dix: Fix wrong cursor refcount.

        Calloc cursor struct to ensure devPrivates are zeroed out and don't
        increase the refcnt for devices automatically when allocating a new
        cursor. Use new DeviceIsPointerType() to detect if device is a pointer
        _before_ device has been activated and can thus be identified and set
        up grab functions accordingly. This way we can increase the refcnt
        when we get a pointer grab.

6 files changed, 34 insertions, 39 deletions

diff --git a/Xi/exevents.c b/Xi/exevents.c
index bc2618968..3e3f15a1d 100644
--- a/Xi/exevents.c
+++ b/Xi/exevents.c
@@ -101,7 +101,7 @@ RegisterOtherDevice(DeviceIntPtr device)
     device->public.realInputProc = ProcessOtherEvent;
     (device)->deviceGrab.ActivateGrab = ActivateKeyboardGrab;
     (device)->deviceGrab.DeactivateGrab = DeactivateKeyboardGrab;
-    if (IsPointerDevice(device))
+    if (DeviceIsPointerType(device))
     {
         (device)->coreGrab.ActivateGrab = ActivatePointerGrab;
         (device)->coreGrab.DeactivateGrab = DeactivatePointerGrab;
diff --git a/Xi/extinit.c b/Xi/extinit.c
index 3766a9516..971617ebb 100644
--- a/Xi/extinit.c
+++ b/Xi/extinit.c
@@ -983,6 +983,22 @@ IResetProc(ExtensionEntry * unused)
     RestoreExtensionEvents();
 }
 
+/*****************************************************************
+ *
+ * Returns TRUE if the device has some sort of pointer type.
+ *
+ */
+
+Bool
+DeviceIsPointerType(DeviceIntPtr dev)
+{
+    if (dev_type[1].type == dev->type)
+        return TRUE;
+
+    return FALSE;
+}
+
+
 /***********************************************************************
  *
  * Assign an id and type to an input device.
diff --git a/dix/cursor.c b/dix/cursor.c
index 27ae9f17d..5886422d5 100644
--- a/dix/cursor.c
+++ b/dix/cursor.c
@@ -179,7 +179,7 @@ AllocCursorARGB(unsigned char *psrcbits, unsigned char *pmaskbits, CARD32 *argb,
     ScreenPtr 	pscr;
     DeviceIntPtr pDev; 
 
-    pCurs = (CursorPtr)xalloc(sizeof(CursorRec) + sizeof(CursorBits));
+    pCurs = (CursorPtr)xcalloc(sizeof(CursorRec) + sizeof(CursorBits), 1);
     if (!pCurs)
     {
 	xfree(psrcbits);
@@ -196,7 +196,7 @@ AllocCursorARGB(unsigned char *psrcbits, unsigned char *pmaskbits, CARD32 *argb,
     bits->height = cm->height;
     bits->xhot = cm->xhot;
     bits->yhot = cm->yhot;
-    pCurs->refcnt = 0;		
+    pCurs->refcnt = 1;		
     CheckForEmptyMask(bits);
 
     pCurs->bits = bits;
@@ -215,6 +215,8 @@ AllocCursorARGB(unsigned char *psrcbits, unsigned char *pmaskbits, CARD32 *argb,
 
     /*
      * realize the cursor for every screen
+     * Do not change the refcnt, this will be changed when ChangeToCursor
+     * actually changes the sprite.
      */
     for (nscr = 0; nscr < screenInfo.numScreens; nscr++)
     {
@@ -223,7 +225,6 @@ AllocCursorARGB(unsigned char *psrcbits, unsigned char *pmaskbits, CARD32 *argb,
         {
             if (DevHasCursor(pDev))
             {
-                pCurs->refcnt++;
                 if (!( *pscr->RealizeCursor)(pDev, pscr, pCurs))
                 {
                     /* Realize failed for device pDev on screen pscr.
@@ -325,7 +326,7 @@ AllocGlyphCursor(Font source, unsigned sourceChar, Font mask, unsigned maskChar,
     }
     if (pShare)
     {
-	pCurs = (CursorPtr)xalloc(sizeof(CursorRec));
+	pCurs = (CursorPtr)xcalloc(sizeof(CursorRec), 1);
 	if (!pCurs)
 	    return BadAlloc;
 	bits = pShare->bits;
@@ -367,7 +368,8 @@ AllocGlyphCursor(Font source, unsigned sourceChar, Font mask, unsigned maskChar,
 	}
 	if (sourcefont != maskfont)
 	{
-	    pCurs = (CursorPtr)xalloc(sizeof(CursorRec) + sizeof(CursorBits));
+	    pCurs = 
+                (CursorPtr)xcalloc(sizeof(CursorRec) + sizeof(CursorBits), 1);
 	    if (pCurs)
 		bits = (CursorBitsPtr)((char *)pCurs + sizeof(CursorRec));
 	    else
@@ -375,9 +377,9 @@ AllocGlyphCursor(Font source, unsigned sourceChar, Font mask, unsigned maskChar,
 	}
 	else
 	{
-	    pCurs = (CursorPtr)xalloc(sizeof(CursorRec));
+	    pCurs = (CursorPtr)xcalloc(sizeof(CursorRec), 1);
 	    if (pCurs)
-		bits = (CursorBitsPtr)xalloc(sizeof(CursorBits));
+		bits = (CursorBitsPtr)xcalloc(sizeof(CursorBits), 1);
 	    else
 		bits = (CursorBitsPtr)NULL;
 	}
@@ -417,9 +419,10 @@ AllocGlyphCursor(Font source, unsigned sourceChar, Font mask, unsigned maskChar,
 	    sharedGlyphs = pShare;
 	}
     }
+
     CheckForEmptyMask(bits);
     pCurs->bits = bits;
-    pCurs->refcnt = 0;
+    pCurs->refcnt = 1;
 #ifdef XFIXES
     pCurs->serialNumber = ++cursorSerial;
     pCurs->name = None;
@@ -440,38 +443,10 @@ AllocGlyphCursor(Font source, unsigned sourceChar, Font mask, unsigned maskChar,
     {
         pscr = screenInfo.screens[nscr];
 
-        pCurs->refcnt++;
-        if (!(*pscr->RealizeCursor)(inputInfo.pointer, pscr, pCurs))
-        {
-            DeviceIntPtr pDevIt = inputInfo.devices; /*dev iterator*/
-            /* Realize for core pointer failed. Unrealize everything from
-             * previous screens.
-             */ 
-            while (--nscr >= 0)
-            {
-                pscr = screenInfo.screens[nscr];
-                /* now unrealize all devices on previous screens */
-                ( *pscr->UnrealizeCursor)(inputInfo.pointer, pscr, pCurs);
-
-                pDevIt = inputInfo.devices;
-                while (pDevIt)
-                {
-                    if (DevHasCursor(pDevIt))
-                        ( *pscr->UnrealizeCursor)(pDevIt, pscr, pCurs);
-                    pDevIt = pDevIt->next;
-                }
-                ( *pscr->UnrealizeCursor)(pDev, pscr, pCurs);
-            }
-            FreeCursorBits(bits);
-            xfree(pCurs);
-            return BadAlloc;
-        }
-
         for (pDev = inputInfo.devices; pDev; pDev = pDev->next)
         {
             if (DevHasCursor(pDev))
             {
-                pCurs->refcnt++;
                 if (!( *pscr->RealizeCursor)(pDev, pscr, pCurs))
                 {
                     /* Realize failed for device pDev on screen pscr.
diff --git a/dix/events.c b/dix/events.c
index a51a56c1d..c482f5c74 100644
--- a/dix/events.c
+++ b/dix/events.c
@@ -4024,7 +4024,6 @@ ProcGrabPointer(ClientPtr client)
 	    oldCursor = grab->cursor;
 	}
 	tempGrab.cursor = cursor;
-        /* FIXME: refcnt?? */
 	tempGrab.resource = client->clientAsMask;
 	tempGrab.ownerEvents = stuff->ownerEvents;
 	tempGrab.eventMask = stuff->eventMask;
diff --git a/hw/xfree86/common/xf86Xinput.c b/hw/xfree86/common/xf86Xinput.c
index a9ce21156..2c740018c 100644
--- a/hw/xfree86/common/xf86Xinput.c
+++ b/hw/xfree86/common/xf86Xinput.c
@@ -174,7 +174,7 @@ xf86ActivateDevice(LocalDevicePtr local)
         dev->spriteInfo->spriteOwner = !(local->flags & XI86_SHARED_POINTER);
 
 #ifdef XKB
-        if (!IsPointerDevice(dev))
+        if (!DeviceIsPointerType(dev))
         {
         /* FIXME: that's not the nice way to do it. XKB wraps the previously
          * set procs, so if we don't have them here, our event will disappear
diff --git a/include/extinit.h b/include/extinit.h
index ead59be24..7a12b1be9 100644
--- a/include/extinit.h
+++ b/include/extinit.h
@@ -142,6 +142,11 @@ IResetProc(
 	ExtensionEntry *       /* unused */
 	);
 
+Bool
+DeviceIsPointerType(
+        DeviceIntPtr dev
+        );
+
 void
 AssignTypeAndName (
 	DeviceIntPtr           /* dev */,