20557 – Xinerama causes segfault on keypress on xserver-1.6.0

With an upgrade to xserver-1.6.0 my xinerama setup causes segfault of xserver.
Config file: http://pld.pastebin.com/m545f79a3
Xorg log: http://pld.pastebin.com/f302a9d50
I start X session with nothing but xterm (happens on gdm login screen too) and press any key, I get following backtrace:
Backtrace:
0: /usr/bin/Xorg(xorg_backtrace+0x3b) [0x8123173]
1: /usr/bin/Xorg(xf86SigHandler+0x4d) [0x80bb10d]
2: [0xb7f1b400]
3: /usr/bin/Xorg [0x80b7b0f]
4: /usr/bin/Xorg [0x810d3bd]
5: /usr/bin/Xorg [0x816451a]
6: /usr/bin/Xorg [0x808bcb1]
7: /usr/bin/Xorg(CheckMotion+0x31f) [0x808faf7]
8: /usr/bin/Xorg(ProcessOtherEvent+0x2bd) [0x816d785]
9: /usr/bin/Xorg(XkbHandleActions+0x24e) [0x8194228]
10: /usr/bin/Xorg(XkbProcessKeyboardEvent+0x3a4) [0x8194cdc]
11: /usr/bin/Xorg(AccessXFilterPressEvent+0xfe) [0x818d038]
12: /usr/bin/Xorg(ProcessKeyboardEvent+0x18c) [0x8194f62]
13: /usr/bin/Xorg(mieqProcessInputEvents+0x383) [0x8104213]
14: /usr/bin/Xorg(ProcessInputEvents+0x17) [0x80bbc17]
15: /usr/bin/Xorg(Dispatch+0x6e) [0x8084b1c]
16: /usr/bin/Xorg(main+0x3b0) [0x806b9b5]
17: /lib/libc.so.6(__libc_start_main+0xee) [0xb7b746ee]
If I first do a mouseclick, then I am able to log in / use xterm for some time. Eventually, it will segfault again with the same backtrace.
Disabling Xinerama helps.
I am ready to do some git bisection (1.5.3 worked fine) if that would help.

please run "addr2line -e /path/to/Xorg 0x808faf7"

Did an upgrade today so a new backtrace (addresses changed):
Backtrace:
0: /usr/bin/Xwrapper(xorg_backtrace+0x39) [0x81595a1]
1: /usr/bin/Xwrapper(xf86SigHandler+0x9e) [0x80d8262]
2: [0xb7ff4400]
3: /usr/bin/Xwrapper [0x8094f4a]
4: /usr/bin/Xwrapper [0x8095103]
5: /usr/bin/Xwrapper [0x8095a97]
6: /usr/bin/Xwrapper [0x80962f6]
7: /usr/bin/Xwrapper [0x80964ee]
8: /usr/bin/Xwrapper [0x8095764]
9: /usr/bin/Xwrapper(CheckMotion+0x48) [0x8099797]
10: /usr/bin/Xwrapper(ProcessOtherEvent+0x16e) [0x81c2652]
11: /usr/bin/Xwrapper(XkbHandleActions+0x736) [0x81fe26f]
12: /usr/bin/Xwrapper(XkbProcessKeyboardEvent+0x4f2) [0x81fec8a]
13: /usr/bin/Xwrapper(AccessXFilterPressEvent+0x453) [0x81f2d05]
14: /usr/bin/Xwrapper(ProcessKeyboardEvent+0x1bb) [0x81fee4b]
15: /usr/bin/Xwrapper(mieqProcessInputEvents+0x3d9) [0x813581f]
16: /usr/bin/Xwrapper(ProcessInputEvents+0x17) [0x80d7c20]
17: /usr/bin/Xwrapper(Dispatch+0x6f) [0x8084a75]
18: /usr/bin/Xwrapper(main+0x53c) [0x806b2f0]
19: /lib/libc.so.6(__libc_start_main+0xee) [0xb7c4d6ee]
[adamg@ankh-th tmp]$ addr2line -e /usr/bin/Xorg 0x8099797
/usr/src/debug/xorg-server-1.6.0/dix/events.c:2555
[adamg@ankh-th tmp]$
That corresponds to:
[adamg@ankh-th tmp]$ cat -n /usr/src/debug/xorg-server-1.6.0/dix/events.c | head -n 2560 | tail -n 10
 2551	 prevSpriteWin = pSprite->win;
 2552	
 2553	#ifdef PANORAMIX
 2554	 if(!noPanoramiXExtension)
 2555		return XineramaCheckMotion(xE, pDev);
 2556	#endif
 2557	
 2558	 if (xE && !syncEvents.playingEvents)
 2559	 {
 2560	 /* GetPointerEvents() guarantees that pointer events have the correct
[adamg@ankh-th tmp]$ 

Similar crash here, with xinerama and Rotate CW:
http://bigasterisk.com/post/xorg-20557-xorg-log
http://bigasterisk.com/post/xorg-20557-xorg-conf
I get a very repeatable crash if I hold any key and make it repeat. I also get a crash if I restart my fvwm (which normally does not restart X).

Also seeing this bug:
Backtrace:
0: /usr/bin/Xorg(xorg_backtrace+0x26) [0x4f00a6]
1: /usr/bin/Xorg(xf86SigHandler+0x39) [0x49c149]
2: /lib/libc.so.6 [0x7fc566508150]
3: /usr/bin/Xorg [0x4da6c5]
4: /usr/bin/Xorg [0x455628]
5: /usr/bin/Xorg [0x4577be]
6: /usr/bin/Xorg(CheckMotion+0x9b) [0x45904b]
7: /usr/bin/Xorg(ProcessOtherEvent+0x2d9) [0x53e559]
8: /usr/bin/Xorg(XkbHandleActions+0x21b) [0x5653db]
9: /usr/bin/Xorg(XkbProcessKeyboardEvent+0x116) [0x565c16]
10: /usr/bin/Xorg [0x55ddd4]
11: /usr/bin/Xorg [0x55de7c]
12: /usr/bin/Xorg [0x4ed908]
13: /usr/bin/Xorg(WaitForSomething+0x56b) [0x4edf5b]
14: /usr/bin/Xorg(Dispatch+0x80) [0x44d6d0]
15: /usr/bin/Xorg(main+0x3bd) [0x4338ad]
16: /lib/libc.so.6(__libc_start_main+0xe6) [0x7fc5664f4546]
17: /usr/bin/Xorg [0x432d39]
Tri-head Xinerama setup.

*** Bug 20744 has been marked as a duplicate of this bug. ***

Created attachment 24220 [details]  [review]
0001-dix-ignore-non-pointer-events-in-XineramaCheckMotio.patch

Created attachment 24224 [details]  [review]
0001-dix-ignore-non-pointer-events-in-XineramaCheckMotio.patch
Updated patch thanks to Julien. The original patch had some unnecessary noise.

Xserver no longer segfaults for me with this patch applied.
Thanks!

I can confirm this - no segfaults anymore for me either.

Nominated for 1.6.1, reassigning to keith.