afeaf71c271b)

commit 94c7d0f8b979ccadd8e5c95f030b8b2cd7ef6f98
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Tue Jun 12 22:38:46 2012 -0700

    Fix some overly indented/poorly line wrapped comments in dix/events.c
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    Reviewed-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit 687536b1044a3297f6b9a45f6a2d2987daa7be59)

commit 49bb2694f10149fbd27c04375939dcfe7cde1e4e
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Tue Jun 12 22:29:51 2012 -0700

    OtherClientGone: Remove unreachable return statement
    
    Now that FatalError is marked as _X_NORETURN, the compilers know we
    can't get here, and the return statement added to make them happy in
    the past now makes them unhappy.
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    Reviewed-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit 93a378aad4a4a03f37ddafccfedeb9d6e2be2a6a)

commit e08f1c261c75d50a3581e8791700436cba6e4b21
Author: Julien Cristau <jcristau@debian.org>
Date:   Mon Jul 30 19:24:38 2012 +0200

    Bump video ABI version to 12.1
    
    Track the addition of DRI2CreateDrawable2.
    
    Signed-off-by: Julien Cristau <jcristau@debian.org>

commit 953c8df9fb7515f70ee6dac7e210e909d26e1490
Author: Michel Dänzer <michel.daenzer@amd.com>
Date:   Thu Jul 12 13:16:37 2012 +0200

    glx: Free DRI2 drawable reference to destroyed GLX drawable.
    
    Otherwise the reference can lead to use after free in
    __glXDRIinvalidateBuffers().
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=50019
    
    Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
    Reviewed-by: Kristian Høgsberg <krh@bitplanet.net>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit a2d0829531249e24dbca25fc20ed30a2bb2d8ed8)
    
    Signed-off-by: Julien Cristau <jcristau@debian.org>

commit 60da5029634ca6258e4e2924ed204096437a0503
Author: Michel Dänzer <michel.daenzer@amd.com>
Date:   Thu Jul 12 13:16:36 2012 +0200

    dri2: Add DRI2CreateDrawable2.
    
    Same as DRI2CreateDrawable, except it can return the DRI2 specific XID of the
    DRI2 drawable reference to the base drawable.
    
    Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
    Reviewed-by: Kristian Høgsberg <krh@bitplanet.net>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit 8a87acc9e57be740e3bd252567622246051a0723)
    
    Signed-off-by: Julien Cristau <jcristau@debian.org>

commit cdeb178cd020bbbd0ebbdb512de1d1d16474858a
Author: Daniel Stone <daniel@fooishbar.org>
Date:   Tue Jul 10 02:03:17 2012 +0100

    DRI2: Remove prototype for DRI2DestroyDrawable
    
    DRI2DestroyDrawable() was still being _X_EXPORTed, but hasn't existed
    since 1da1f33f last year.
    
    Signed-off-by: Daniel Stone <daniel@fooishbar.org>
    Reviewed-by: Cyril Brulebois <kibi@debian.org>
    Reviewed-by: Jamey Sharp <jamey@minilop.net>
    Reviewed-by: Ian Romanick <ian.d.romanick@intel.com>
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit b8a3267c36e2e335b888bd4f2ef2f2c477cdfdce)
    
    Signed-off-by: Julien Cristau <jcristau@debian.org>

commit 60e0d205666c1fc0c818b9430c1e20428c9d3808
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Mon Jul 9 10:44:01 2012 +1000

    configure.ac: Bump to Version 1.12.3
    
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>

commit 738e55ebbdf516a45b95761b815bed4e697dc726
Author: Torsten Kaiser <just.for.lkml@googlemail.com>
Date:   Fri Jul 6 12:10:25 2012 -0700

    xfree86: EDID Est III parsing skips some modes
    
    This loop needs to count from 7 to 0, not only from 7 to 1.
    The current code always skips the modes {1152, 864, 75, 0}, {1280, 1024, 85, 0},
    {1400, 1050, 75, 0}, {1600, 1200, 70, 0} and {1920, 1200, 60, 0}.
    
    Signed-off-by: Torsten Kaiser <x11@ariolc.dyndns.org>
    Reviewed-by: Adam Jackson <ajax@redhat.com>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit 7c9d8cbd368cac53e7aed9308292614337db3be2)

commit f27fcb81c4a30cec899628e4bb3e300edbcebe4b
Author: Torsten Kaiser <just.for.lkml@googlemail.com>
Date:   Fri Jul 6 12:06:13 2012 -0700

    xfree86: EDID Est III parsing can walk off end of array
    
    Using -O3 gcc notes that m could reach beyound the end of the EstIIIModes array,
    if the last bits of the 11s byte where set.
    Fix this, by extending the array to cover all possible bits from est.
    
    https://bugs.freedesktop.org/show_bug.cgi?id=45623
    
    Signed-off-by: Torsten Kaiser <x11@ariolc.dyndns.org>
    Reviewed-by: Adam Jackson <ajax@redhat.com>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit 0b3abacb6430e6593c4358420ba457d8149bd32b)

commit e4497cd002ffb59cb7cf9df69d47ccb62ab55bf4
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Fri Jun 15 10:00:51 2012 +1000

    xfree86: always enable SIGIO on OsVendorInit (#50957)
    
    Drivers call xf86InstallSIGIOHandler() for their fd on DEVICE_ON. That
    function does not actually enable the signal if it was blocked to begin
    with. As a result, if one vt-switches away from the server (SIGIO is
    blocked) and then triggers a server regeneration, the signal remains
    blocked and input devices are dead.
    
    Avoid this by always unblocking SIGIO when we start the server.
    
    X.Org Bug 50957 <http://bugs.freedesktop.org/show_bug.cgi?id=50957>
    
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Reviewed-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit 9f1edced9abc066f0ba47672d006fe50fb206371)

commit ac85a6866fa63d1a1972dfa8fdcfe6ad76705648
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Tue Jun 26 09:19:33 2012 +1000

    Xi: extend PropagateMask to EMASKSIZE
    
    Number of devices is 2 + MAXDEVICES, with index 0 and 1 reserved for
    XIAll{Master}Devices. At the current size, PropagateMask would be overrun in
    RecalculateDeviceDeliverableEvents().
    
    Found by Coverity.
    
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Reviewed-by: Dave Airlie <airlied@redhat.com>
    (cherry picked from commit 12bfb4cf1bebb66d2c2eb76b93c18a2915b865e5)

commit eca5de2f1a08b38cf17188c8b3d02bae7fc14cd5
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Mon Jun 25 14:24:11 2012 +1000

    dix: fix memory leak in TouchEventHistoryReplay
    
    Don't leak if ti->history is NULL.
    
    Found by coverity.
    
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Reviewed-by: Dave Airlie <airlied@redhat.com>
    (cherry picked from commit a9c09f8f8e2a97e4bfe927bc4c7f29b04ee3403a)

commit c4d28c40bfb7e6ccdb921b610f26a3881bc5974a
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Mon Oct 24 10:01:26 2011 +1000

    xfree86: fix use-after-free issue in checkInput
    
    *dev is the condition of the while loop we're in, reset to NULL after
    freeing
    
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Reviewed-by: Dave Airlie <airlied@redhat.com>
    (cherry picked from commit e3f47be9fbc489e3eb5832445924810b2ff300f7)

commit 487e8e829942fcafe2435576d1e4cf831002aed4
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Mon Jul 2 10:15:14 2012 +1000

    configure.ac: Version bump to 1.12.2.902 (1.12.3 RC2)
    
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>

commit d21b6f0a2d767ca6fbd8f0ec387f83a50a38b486
Author: Andy Ritger <aritger@nvidia.com>
Date:   Thu Jun 14 09:15:37 2012 -0700

    randr: Don't recurse into mieqProcessInputEvents() from RRTellChanged().
    
    Call UpdateCurrentTimeIf(), not UpdateCurrentTime(), from RRTellChanged().
    The latter calls ProcessInputEvents(), which can trigger a recursion
    into mieqProcessInputEvents().  The former omits the call to
    ProcessInputEvents().
    
    Signed-off-by: Andy Ritger <aritger@nvidia.com>
    Reviewed-by: Jeremy Huddleston <jeremyhu@apple.com>
    Signed-off-by: Keith Packard <keithp@keithp.com>
    (cherry picked from commit dae317e7265007b38012244722e3b3a06e904ed5)

commit a6de3eac661ff6f23145cdaa49fc722381a1899e
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Thu Jun 7 16:52:20 2012 +1000

    dix: if the scroll valuator reaches INT_MAX, reset to 0
    
    Too much scrolling down may eventually trigger an overflow of the valuator.
    If this happens, reset the valuator to 0 and skip this event for button
    emulation. Clients will have to figure out a way to deal with this, but a
    scroll event from (close to) INT_MAX to 0 is a hint of that it needs to be
    ignored.
    
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
    (cherry picked from commit 54476b5e4461ff523e935961affabcf0de12c556)

commit b0be2d29b2c72c09de9845d2b1983e4c77c2ef17
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Wed Apr 11 09:43:23 2012 +1000

    Xi: fix XITouchClass sourceid assignment
    
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
    (cherry picked from commit 72cfc1a097dc1e09d2cd9415ef7855a2cef92351)

commit 4af8e22b1a539778388fe509a7f3a25860a7879c
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Wed Jun 6 14:38:49 2012 +1000

    xkb: warn if XKB SlowKeys have been automatically enabled
    
    Slow keys are enabled when the XKB AccessX features are generally enabled
    (ctrls->enabled_ctrls & XkbAccessXKeysMask) and either shift key is held for
    8 seconds. For the unsuspecting user this appears as if the keyboard
    suddenly stops working.
    
    Print a warning to the log, so we can later tell them "told you so".
    
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Reviewed-by: Dan Nicholson <dbn.lists@gmail.com>
    (cherry picked from commit ff41753b1bee414b16c0f1e8d183776e87c94065)

commit 0cecc4fc0f232bb64b8ef86d74164a676d92284f
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Tue May 29 10:17:50 2012 +0530

    configure.ac: Version bump to 1.12.2.901 (1.12.3 RC1)
    
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>

commit aaf48906279bcf74bcfd0a1de24de099184be022
Author: Julien Cristau <jcristau@debian.org>
Date:   Fri May 11 21:31:49 2012 +0200

    Xi: make stub DeleteInputDeviceRequest call RemoveDevice
    
    DeleteInputDeviceRequest is called from CloseDownDevices on reset, so
    call RemoveDevice to avoid leaking devices in Xvfb/Xnest/Xwin.
    
    Signed-off-by: Julien Cristau <jcristau@debian.org>
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    (cherry picked from commit e4153c1d9138ed40de1c615525066a0f5bb599dc)

commit f4a1ecb9280570c473631760885cc2afb5d174b9
Author: Marcin Slusarz <marcin.slusarz@gmail.com>
Date:   Mon May 21 21:39:43 2012 +0200

    xfree86: fix mouse wheel support for DGA clients
    
    xf86-input-evdev (since "smooth scrolling" support was added) can send mouse
    motion and wheel events in one batch, so we need to handle it properly.
    Otherwise mouse wheel events which come with motion events are lost
    and separate mouse wheel events are handled through non-DGA path.
    
    Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    (cherry picked from commit 2d4fda4b09e67e47d3e6fc4743fc6e81bfe40f28)

commit 889ce06946b8c1a246130a899e2702a3d7340fd2
Author: Peter Hutterer <peter.hutterer@who-t.net>
Date:   Wed May 9 11:30:46 2012 +1000

    dix: undo transformation for missing valuators (#49347)
    
    last.valuators contains the transformed valuators of the device. If the
    device submits events with x/y missing, we need to get that from
    last.valuators and undo the transformation to that axis.
    
    X.Org Bug 49347 <http://bugs.freedesktop.org/show_bug.cgi?id=49347>
    
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    Reviewed-by: Chase Douglas <chase.douglas@canonical.com>
    (cherry picked from commit 749a593e49adccdf1225be28a521412ec85333f4)

commit 4c21adab7ce4290ea038e13dd20a850f50d95f23
Author: Siddhesh Poyarekar <siddhesh.poyarekar@gmail.com>
Date:   Tue May 29 10:17:50 2012 +0530

    xkb: Allocate size_syms correctly when width of a type increases
    
    The current code seems to skip syms with width less than
    type->num_levels when calculating the total size for the new
    size_syms. This leads to less space being allocated than necessary
    during the next phase, which is to copy over the syms to the new
    location. This results in an overflow leading to a crash.
    
    Signed-off-by: Siddhesh Poyarekar <siddhesh.poyarekar@gmail.com>
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    (cherry picked from commit 42ae2e8199fe875319978249963de7499607988b)

commit 472c2d1af75d8e321728589e377f73116adb29fa
Author: Michal Suchanek <hramrach@gmail.com>
Date:   Wed May 23 11:22:05 2012 +0200

    Fix crash for motion events from devices without valuators
    
    A WarpPointer request may trigger a motion event on a device without
    valuators. That request is ignored by GetPointerEvents but during smooth
    scroll emulation we dereference dev->valuators to get the number of axes.
    
    Break out early if the device doesn't have valuators.
    
    Signed-off-by: Michal Suchanek <hramrach@gmail.com>
    Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
    Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
    (cherry picked from commit 88c767edb01ed7efb19ffe3a453e16107b27130b)

commit 97cae5e07a8e81c17cf18df7843db6ab1fc6a2a7
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Thu Jan 26 15:44:40 2012 -0800

    Convert sbusPaletteKey to latest DevPrivate API
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    Reviewed-by: Mark Kettenis <kettenis@openbsd.org>
    Reviewed-by: Dave Airlie <airlied@redhat.com>
    (cherry picked from commit 96e0ab54962ab59f03275a098ee02c1f0f86b94e)

commit 3484ef2de50970fefe0c2580f52357ee37d3e6f3
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Fri Apr 6 21:51:37 2012 -0700

    cvt man page should use Hz, not kHz, for vertical refresh rate
    
    https://bugs.freedesktop.org/show_bug.cgi?id=48311
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    Reviewed-by: Julien Cristau <jcristau@debian.org>
    (cherry picked from commit c3180a74a4fc6304bcfe676e3285d707874a9fea)

commit a5808eae02749507c49978f71d5aba2f3193cb07
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Fri Apr 27 13:35:32 2012 -0700

    Undocument Font Module loading
    
    Code was deleted in commit affec10635343668839994ea2bac16c1d4524200
    
    Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
    Reviewed-by: Dave Airlie <airlied@redhat.com>
    Reviewed-by: Adam Jackson <ajax@redhat.com>
    (cherry picked from commit 5a3a98fcb799c2ac8fa7494645ad9030f1cac837)

commit 9a4e2d80a5e79f6818879d682bb21a47acefc550
Author: Alan Coopersmith <alan.coopersmith@oracle.com>
Date:   Fri Apr 27 13:31:56 2012 -0700

    Undocument mandatory loadable modules
    
    The code to implement was deleted when BaseModules[] was emptied by
    the replacement of the "pcidata" module with libpciaccess calls
    in commit 46f55f5dead5d70cdff30531d80a72f6be042315.
