Harden compat stack and hook violawww

[jserv]

This consolidates differential test that gates the compat stack against the ViolaWWW browser. Affected Xlib surface spans XCopyArea, XGrabPointer, XQueryPointer, XWarpPointer, XGeometry/XWMGeometry, XDrawString family, XListFonts, XPutImage, XDoubleToFixed, and the SDL event/grab pipeline.

Memory safety and contract:

• xCopyArea raster-op fallback for non-GXcopy/masked planeMask via read-modify-write through SDL_RenderReadPixels; source read before the destination renderer is resolved (lazy GET_RENDERER can switch the active SDL target); calloc-backed pixel buffers; viewport-offset translation on the read rects
• subtractSegment uses caller-provided scratch buffer and int64 extents; renderFillRectClipByChildren allocations bounded against SIZE_MAX wrap
• font.c NULL string guards; decodeChar2bString rejects negative counts and caps allocation at (SIZE_MAX-1)/3; XDrawString16 double-free removed; XmbTextPerCharExtents rejects negative buffer size; XmbTextEscapement / Xutf8TextEscapement use int64 fallback; text extents clamp to short range
• decodeString stripped to bounded copy + NUL-terminate; no more escape interpretation that mangled file paths
• XListFonts returns caller-owned strdup'd entries with NULL sentinel; XFreeFontNames walks-and-frees; isSupportedFontFileName case-insensitive
• XGeometry / XWMGeometry pixel math via new satMulAdd (__builtin_mul_overflow / __builtin_add_overflow) with clampInt64ToInt narrowing
• XCopyArea int64 extent guards before SDL_Rect math
• XDoubleToFixed clamps representable range; NaN returns 0
• XPutImage stride validation (non-negative bytes_per_line, minimum row size for ZPixmap-32 and XYBitmap fast paths)

Pointer + grab contract:

• XQueryPointer NULL-checks every output, type-checks window, reports pressed-button bits in mask_return
• XWarpPointer containment and warp coord math in int64
• XGrabPointer returns BadWindow/GrabNotViewable for invalid args, AlreadyGrabbed on second active grab, GrabInvalidTime via CARD32 signed-delta against SDL_GetTicks (tick-wrap safe)
• XGrabButton replaces existing grab on (button, modifiers, window) tuple match instead of leaking duplicates
• Grab cursor saved/restored on ungrab; activatePassiveButtonGrab uses new getContainingWindow helper

Concurrency:

• putBackEventsLock, trackedDisplaysLock, activePointerWindowLock (the last is shared by activePointerWindow + pointerButtonState); pointerButtonStateSnapshot() helper for motion/wheel reads
• putImageScratchLock with lazy SDL_AtomicLock spinlock init, process-long lifetime; lock/unlock helpers pass the acquired SDL_mutex handle so a lazy-init race cannot make a thread unlock what it did not lock
• Event pipe fds initialized to -1, closed on last display close; dead fdopen(FILE*) leak path removed; closeEventPipe runs unconditional last-display teardown when remainingDisplays == 0

Build:

• Debug-only NULL guards on GET_WINDOW_STRUCT, GET_GC, GET_DISPLAY via extension statement expressions (release builds unchanged)
• STRICT=1 build variant adds -Werror to first-party objects only, applied via mk/common.mk and mk/xcompat-libs.mk
• New differential umbrella target runs motif-demos-check and violawww as separate sub-makes with set +e; aggregate exit reports both statuses on failure (one regression cannot mask the other)
• New mk/violawww.mk pinning the bolknote/violawww commit; Makefile includes it; externals/violawww/ added to .gitignore

CI:

• ViolaWWW build step in the motif job after demo smoke checks
• if: !cancelled() so a demo failure does not skip ViolaWWW (and ccache stats); workflow cancellation still aborts
• ViolaWWW build log uploaded as artifact on failure

Build commands run: make, make check, make
CFLAGS_EXTRA=-DDEBUG_LIBX11_COMPAT check, make STRICT=1.

---

Summary by cubic

Adds in‑process XTest/replay with resize and snapshot support, and gates deterministic UI smoke tests for Motif and violawww across CI and local runs. Also embeds a 6x13 fixed‑bitmap font and tightens drawing, focus/grab, and event behavior for reliability.

• New Features

  • XTest injection + scripted replay with motion/button/key, in‑process snapshots, and main‑thread resize; seqlock‑protected replay target for coherent (id, root) reads; tests/test-xtest added.
  • violawww gate: pinned build via mk/violawww.mk with patches to clear before redraw/scroll/resize and to use libXpm compat; new scroll/help replays, assertions, and differential runner.
  • Motif smoke: added ASan‑safe and iconv‑warning patches; runner uses a JSON assertion DSL; check-unit split from differential; CI installs DIFFERENTIAL_PKGS and runs smokes and references.
  • Fonts: embedded 6x13 bitmap fallback (used when LIBX11_COMPAT_FONT_DIR is unset) with length‑counted text paths; ASCII probe enables deterministic metrics.
  • API/behavior: XRenderSetPictureTransform stub; clamped XDoubleToFixed; top‑level windows start hidden and show on map; debug‑only NULL guards for GET_DISPLAY/GET_GC/GET_WINDOW_STRUCT.

• Bug Fixes

  • Drawing/image: GX raster‑op read‑modify‑write fallback; XCopyArea bounds; XPutImage stride checks and process‑long scratch lock; default opaque alpha for core X11 pixels; present‑flush event on draw.
  • Focus/pointer/grabs: tri‑state focus with correct Notify detail; XGetInputFocus reports the real kind; RevertToParent walks past unviewable ancestors; destroy auto‑revert and queued‑event discard; strict grab semantics (active/passive), cursor save/restore, 64‑bit XWarpPointer, NULL‑safe XQueryPointer.
  • Concurrency/events: dedicated locks for event queues and XPutImage; event pipe fds init to ‑1 with ordered teardown; replay stops before pipe shutdown; snapshot/resize user events run on the main thread; seqlock root fallback if retries exhaust.
  • Build/CI/tests: STRICT=1 applies -Werror to first‑party only; separate Motif and violawww diff steps; thresholds tuned; Motif fileview smoke stabilized with corrected click coords and delay; README updated with violawww example.

^{Written for commit b8d0fe9. Summary will update on new commits.}