Harden compat stack and hook violawww

[jserv]

This consolidates differential test that gates the compat stack against the ViolaWWW browser. Affected Xlib surface spans XCopyArea, XGrabPointer, XQueryPointer, XWarpPointer, XGeometry/XWMGeometry, XDrawString family, XListFonts, XPutImage, XDoubleToFixed, and the SDL event/grab pipeline.

Memory safety and contract:

• xCopyArea raster-op fallback for non-GXcopy/masked planeMask via read-modify-write through SDL_RenderReadPixels; source read before the destination renderer is resolved (lazy GET_RENDERER can switch the active SDL target); calloc-backed pixel buffers; viewport-offset translation on the read rects
• subtractSegment uses caller-provided scratch buffer and int64 extents; renderFillRectClipByChildren allocations bounded against SIZE_MAX wrap
• font.c NULL string guards; decodeChar2bString rejects negative counts and caps allocation at (SIZE_MAX-1)/3; XDrawString16 double-free removed; XmbTextPerCharExtents rejects negative buffer size; XmbTextEscapement / Xutf8TextEscapement use int64 fallback; text extents clamp to short range
• decodeString stripped to bounded copy + NUL-terminate; no more escape interpretation that mangled file paths
• XListFonts returns caller-owned strdup'd entries with NULL sentinel; XFreeFontNames walks-and-frees; isSupportedFontFileName case-insensitive
• XGeometry / XWMGeometry pixel math via new satMulAdd (__builtin_mul_overflow / __builtin_add_overflow) with clampInt64ToInt narrowing
• XCopyArea int64 extent guards before SDL_Rect math
• XDoubleToFixed clamps representable range; NaN returns 0
• XPutImage stride validation (non-negative bytes_per_line, minimum row size for ZPixmap-32 and XYBitmap fast paths)

Pointer + grab contract:

• XQueryPointer NULL-checks every output, type-checks window, reports pressed-button bits in mask_return
• XWarpPointer containment and warp coord math in int64
• XGrabPointer returns BadWindow/GrabNotViewable for invalid args, AlreadyGrabbed on second active grab, GrabInvalidTime via CARD32 signed-delta against SDL_GetTicks (tick-wrap safe)
• XGrabButton replaces existing grab on (button, modifiers, window) tuple match instead of leaking duplicates
• Grab cursor saved/restored on ungrab; activatePassiveButtonGrab uses new getContainingWindow helper

Concurrency:

• putBackEventsLock, trackedDisplaysLock, activePointerWindowLock (the last is shared by activePointerWindow + pointerButtonState); pointerButtonStateSnapshot() helper for motion/wheel reads
• putImageScratchLock with lazy SDL_AtomicLock spinlock init, process-long lifetime; lock/unlock helpers pass the acquired SDL_mutex handle so a lazy-init race cannot make a thread unlock what it did not lock
• Event pipe fds initialized to -1, closed on last display close; dead fdopen(FILE*) leak path removed; closeEventPipe runs unconditional last-display teardown when remainingDisplays == 0

Build:

• Debug-only NULL guards on GET_WINDOW_STRUCT, GET_GC, GET_DISPLAY via extension statement expressions (release builds unchanged)
• STRICT=1 build variant adds -Werror to first-party objects only, applied via mk/common.mk and mk/xcompat-libs.mk
• New differential umbrella target runs motif-demos-check and violawww as separate sub-makes with set +e; aggregate exit reports both statuses on failure (one regression cannot mask the other)
• New mk/violawww.mk pinning the bolknote/violawww commit; Makefile includes it; externals/violawww/ added to .gitignore

CI:

• ViolaWWW build step in the motif job after demo smoke checks
• if: !cancelled() so a demo failure does not skip ViolaWWW (and ccache stats); workflow cancellation still aborts
• ViolaWWW build log uploaded as artifact on failure

Build commands run: make, make check, make
CFLAGS_EXTRA=-DDEBUG_LIBX11_COMPAT check, make STRICT=1.

---

Summary by cubic

Hardened the X11 compat stack and added a violawww differential build gate to catch regressions. This improves pointer/grab correctness, drawing/font safety, window show timing, and CI reliability.

• Bug Fixes

  • Drawing/image: safer XCopyArea fallback with read rect clipping; int64 bounds on copies/geometry; XPutImage stride checks with a process-long scratch lock; default opaque alpha for X11 pixels; clamped XDoubleToFixed.
  • Fonts/text: reject invalid sizes/counts, clamp text extents, fix XDrawString16 double-free, sanitize decodeString, XListFonts returns caller-owned lists.
  • Pointer/grabs: NULL-safe XQueryPointer; int64 XWarpPointer; strict XGrabPointer/XGrabButton semantics (errors, AlreadyGrabbed, time checks), passive button grabs with cursor save/restore, release grabs on window destroy, and viewability-aware containment.
  • Concurrency/events: dedicated locks for event queues and XPutImage scratch; event pipe fds init to -1 and torn down on last display close.
  • APIs/behavior: overflow-safe XGeometry/XWMGeometry; XRenderSetPictureTransform stub; XGrabServer/XUngrabServer are no-ops; top-level windows start hidden and are shown on map.

• Build and CI

  • STRICT=1 enables warnings-as-errors for first-party code via STRICT_CFLAGS; debug-only NULL guards for GET_DISPLAY, GET_GC, and GET_WINDOW_STRUCT.
  • New mk/violawww.mk and make violawww gate pinning bolknote/violawww; .gitignore ignores externals/violawww/; added make differential to run Motif smoke checks plus violawww.
  • CI builds violawww after Motif smoke tests, uploads logs on failure, and runs even if demos fail (if: !cancelled()).

^{Written for commit 0e9bc42. Summary will update on new commits.}