quick fix to stop the crash. Need to have a closer look tomorrow.

From 7dafc83481957c190ca7220736343717f45a1177 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@redhat.com>
Date: Thu, 4 Dec 2008 16:36:23 +1000
Subject: [PATCH] Xi: don't update VCP's valuators from DeviceValuator events #18882

The VCP doesn't need to update the valuators anyway since it cannot send XI
events. Just skip that bit.

X.Org Bug 18882 <http://bugs.freedesktop.org/show_bug.cgi?id=18882>
---
 Xi/exevents.c |    8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/Xi/exevents.c b/Xi/exevents.c
index 00a6b21..8eef400 100644
--- a/Xi/exevents.c
+++ b/Xi/exevents.c
@@ -781,12 +781,14 @@ UpdateDeviceState(DeviceIntPtr device, xEvent* xE, int count)
     }
 
     /* Update device axis */
-    for (i = 1; i < count; i++) {
+    /* Don't update valuators for the VCP, it never sends XI events anyway */
+    for (i = 1; !device->isMaster && i < count; i++) {
 	if ((++xV)->type == DeviceValuator) {
 	    int *axisvals;
             int first = xV->first_valuator;
             BOOL change = FALSE;
 
+
 	    if (xV->num_valuators &&
                 (!v || (xV->num_valuators &&
                       (first + xV->num_valuators > v->numAxes))))
@@ -1009,7 +1011,9 @@ ProcessOtherEvent(xEventPtr xE, DeviceIntPtr device, int count)
     }
 
     /* Valuator event handling */
-    for (i = 1; i < count; i++) {
+    /* Don't care about valuators for the VCP, it never sends XI events */
+
+    for (i = 1; !device->isMaster && i < count; i++) {
 	if ((++xV)->type == DeviceValuator) {
 	    int first = xV->first_valuator;
 	    if (xV->num_valuators

Thanks for the quick reply.  This fixes the issue at hand.  Moving the pointer using the pen is working, now, but clicks are not reported for the VCP, even though they are reported for the stylus device.  I'll look into this tomorrow.

> --- Comment #2 from Tom Jaeger <ThJaeger@gmail.com>  2008-12-04 00:14:28 PST ---
> Thanks for the quick reply.  This fixes the issue at hand.  Moving the pointer
> using the pen is working, now, but clicks are not reported for the VCP, even
> though they are reported for the stylus device.  I'll look into this tomorrow.

just looked into that, the wacom driver posts the button index, not the button
number. So button 1 is posted as button 0 (and therefore ignored). I'm
surprised this worked with 1.5, tbh. Not sure what changed, there probably the
button map lookup.
Simply adding xf86PostButtonEvent(... button_idx + 1... ) fixes the issue.

Thanks.  Unfortunately, there are still issues with the wacom driver and the latest beta.  When I press the button, regular pointer event processing stops, but XInput events continue to work for a while, and then after a few more clicks, event processing comes completely to a halt.  In addition, the server log file is flooded with the following message:

[dix] XIGetDevice failed on XACE restrictions (148)

Weirdly enough, the stylus works fine under gdm.

The "[dix] XIGetDevice failed on XACE restrictions (148)" error message is caused by line 1078 in getevents.c:
        kbp->deviceid |= MORE_EVENTS;
dixLookupDevice in XIGetDevice (l. 155 in exevents.c) is then called with a non-existent device id.  Changing line 153 to
        id = ((deviceKeyButtonPointer*)xE)->deviceid & ~MORE_EVENTS;
fixes the error message for me, but unfortunately the problems with the wacom driver remain.

Pushed as 
commit 78a62d7713c708d067d8824ec41b0a0225c1997f
Author:     Tom Jaeger <ThJaeger@gmail.com>
Date: Mon Dec 8 11:38:12 2008 +1000

    Xi: XIGetDevice needs to ignore the MORE_EVENTS flag.

on my 1.6 branch the tablet now appears to work fine. Thats after
cherry-picking 725eec9ffcdbb19b dix: fix calculation of valuator events in
addition to the two patches here.

I still notice two behaviours: every so often the XI coordinates jump back to
the upper left corner, and there's something that can screw the device's
state, so it doesn't paint but always attempts to move the canvas. I haven't
been able to figure out the source for either problem yet.

Thanks, this is working great now.

Closing this bug for now, please reopen if you find more issues.

Reopening bug, was closed prematurely. Added as 1.6 blocker, will be closed when patch is in 1.6 branch.

Patch was merged into server-1.6-branch. Closing

http://cgit.freedesktop.org/xorg/xserver/commit/?h=server-1.6-branch&id=9a44cc619f3296b0faca97b0959e19c208f143bb