Merge remote-tracking branch 'origin/released'

16 files changed, 338 insertions, 211 deletions

diff --git a/fontconfig/configure.in b/fontconfig/configure.in
index 9f671abe7..06851a5e4 100644
--- a/fontconfig/configure.in
+++ b/fontconfig/configure.in
@@ -119,7 +119,7 @@ AC_TYPE_PID_T
 # Checks for library functions.
 AC_FUNC_VPRINTF
 AC_FUNC_MMAP
-AC_CHECK_FUNCS([geteuid getuid link memmove memset mkstemp strchr strrchr strtol getopt getopt_long sysconf ftruncate chsize rand random lrand48])
+AC_CHECK_FUNCS([geteuid getuid link memmove memset mkstemp strchr strrchr strtol getopt getopt_long sysconf ftruncate chsize rand random lrand48 random_r rand_r])
 
 #
 # Checks for iconv
diff --git a/fontconfig/src/fccache.c b/fontconfig/src/fccache.c
index 054371445..bbf950f17 100644
--- a/fontconfig/src/fccache.c
+++ b/fontconfig/src/fccache.c
@@ -20,14 +20,18 @@
  * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  * PERFORMANCE OF THIS SOFTWARE.
  */
-
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
 #include "fcint.h"
 #include "fcarch.h"
 #include <stdio.h>
+#include <stdlib.h>
 #include <fcntl.h>
 #include <dirent.h>
 #include <string.h>
 #include <sys/types.h>
+#include <time.h>
 #include <assert.h>
 #if defined(HAVE_MMAP) || defined(__CYGWIN__)
 #  include <unistd.h>
@@ -304,17 +308,62 @@ struct _FcCacheSkip {
 static FcCacheSkip	*fcCacheChains[FC_CACHE_MAX_LEVEL];
 static int		fcCacheMaxLevel;
 
-#if HAVE_RANDOM
-# define FcRandom()  random()
+
+static int32_t
+FcRandom(void)
+{
+    int32_t result;
+
+#if HAVE_RANDOM_R
+    static struct random_data fcrandbuf;
+    static char statebuf[256];
+    static FcBool initialized = FcFalse;
+
+    if (initialized != FcTrue)
+    {
+	initstate_r(time(NULL), statebuf, 256, &fcrandbuf);
+	initialized = FcTrue;
+    }
+
+    random_r(&fcrandbuf, &result);
+#elif HAVE_RANDOM
+    static char statebuf[256];
+    char *state;
+    static FcBool initialized = FcFalse;
+
+    if (initialized != FcTrue)
+    {
+	state = initstate(time(NULL), statebuf, 256);
+	initialized = FcTrue;
+    }
+    else
+	state = setstate(statebuf);
+
+    result = random();
+
+    setstate(state);
+#elif HAVE_LRAND48
+    result = lrand48();
+#elif HAVE_RAND_R
+    static unsigned int seed = time(NULL);
+
+    result = rand_r(&seed);
+#elif HAVE_RAND
+    static FcBool initialized = FcFalse;
+
+    if (initialized != FcTrue)
+    {
+	srand(time(NULL));
+	initialized = FcTrue;
+    }
+    result = rand();
 #else
-# if HAVE_LRAND48
-#  define FcRandom()  lrand48()
-# else
-#  if HAVE_RAND
-#   define FcRandom()  rand()
-#  endif
-# endif
+# error no random number generator function available.
 #endif
+
+    return result;
+}
+
 /*
  * Generate a random level number, distributed
  * so that each level is 1/4 as likely as the one before
diff --git a/mesalib/src/gallium/auxiliary/util/u_transfer.c b/mesalib/src/gallium/auxiliary/util/u_transfer.c
index 772b6d269..673a984fc 100644
--- a/mesalib/src/gallium/auxiliary/util/u_transfer.c
+++ b/mesalib/src/gallium/auxiliary/util/u_transfer.c
@@ -1,114 +1,135 @@
-#include "pipe/p_context.h"

-#include "util/u_rect.h"

-#include "util/u_inlines.h"

-#include "util/u_transfer.h"

-#include "util/u_memory.h"

-

-/* One-shot transfer operation with data supplied in a user

- * pointer.  XXX: strides??

- */

-void u_default_transfer_inline_write( struct pipe_context *pipe,

-                                      struct pipe_resource *resource,

-                                      unsigned level,

-                                      unsigned usage,

-                                      const struct pipe_box *box,

-                                      const void *data,

-                                      unsigned stride,

-                                      unsigned layer_stride)

-{

-   struct pipe_transfer *transfer = NULL;

-   uint8_t *map = NULL;

-   const uint8_t *src_data = data;

-   unsigned i;

-

-   transfer = pipe->get_transfer(pipe,

-                                 resource,

-                                 level,

-                                 usage,

-                                 box );

-   if (transfer == NULL)

-      goto out;

-

-   map = pipe_transfer_map(pipe, transfer);

-   if (map == NULL)

-      goto out;

-

-   for (i = 0; i < box->depth; i++) {

-      util_copy_rect(map,

-                     resource->format,

-                     transfer->stride, /* bytes */

-                     0, 0,

-                     box->width,

-                     box->height,

-                     src_data,

-                     stride,       /* bytes */

-                     0, 0);

-      map += transfer->layer_stride;

-      src_data += layer_stride;

-   }

-

-out:

-   if (map)

-      pipe_transfer_unmap(pipe, transfer);

-

-   if (transfer)

-      pipe_transfer_destroy(pipe, transfer);

-}

-

-

-boolean u_default_resource_get_handle(struct pipe_screen *screen,

-                                      struct pipe_resource *resource,

-                                      struct winsys_handle *handle)

-{

-   return FALSE;

-}

-

-

-

-void u_default_transfer_flush_region( struct pipe_context *pipe,

-                                      struct pipe_transfer *transfer,

-                                      const struct pipe_box *box)

-{

-   /* This is a no-op implementation, nothing to do.

-    */

-}

-

-struct pipe_transfer * u_default_get_transfer(struct pipe_context *context,

-                                              struct pipe_resource *resource,

-                                              unsigned level,

-                                              unsigned usage,

-                                              const struct pipe_box *box)

-{

-   struct pipe_transfer *transfer = CALLOC_STRUCT(pipe_transfer);

-   if (transfer == NULL)

-      return NULL;

-

-   transfer->resource = resource;

-   transfer->level = level;

-   transfer->usage = usage;

-   transfer->box = *box;

-

-   /* Note strides are zero, this is ok for buffers, but not for

-    * textures 2d & higher at least. 

-    */

-   return transfer;

-}

-

-void u_default_transfer_unmap( struct pipe_context *pipe,

-                               struct pipe_transfer *transfer )

-{

-}

-

-void u_default_transfer_destroy(struct pipe_context *pipe,

-                                struct pipe_transfer *transfer)

-{

-   FREE(transfer);

-}

-

-void u_default_redefine_user_buffer(struct pipe_context *ctx,

-                                    struct pipe_resource *resource,

-                                    unsigned offset,

-                                    unsigned size)

-{

-   resource->width0 = MAX2(resource->width0, offset + size);

-}

+#include "pipe/p_context.h"
+#include "util/u_rect.h"
+#include "util/u_inlines.h"
+#include "util/u_transfer.h"
+#include "util/u_memory.h"
+
+/* One-shot transfer operation with data supplied in a user
+ * pointer.  XXX: strides??
+ */
+void u_default_transfer_inline_write( struct pipe_context *pipe,
+                                      struct pipe_resource *resource,
+                                      unsigned level,
+                                      unsigned usage,
+                                      const struct pipe_box *box,
+                                      const void *data,
+                                      unsigned stride,
+                                      unsigned layer_stride)
+{
+   struct pipe_transfer *transfer = NULL;
+   uint8_t *map = NULL;
+
+   assert(!(usage & PIPE_TRANSFER_READ));
+
+   /* the write flag is implicit by the nature of transfer_inline_write */
+   usage |= PIPE_TRANSFER_WRITE;
+
+   /* transfer_inline_write implicitly discards the rewritten buffer range */
+   if (box->x == 0 && box->width == resource->width0) {
+      usage |= PIPE_TRANSFER_DISCARD_WHOLE_RESOURCE;
+   } else {
+      usage |= PIPE_TRANSFER_DISCARD_RANGE;
+   }
+
+   transfer = pipe->get_transfer(pipe,
+                                 resource,
+                                 level,
+                                 usage,
+                                 box );
+   if (transfer == NULL)
+      goto out;
+
+   map = pipe_transfer_map(pipe, transfer);
+   if (map == NULL)
+      goto out;
+
+   if (resource->target == PIPE_BUFFER) {
+      assert(box->height == 1);
+      assert(box->depth == 1);
+
+      memcpy(map, data, box->width);
+   }
+   else {
+      const uint8_t *src_data = data;
+      unsigned i;
+
+      for (i = 0; i < box->depth; i++) {
+         util_copy_rect(map,
+                        resource->format,
+                        transfer->stride, /* bytes */
+                        0, 0,
+                        box->width,
+                        box->height,
+                        src_data,
+                        stride,       /* bytes */
+                        0, 0);
+         map += transfer->layer_stride;
+         src_data += layer_stride;
+      }
+   }
+
+out:
+   if (map)
+      pipe_transfer_unmap(pipe, transfer);
+
+   if (transfer)
+      pipe_transfer_destroy(pipe, transfer);
+}
+
+
+boolean u_default_resource_get_handle(struct pipe_screen *screen,
+                                      struct pipe_resource *resource,
+                                      struct winsys_handle *handle)
+{
+   return FALSE;
+}
+
+
+
+void u_default_transfer_flush_region( struct pipe_context *pipe,
+                                      struct pipe_transfer *transfer,
+                                      const struct pipe_box *box)
+{
+   /* This is a no-op implementation, nothing to do.
+    */
+}
+
+struct pipe_transfer * u_default_get_transfer(struct pipe_context *context,
+                                              struct pipe_resource *resource,
+                                              unsigned level,
+                                              unsigned usage,
+                                              const struct pipe_box *box)
+{
+   struct pipe_transfer *transfer = CALLOC_STRUCT(pipe_transfer);
+   if (transfer == NULL)
+      return NULL;
+
+   transfer->resource = resource;
+   transfer->level = level;
+   transfer->usage = usage;
+   transfer->box = *box;
+
+   /* Note strides are zero, this is ok for buffers, but not for
+    * textures 2d & higher at least. 
+    */
+   return transfer;
+}
+
+void u_default_transfer_unmap( struct pipe_context *pipe,
+                               struct pipe_transfer *transfer )
+{
+}
+
+void u_default_transfer_destroy(struct pipe_context *pipe,
+                                struct pipe_transfer *transfer)
+{
+   FREE(transfer);
+}
+
+void u_default_redefine_user_buffer(struct pipe_context *ctx,
+                                    struct pipe_resource *resource,
+                                    unsigned offset,
+                                    unsigned size)
+{
+   resource->width0 = MAX2(resource->width0, offset + size);
+}
diff --git a/mesalib/src/glsl/glcpp/glcpp-parse.y b/mesalib/src/glsl/glcpp/glcpp-parse.y
index efcc205c2..47ba54ddf 100644
--- a/mesalib/src/glsl/glcpp/glcpp-parse.y
+++ b/mesalib/src/glsl/glcpp/glcpp-parse.y
@@ -184,11 +184,11 @@ input:
 
 line:
 	control_line {
-		ralloc_strcat (&parser->output, "\n");
+		ralloc_asprintf_rewrite_tail (&parser->output, &parser->output_length, "\n");
 	}
 |	text_line {
 		_glcpp_parser_print_expanded_token_list (parser, $1);
-		ralloc_strcat (&parser->output, "\n");
+		ralloc_asprintf_rewrite_tail (&parser->output, &parser->output_length, "\n");
 		ralloc_free ($1);
 	}
 |	expanded_line
@@ -320,7 +320,7 @@ control_line:
 		if ($2 >= 130 || $2 == 100)
 			add_builtin_define (parser, "GL_FRAGMENT_PRECISION_HIGH", 1);
 
-		ralloc_asprintf_append (&parser->output, "#version %" PRIiMAX, $2);
+		ralloc_asprintf_rewrite_tail (&parser->output, &parser->output_length, "#version %" PRIiMAX, $2);
 	}
 |	HASH NEWLINE
 ;
@@ -903,54 +903,54 @@ _token_list_equal_ignoring_space (token_list_t *a, token_list_t *b)
 }
 
 static void
-_token_print (char **out, token_t *token)
+_token_print (char **out, size_t *len, token_t *token)
 {
 	if (token->type < 256) {
-		ralloc_asprintf_append (out, "%c", token->type);
+		ralloc_asprintf_rewrite_tail (out, len, "%c", token->type);
 		return;
 	}
 
 	switch (token->type) {
 	case INTEGER:
-		ralloc_asprintf_append (out, "%" PRIiMAX, token->value.ival);
+		ralloc_asprintf_rewrite_tail (out, len, "%" PRIiMAX, token->value.ival);
 		break;
 	case IDENTIFIER:
 	case INTEGER_STRING:
 	case OTHER:
-		ralloc_strcat (out, token->value.str);
+		ralloc_asprintf_rewrite_tail (out, len, "%s", token->value.str);
 		break;
 	case SPACE:
-		ralloc_strcat (out, " ");
+		ralloc_asprintf_rewrite_tail (out, len, " ");
 		break;
 	case LEFT_SHIFT:
-		ralloc_strcat (out, "<<");
+		ralloc_asprintf_rewrite_tail (out, len, "<<");
 		break;
 	case RIGHT_SHIFT:
-		ralloc_strcat (out, ">>");
+		ralloc_asprintf_rewrite_tail (out, len, ">>");
 		break;
 	case LESS_OR_EQUAL:
-		ralloc_strcat (out, "<=");
+		ralloc_asprintf_rewrite_tail (out, len, "<=");
 		break;
 	case GREATER_OR_EQUAL:
-		ralloc_strcat (out, ">=");
+		ralloc_asprintf_rewrite_tail (out, len, ">=");
 		break;
 	case EQUAL:
-		ralloc_strcat (out, "==");
+		ralloc_asprintf_rewrite_tail (out, len, "==");
 		break;
 	case NOT_EQUAL:
-		ralloc_strcat (out, "!=");
+		ralloc_asprintf_rewrite_tail (out, len, "!=");
 		break;
 	case AND:
-		ralloc_strcat (out, "&&");
+		ralloc_asprintf_rewrite_tail (out, len, "&&");
 		break;
 	case OR:
-		ralloc_strcat (out, "||");
+		ralloc_asprintf_rewrite_tail (out, len, "||");
 		break;
 	case PASTE:
-		ralloc_strcat (out, "##");
+		ralloc_asprintf_rewrite_tail (out, len, "##");
 		break;
 	case COMMA_FINAL:
-		ralloc_strcat (out, ",");
+		ralloc_asprintf_rewrite_tail (out, len, ",");
 		break;
 	case PLACEHOLDER:
 		/* Nothing to print. */
@@ -1040,11 +1040,11 @@ _token_paste (glcpp_parser_t *parser, token_t *token, token_t *other)
 	}
 
 	glcpp_error (&token->location, parser, "");
-	ralloc_strcat (&parser->info_log, "Pasting \"");
-	_token_print (&parser->info_log, token);
-	ralloc_strcat (&parser->info_log, "\" and \"");
-	_token_print (&parser->info_log, other);
-	ralloc_strcat (&parser->info_log, "\" does not give a valid preprocessing token.\n");
+	ralloc_asprintf_rewrite_tail (&parser->info_log, &parser->info_log_length, "Pasting \"");
+	_token_print (&parser->info_log, &parser->info_log_length, token);
+	ralloc_asprintf_rewrite_tail (&parser->info_log, &parser->info_log_length, "\" and \"");
+	_token_print (&parser->info_log, &parser->info_log_length, other);
+	ralloc_asprintf_rewrite_tail (&parser->info_log, &parser->info_log_length, "\" does not give a valid preprocessing token.\n");
 
 	return token;
 }
@@ -1058,7 +1058,7 @@ _token_list_print (glcpp_parser_t *parser, token_list_t *list)
 		return;
 
 	for (node = list->head; node; node = node->next)
-		_token_print (&parser->output, node->token);
+		_token_print (&parser->output, &parser->output_length, node->token);
 }
 
 void
@@ -1104,7 +1104,9 @@ glcpp_parser_create (const struct gl_extensions *extensions, int api)
 	parser->lex_from_node = NULL;
 
 	parser->output = ralloc_strdup(parser, "");
+	parser->output_length = 0;
 	parser->info_log = ralloc_strdup(parser, "");
+	parser->info_log_length = 0;
 	parser->error = 0;
 
 	/* Add pre-defined macros. */
diff --git a/mesalib/src/glsl/glcpp/glcpp.h b/mesalib/src/glsl/glcpp/glcpp.h
index dc816e90e..2d7cad2e6 100644
--- a/mesalib/src/glsl/glcpp/glcpp.h
+++ b/mesalib/src/glsl/glcpp/glcpp.h
@@ -174,6 +174,8 @@ struct glcpp_parser {
 	token_node_t *lex_from_node;
 	char *output;
 	char *info_log;
+	size_t output_length;
+	size_t info_log_length;
 	int error;
 };
 
diff --git a/mesalib/src/glsl/link_uniforms.cpp b/mesalib/src/glsl/link_uniforms.cpp
index 296e4e20c..bd2c10d75 100644
--- a/mesalib/src/glsl/link_uniforms.cpp
+++ b/mesalib/src/glsl/link_uniforms.cpp
@@ -67,7 +67,7 @@ uniform_field_visitor::process(ir_variable *var)
 
 void
 uniform_field_visitor::recursion(const glsl_type *t, char **name,
-				 unsigned name_length)
+				 size_t name_length)
 {
    /* Records need to have each field processed individually.
     *
@@ -78,22 +78,21 @@ uniform_field_visitor::recursion(const glsl_type *t, char **name,
    if (t->is_record()) {
       for (unsigned i = 0; i < t->length; i++) {
 	 const char *field = t->fields.structure[i].name;
+	 size_t new_length = name_length;
 
 	 /* Append '.field' to the current uniform name. */
-	 ralloc_asprintf_rewrite_tail(name, name_length, ".%s", field);
+	 ralloc_asprintf_rewrite_tail(name, &new_length, ".%s", field);
 
-	 recursion(t->fields.structure[i].type, name,
-		   name_length + 1 + strlen(field));
+	 recursion(t->fields.structure[i].type, name, new_length);
       }
    } else if (t->is_array() && t->fields.array->is_record()) {
       for (unsigned i = 0; i < t->length; i++) {
-	 char subscript[13];
+	 size_t new_length = name_length;
 
 	 /* Append the subscript to the current uniform name */
-	 const unsigned subscript_length = snprintf(subscript, 13, "[%u]", i);
-	 ralloc_asprintf_rewrite_tail(name, name_length, "%s", subscript);
+	 ralloc_asprintf_rewrite_tail(name, &new_length, "[%u]", i);
 
-	 recursion(t->fields.array, name, name_length + subscript_length);
+	 recursion(t->fields.array, name, new_length);
       }
    } else {
       this->visit_field(t, *name);
diff --git a/mesalib/src/glsl/linker.h b/mesalib/src/glsl/linker.h
index 433c63be2..0b4c001f7 100644
--- a/mesalib/src/glsl/linker.h
+++ b/mesalib/src/glsl/linker.h
@@ -76,7 +76,7 @@ private:
     * \param name_length  Length of the current name \b not including the
     *                     terminating \c NUL character.
     */
-   void recursion(const glsl_type *t, char **name, unsigned name_length);
+   void recursion(const glsl_type *t, char **name, size_t name_length);
 };
 
 #endif /* GLSL_LINKER_H */
diff --git a/mesalib/src/glsl/ralloc.c b/mesalib/src/glsl/ralloc.c
index 91e4bab2e..2f93dcdea 100644
--- a/mesalib/src/glsl/ralloc.c
+++ b/mesalib/src/glsl/ralloc.c
@@ -448,11 +448,11 @@ ralloc_vasprintf_append(char **str, const char *fmt, va_list args)
    size_t existing_length;
    assert(str != NULL);
    existing_length = *str ? strlen(*str) : 0;
-   return ralloc_vasprintf_rewrite_tail(str, existing_length, fmt, args);
+   return ralloc_vasprintf_rewrite_tail(str, &existing_length, fmt, args);
 }
 
 bool
-ralloc_asprintf_rewrite_tail(char **str, size_t start, const char *fmt, ...)
+ralloc_asprintf_rewrite_tail(char **str, size_t *start, const char *fmt, ...)
 {
    bool success;
    va_list args;
@@ -463,7 +463,7 @@ ralloc_asprintf_rewrite_tail(char **str, size_t start, const char *fmt, ...)
 }
 
 bool
-ralloc_vasprintf_rewrite_tail(char **str, size_t start, const char *fmt,
+ralloc_vasprintf_rewrite_tail(char **str, size_t *start, const char *fmt,
 			      va_list args)
 {
    size_t new_length;
@@ -479,11 +479,12 @@ ralloc_vasprintf_rewrite_tail(char **str, size_t start, const char *fmt,
 
    new_length = printf_length(fmt, args);
 
-   ptr = resize(*str, start + new_length + 1);
+   ptr = resize(*str, *start + new_length + 1);
    if (unlikely(ptr == NULL))
       return false;
 
-   vsnprintf(ptr + start, new_length + 1, fmt, args);
+   vsnprintf(ptr + *start, new_length + 1, fmt, args);
    *str = ptr;
+   *start += new_length;
    return true;
 }
diff --git a/mesalib/src/glsl/ralloc.h b/mesalib/src/glsl/ralloc.h
index 1324f3466..86306b1f5 100644
--- a/mesalib/src/glsl/ralloc.h
+++ b/mesalib/src/glsl/ralloc.h
@@ -329,10 +329,11 @@ char *ralloc_vasprintf(const void *ctx, const char *fmt, va_list args);
  * \param fmt   A printf-style formatting string
  *
  * \p str will be updated to the new pointer unless allocation fails.
+ * \p start will be increased by the length of the newly formatted text.
  *
  * \return True unless allocation failed.
  */
-bool ralloc_asprintf_rewrite_tail(char **str, size_t start,
+bool ralloc_asprintf_rewrite_tail(char **str, size_t *start,
 				  const char *fmt, ...);
 
 /**
@@ -352,10 +353,11 @@ bool ralloc_asprintf_rewrite_tail(char **str, size_t start,
  * \param args  A va_list containing the data to be formatted
  *
  * \p str will be updated to the new pointer unless allocation fails.
+ * \p start will be increased by the length of the newly formatted text.
  *
  * \return True unless allocation failed.
  */
-bool ralloc_vasprintf_rewrite_tail(char **str, size_t start, const char *fmt,
+bool ralloc_vasprintf_rewrite_tail(char **str, size_t *start, const char *fmt,
 				   va_list args);
 
 /**
diff --git a/mesalib/src/mesa/main/readpix.c b/mesalib/src/mesa/main/readpix.c
index 0f429ab22..3384d8a38 100644
--- a/mesalib/src/mesa/main/readpix.c
+++ b/mesalib/src/mesa/main/readpix.c
@@ -225,6 +225,16 @@ fast_read_rgba_pixels_memcpy( struct gl_context *ctx,
                                              ctx->Pack.SwapBytes))
       return GL_FALSE;
 
+   /* If the format is unsigned normalized then we can ignore clamping
+    * because the values are already in the range [0,1] so it won't
+    * have any effect anyway.
+    */
+   if (_mesa_get_format_datatype(rb->Format) == GL_UNSIGNED_NORMALIZED)
+      transferOps &= ~IMAGE_CLAMP_BIT;
+
+   if (transferOps)
+      return GL_FALSE;
+
    dstStride = _mesa_image_row_stride(packing, width, format, type);
    dst = (GLubyte *) _mesa_image_address2d(packing, pixels, width, height,
 					   format, type, 0, 0);
@@ -320,13 +330,11 @@ read_rgba_pixels( struct gl_context *ctx,
       transferOps |= IMAGE_CLAMP_BIT;
    }
 
-   if (!transferOps) {
-      /* Try the optimized paths first. */
-      if (fast_read_rgba_pixels_memcpy(ctx, x, y, width, height,
-				       format, type, pixels, packing,
-				       transferOps)) {
-	 return;
-      }
+   /* Try the optimized paths first. */
+   if (fast_read_rgba_pixels_memcpy(ctx, x, y, width, height,
+                                    format, type, pixels, packing,
+                                    transferOps)) {
+      return;
    }
 
    slow_read_rgba_pixels(ctx, x, y, width, height,
diff --git a/mesalib/src/mesa/main/teximage.c b/mesalib/src/mesa/main/teximage.c
index 9b6c6c896..5328ae296 100644
--- a/mesalib/src/mesa/main/teximage.c
+++ b/mesalib/src/mesa/main/teximage.c
@@ -69,8 +69,6 @@
  *
  * This is the format which is used during texture application (i.e. the
  * texture format and env mode determine the arithmetic used.
- *
- * XXX this could be static
  */
 GLint
 _mesa_base_tex_format( struct gl_context *ctx, GLint internalFormat )
@@ -830,7 +828,7 @@ _mesa_get_proxy_tex_image(struct gl_context *ctx, GLenum target, GLint level)
    struct gl_texture_image *texImage;
    GLuint texIndex;
 
-   if (level < 0 )
+   if (level < 0)
       return NULL;
 
    switch (target) {
diff --git a/mesalib/src/mesa/state_tracker/st_draw.c b/mesalib/src/mesa/state_tracker/st_draw.c
index c0554cfc7..c4b2caccd 100644
--- a/mesalib/src/mesa/state_tracker/st_draw.c
+++ b/mesalib/src/mesa/state_tracker/st_draw.c
@@ -905,6 +905,7 @@ st_validate_varrays(struct gl_context *ctx,
    unsigned num_vbuffers, num_velements;
    GLuint attr;
    unsigned i;
+   unsigned old_num_user_attribs;
 
    /* must get these after state validation! */
    vp = st->vp;
@@ -913,9 +914,7 @@ st_validate_varrays(struct gl_context *ctx,
    memset(velements, 0, sizeof(struct pipe_vertex_element) * vpv->num_inputs);
 
    /* Unreference any user vertex buffers. */
-   for (i = 0; i < st->num_user_attribs; i++) {
-      pipe_resource_reference(&st->user_attrib[i].buffer, NULL);
-   }
+   old_num_user_attribs = st->num_user_attribs;
    st->num_user_attribs = 0;
 
    /*
@@ -954,6 +953,10 @@ st_validate_varrays(struct gl_context *ctx,
       assert(!vbuffer[attr].buffer);
    }
 
+   for (i = old_num_user_attribs; i < st->num_user_attribs; i++) {
+      pipe_resource_reference(&st->user_attrib[i].buffer, NULL);
+   }
+
    return GL_TRUE;
 }
 
diff --git a/mesalib/src/mesa/vbo/vbo.h b/mesalib/src/mesa/vbo/vbo.h
index bf925ab16..2d01d9823 100644
--- a/mesalib/src/mesa/vbo/vbo.h
+++ b/mesalib/src/mesa/vbo/vbo.h
@@ -123,8 +123,22 @@ void vbo_rebase_prims( struct gl_context *ctx,
 		       GLuint max_index,
 		       vbo_draw_func draw );
 
-int
-vbo_sizeof_ib_type(GLenum type);
+static inline int
+vbo_sizeof_ib_type(GLenum type)
+{
+   switch (type) {
+   case GL_UNSIGNED_INT:
+      return sizeof(GLuint);
+   case GL_UNSIGNED_SHORT:
+      return sizeof(GLushort);
+   case GL_UNSIGNED_BYTE:
+      return sizeof(GLubyte);
+   default:
+      assert(!"unsupported index data type");
+      /* In case assert is turned off */
+      return 0;
+   }
+}
 
 void
 vbo_get_minmax_indices(struct gl_context *ctx, const struct _mesa_prim *prim,
diff --git a/mesalib/src/mesa/vbo/vbo_exec_array.c b/mesalib/src/mesa/vbo/vbo_exec_array.c
index 06e36a677..b0a4261e7 100644
--- a/mesalib/src/mesa/vbo/vbo_exec_array.c
+++ b/mesalib/src/mesa/vbo/vbo_exec_array.c
@@ -75,22 +75,6 @@ vbo_check_buffers_are_unmapped(struct gl_context *ctx)
    assert(!_mesa_bufferobj_mapped(exec->vtx.bufferobj));
 }
 
-int
-vbo_sizeof_ib_type(GLenum type)
-{
-   switch (type) {
-   case GL_UNSIGNED_INT:
-      return sizeof(GLuint);
-   case GL_UNSIGNED_SHORT:
-      return sizeof(GLushort);
-   case GL_UNSIGNED_BYTE:
-      return sizeof(GLubyte);
-   default:
-      assert(!"unsupported index data type");
-      /* In case assert is turned off */
-      return 0;
-   }
-}
 
 
 /**
diff --git a/pixman/pixman/pixman-cpu.c b/pixman/pixman/pixman-cpu.c
index fcf591a99..bb97ae3e6 100644
--- a/pixman/pixman/pixman-cpu.c
+++ b/pixman/pixman/pixman-cpu.c
@@ -24,6 +24,7 @@
 #endif
 
 #include <string.h>
+#include <stdlib.h>
 
 #if defined(USE_ARM_SIMD) && defined(_MSC_VER)
 /* Needed for EXCEPTION_ILLEGAL_INSTRUCTION */
@@ -328,7 +329,6 @@ pixman_arm_read_auxv_or_cpu_features ()
 
 #elif defined (__linux__) /* linux ELF */
 
-#include <stdlib.h>
 #include <unistd.h>
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -711,51 +711,84 @@ pixman_have_sse2 (void)
 #endif /* __amd64__ */
 #endif
 
+static pixman_bool_t
+disabled (const char *name)
+{
+    const char *env;
+
+    if ((env = getenv ("PIXMAN_DISABLE")))
+    {
+	do
+	{
+	    const char *end;
+	    int len;
+
+	    if ((end = strchr (env, ' ')))
+		len = end - env;
+	    else
+		len = strlen (env);
+
+	    if (strlen (name) == len && strncmp (name, env, len) == 0)
+	    {
+		printf ("pixman: Disabled %s implementation\n", name);
+		return TRUE;
+	    }
+
+	    env += len;
+	}
+	while (*env++);
+    }
+
+    return FALSE;
+}
+
 pixman_implementation_t *
 _pixman_choose_implementation (void)
 {
     pixman_implementation_t *imp;
 
     imp = _pixman_implementation_create_general();
-    imp = _pixman_implementation_create_fast_path (imp);
-    
+
+    if (!disabled ("fast"))
+	imp = _pixman_implementation_create_fast_path (imp);
+
 #ifdef USE_X86_MMX
-    if (pixman_have_mmx ())
+    if (!disabled ("mmx") && pixman_have_mmx ())
 	imp = _pixman_implementation_create_mmx (imp);
 #endif
 
 #ifdef USE_SSE2
-    if (pixman_have_sse2 ())
+    if (!disabled ("sse2") && pixman_have_sse2 ())
 	imp = _pixman_implementation_create_sse2 (imp);
 #endif
 
 #ifdef USE_ARM_SIMD
-    if (pixman_have_arm_simd ())
+    if (!disabled ("arm-simd") && pixman_have_arm_simd ())
 	imp = _pixman_implementation_create_arm_simd (imp);
 #endif
 
 #ifdef USE_ARM_IWMMXT
-    if (pixman_have_arm_iwmmxt ())
+    if (!disabled ("arm-iwmmxt") && pixman_have_arm_iwmmxt ())
 	imp = _pixman_implementation_create_mmx (imp);
 #endif
 
 #ifdef USE_ARM_NEON
-    if (pixman_have_arm_neon ())
+    if (!disabled ("arm-neon") && pixman_have_arm_neon ())
 	imp = _pixman_implementation_create_arm_neon (imp);
 #endif
 
 #ifdef USE_MIPS_DSPR2
-    if (pixman_have_mips_dspr2 ())
+    if (!disabled ("mips-dspr2") && pixman_have_mips_dspr2 ())
 	imp = _pixman_implementation_create_mips_dspr2 (imp);
 #endif
 
 #ifdef USE_VMX
-    if (pixman_have_vmx ())
+    if (!disabled ("vmx") && pixman_have_vmx ())
 	imp = _pixman_implementation_create_vmx (imp);
 #endif
 
     imp = _pixman_implementation_create_noop (imp);
-    
+
     return imp;
 }
 
diff --git a/xorg-server/dix/getevents.c b/xorg-server/dix/getevents.c
index 8091c5782..ed529722c 100644
--- a/xorg-server/dix/getevents.c
+++ b/xorg-server/dix/getevents.c
@@ -855,10 +855,15 @@ scale_to_desktop(DeviceIntPtr dev, ValuatorMask *mask,
     ScreenPtr scr = miPointerGetScreen(dev);
     double x, y;
 
-    BUG_WARN(!dev->valuator);
-    BUG_WARN(dev->valuator->numAxes < 2);
+    BUG_WARN(!dev->valuator || dev->valuator->numAxes < 2);
     if (!dev->valuator || dev->valuator->numAxes < 2)
+    {
+        /* if we have no axes, last.valuators must be in screen coords
+         * anyway */
+        *devx = *screenx = dev->last.valuators[0];
+        *devy = *screeny = dev->last.valuators[1];
         return scr;
+    }
 
     if (valuator_mask_isset(mask, 0))
         x = valuator_mask_get_double(mask, 0);
@@ -1514,8 +1519,6 @@ GetPointerEvents(InternalEvent *events, DeviceIntPtr pDev, int type,
 {
     CARD32 ms = GetTimeInMillis();
     int num_events = 0, nev_tmp;
-    int h_scroll_axis = pDev->valuator->h_scroll_axis;
-    int v_scroll_axis = pDev->valuator->v_scroll_axis;
     ValuatorMask mask;
     ValuatorMask scroll;
     int i;
@@ -1540,6 +1543,14 @@ GetPointerEvents(InternalEvent *events, DeviceIntPtr pDev, int type,
     {
         double val, adj;
         int axis;
+        int h_scroll_axis = -1;
+        int v_scroll_axis = -1;
+
+        if (pDev->valuator)
+        {
+            h_scroll_axis = pDev->valuator->h_scroll_axis;
+            v_scroll_axis = pDev->valuator->v_scroll_axis;
+        }
 
         /* Up is negative on valuators, down positive */
         switch (buttons) {