Make WriteEventsToClient/WriteToClient no-op on fake or dead clients.

This matches the test in TryClientEvents, and is a superset of tests
done by the callers of these functions. The consequence of forgetting
these tests is a server crash, so they're always desirable. In my
opinion, it's better to not require the callers to remember to do these
checks.

For callers that don't do very much work before calling WriteToClient or
WriteEventsToClient, I've removed the redundant checks.

hw/xquartz/xpr/appledri.c has an interesting case: While its check for
"client == NULL" appears redundant with the test in WriteEventsToClient,
it dereferences client to get the sequence number.

Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=27497
Signed-off-by: Jamey Sharp <jamey@minilop.net>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Adam Jackson <ajax@redhat.com>

Xext/saver.c

@@ -500,8 +500,6 @@ SendScreenSaverNotify (ScreenPtr pScreen, int state, Bool forced)
     for (pEv = pPriv->events; pEv; pEv = pEv->next)
     {
 	client = pEv->client;
-	if (client->clientGone)
-	    continue;
 	if (!(pEv->mask & mask))
 	    continue;
 	ev.type = ScreenSaverNotify + ScreenSaverEventBase;

Xext/security.c

@@ -199,15 +199,11 @@ SecurityDeleteAuthorization(
     {
 	/* send revocation event event */
 	ClientPtr client = rClient(pEventClient);
-
-	if (!client->clientGone)
-	{
 	xSecurityAuthorizationRevokedEvent are;
 	are.type = SecurityEventBase + XSecurityAuthorizationRevoked;
 	are.sequenceNumber = client->sequence;
 	are.authId = pAuth->id;
 	WriteEventsToClient(client, 1, (xEvent *)&are);
-	}
 	FreeResource(pEventClient->resource, RT_NONE);
     }
 

Xext/shape.c

@@ -941,8 +941,6 @@ SendShapeNotify (WindowPtr pWin, int which)
     }
     for (pShapeEvent = *pHead; pShapeEvent; pShapeEvent = pShapeEvent->next) {
 	client = pShapeEvent->client;
-	if (client == serverClient || client->clientGone)
-	    continue;
 	se.type = ShapeNotify + ShapeEventBase;
 	se.kind = which;
 	se.window = pWin->drawable.id;

Xext/sync.c

@@ -390,19 +390,16 @@ SyncSendAlarmNotifyEvents(SyncAlarm *pAlarm)
     ane.state = pAlarm->state;
 
     /* send to owner */
-    if (pAlarm->events && !pAlarm->client->clientGone)
+    if (pAlarm->events)
 	WriteEventsToClient(pAlarm->client, 1, (xEvent *) &ane);
 
     /* send to other interested clients */
     for (pcl = pAlarm->pEventClients; pcl; pcl = pcl->next)
-    {
-	if (!pcl->client->clientGone)
     {
 	ane.sequenceNumber = pcl->client->sequence;
 	WriteEventsToClient(pcl->client, 1, (xEvent *) &ane);
     }
 }
-}
 
 
 /*  CounterNotify events only occur in response to an Await.  The events

Xext/xcalibrate.c

@@ -59,7 +59,6 @@ xcalibrate_event_hook (int x, int y, int pressure, void *closure)
   ev.y = y;
   ev.pressure = pressure;
 
-  if (!pClient->clientGone)
   WriteEventsToClient (pClient, 1, (xEvent *) &ev);
 }
 

damageext/damageext.c

@@ -69,7 +69,6 @@ DamageExtNotify (DamageExtPtr pDamageExt, BoxPtr pBoxes, int nBoxes)
 	    ev.area.y = pBoxes[i].y1;
 	    ev.area.width = pBoxes[i].x2 - pBoxes[i].x1;
 	    ev.area.height = pBoxes[i].y2 - pBoxes[i].y1;
-	    if (!pClient->clientGone)
 	    WriteEventsToClient (pClient, 1, (xEvent *) &ev);
 	}
     }
@@ -79,7 +78,6 @@ DamageExtNotify (DamageExtPtr pDamageExt, BoxPtr pBoxes, int nBoxes)
 	ev.area.y = 0;
 	ev.area.width = pDrawable->width;
 	ev.area.height = pDrawable->height;
-	if (!pClient->clientGone)
 	WriteEventsToClient (pClient, 1, (xEvent *) &ev);
     }
     /* Composite extension marks clients with manual Subwindows as critical */

dix/events.c

@@ -5669,6 +5669,9 @@ WriteEventsToClient(ClientPtr pClient, int count, xEvent *events)
     int       i,
               eventlength = sizeof(xEvent);
 
+    if (!pClient || pClient == serverClient || pClient->clientGone)
+	return;
+
     /* Let XKB rewrite the state, as it depends on client preferences. */
     XkbFilterEvents(pClient, count, events);
 

hw/xfree86/dixmods/extmod/xf86vmode.c

@@ -344,8 +344,6 @@ SendXF86VidModeNotify(ScreenPtr pScreen, int state, Bool forced)
     for (pEv = pPriv->events; pEv; pEv = pEv->next)
     {
 	client = pEv->client;
-	if (client->clientGone)
-	    continue;
 	if (!(pEv->mask & mask))
 	    continue;
 	ev.type = XF86VidModeNotify + XF86VidModeEventBase;

hw/xfree86/dri2/dri2ext.c

@@ -160,9 +160,6 @@ DRI2InvalidateBuffersEvent(DrawablePtr pDraw, void *priv)
     xDRI2InvalidateBuffers event;
     ClientPtr client = priv;
 
-    if (client->clientGone)
-	return;
-
     event.type = DRI2EventBase + DRI2_InvalidateBuffers;
     event.sequenceNumber = client->sequence;
     event.drawable = pDraw->id;

hw/xquartz/applewm.c

@@ -350,11 +350,8 @@ AppleWMSendEvent (int type, unsigned int mask, int which, int arg) {
         return;
     for (pEvent = *pHead; pEvent; pEvent = pEvent->next) {
         client = pEvent->client;
-        if ((pEvent->mask & mask) == 0
+        if ((pEvent->mask & mask) == 0)
-            || client == serverClient || client->clientGone)
-        {
             continue;
-        }
         se.type = type + WMEventBase;
         se.kind = which;
         se.arg = arg;

hw/xquartz/xpr/appledri.c

@@ -199,7 +199,7 @@ static void surface_notify(
         return;
 
     client = clients[client_index];
-    if (client == NULL || client == serverClient || client->clientGone)
+    if (client == NULL)
         return;
 
     se.type = DRIEventBase + AppleDRISurfaceNotify;

hw/xwin/winwindowswm.c

@@ -304,8 +304,7 @@ winWindowsWMSendEvent (int type, unsigned int mask, int which, int arg,
 #if CYGMULTIWINDOW_DEBUG
       ErrorF ("winWindowsWMSendEvent - x%08x\n", (int) client);
 #endif
-      if ((pEvent->mask & mask) == 0
+      if ((pEvent->mask & mask) == 0)
-	  || client == serverClient || client->clientGone)
 	{
 	  continue;
 	}

os/io.c

@@ -698,15 +698,17 @@ SetCriticalOutputPending(void)
 int
 WriteToClient (ClientPtr who, int count, const void *__buf)
 {
-    OsCommPtr oc = (OsCommPtr)who->osPrivate;
+    OsCommPtr oc;
-    ConnectionOutputPtr oco = oc->output;
+    ConnectionOutputPtr oco;
     int padBytes;
     const char *buf = __buf;
 #ifdef DEBUG_COMMUNICATION
     Bool multicount = FALSE;
 #endif
-    if (!count)
+    if (!count || !who || who == serverClient || who->clientGone)
 	return(0);
+    oc = who->osPrivate;
+    oco = oc->output;
 #ifdef DEBUG_COMMUNICATION
     {
 	char info[128];

randr/rrproperty.c

@@ -29,7 +29,6 @@ DeliverPropertyEvent(WindowPtr pWin, void *value)
 {
     xRROutputPropertyNotifyEvent *event = value;
     RREventPtr *pHead, pRREvent;
-    ClientPtr client;
 
     dixLookupResourceByType((pointer *)&pHead, pWin->drawable.id,
 			    RREventType, serverClient, DixReadAccess);
@@ -38,14 +37,10 @@ DeliverPropertyEvent(WindowPtr pWin, void *value)
 
     for (pRREvent = *pHead; pRREvent; pRREvent = pRREvent->next)
     {
-	client = pRREvent->client;
-	if (client == serverClient || client->clientGone)
-	    continue;
-
 	if (!(pRREvent->mask & RROutputPropertyNotifyMask))
 	    continue;
 
-	event->sequenceNumber = client->sequence;
+	event->sequenceNumber = pRREvent->client->sequence;
 	event->window = pRREvent->window->drawable.id;
 	WriteEventsToClient(pRREvent->client, 1, (xEvent *)event);
     }

xfixes/cursor.c

@@ -164,8 +164,7 @@ CursorDisplayCursor (DeviceIntPtr pDev,
 	CursorCurrent[pDev->id] = pCursor;
 	for (e = cursorEvents; e; e = e->next)
 	{
-	    if ((e->eventMask & XFixesDisplayCursorNotifyMask) &&
+	    if ((e->eventMask & XFixesDisplayCursorNotifyMask))
-		!e->pClient->clientGone)
 	    {
 		xXFixesCursorNotifyEvent	ev;
 		ev.type = XFixesEventBase + XFixesCursorNotify;

xfixes/select.c

@@ -78,8 +78,7 @@ XFixesSelectionCallback (CallbackListPtr *callbacks, pointer data, pointer args)
     for (e = selectionEvents; e; e = e->next)
     {
 	if (e->selection == selection->selection && 
-	    (e->eventMask & eventMask) &&
+	    (e->eventMask & eventMask))
-	    !e->pClient->clientGone)
 	{
 	    xXFixesSelectionNotifyEvent	ev;