OS: Ubuntu 9.04 Jaunty 
Xephyr: xserver-xephyr 1.6.0-0ubuntu14

Description:
Using Nokia Maemo SDK 5 beta environment with Xephyr.
Xephyr is started with parameters: Xephyr :2 -host-cursor -screen 800x480x16 -dpi 96 -ac &
When in the SDK a user clicks on any application' textbox then Xephyr is crashing with segfault:
-------
Backtrace (10 deep):
0: Xephyr(KdBacktrace+0x35) [0x80c1595]
1: /lib/tls/i686/cmov/libc.so.6 [0xb7a87778]
2: Xephyr(DeliverDeviceEvents+0x20f) [0x808fabf]
3: Xephyr(ProcessOtherEvent+0x36c) [0x81910cc]
4: Xephyr(mieqProcessInputEvents+0x372) [0x80f0da2]
5: Xephyr(ProcessInputEvents+0xd) [0x80c620d]
6: Xephyr(Dispatch+0x6e) [0x80b329e]
7: Xephyr(main+0x3bd) [0x809869d]
8: /lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe5) [0xb7a72775]
9: Xephyr [0x8070741]

Fatal server error:
Segmentation fault caught
-------

I have grabbed the source and managed to reproduce the crash running in gdb. It seems the following line cause the crashing from dix/events.c:2108 
in function named DeliverEventsToWindow
        
        (*pDev->deviceGrab.ActivateGrab)(pDev, &tempGrab,
                                        currentTime, TRUE | ImplicitGrabMask);
The problem is that the *pDev->deviceGrab.ActiveGrab is zero. See below the content of the *pDev before the line would be executed:

(gdb) p * pDev
$32 = {public = {devicePrivate = 0x0, processInputProc = 0x8189720 <ProcessOtherEvent>, 
    realInputProc = 0x8189720 <ProcessOtherEvent>, enqueueInputProc = 0x808ce80 <EnqueueEvent>, 
    on = 1}, next = 0x0, startup = 1, deviceProc = 0x80c5630 <KdPointerProc>, inited = 1, 
  enabled = 1, coreEvents = 1, deviceGrab = {grabTime = {months = 0, milliseconds = 177133522}, 
    fromPassiveGrab = 0, implicitGrab = 0, activeGrab = {next = 0x0, resource = 0, device = 0x0, 
      window = 0x0, ownerEvents = 0, keyboardMode = 0, pointerMode = 0, coreGrab = 0, 
      coreMods = 0, type = 0 '\0', modifiersDetail = {exact = 0, pMask = 0x0}, 
      modifierDevice = 0x0, detail = {exact = 0, pMask = 0x0}, confineTo = 0x0, cursor = 0x0, 
      eventMask = 0, deviceMask = 0, genericMasks = 0x0}, grab = 0x0, activatingKey = 0 '\0', 
    ActivateGrab = 0, DeactivateGrab = 0, sync = {frozen = 0, state = 0, other = 0x0, event = 0x0, 
      evcount = 0}}, isMaster = 0, type = 72, name = 0x94e0450 "Xephyr virtual mouse", 
  id = 3 '\003', key = 0x0, valuator = 0x94df210, button = 0x94df0e0, focus = 0x0, 
  proximity = 0x0, absolute = 0x0, kbdfeed = 0x0, ptrfeed = 0x94e0430, intfeed = 0x0, 
  stringfeed = 0x0, bell = 0x0, leds = 0x0, xkb_interest = 0x0, config_info = 0x0, 
  devPrivates = 0x0, nPrivates = 0, unwrapProc = 0, spriteInfo = 0x9468fd4, u = {
    master = 0x9467c00, lastSlave = 0x9467c00}, last = {valuators = {425, 307, 
      0 <repeats 34 times>}, remainder = {0 <repeats 36 times>}, numValuators = 3}, properties = {
    properties = 0x93e9be8, handlers = 0x93e9c18}}
(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x00000000 in ?? ()
(gdb) bt
#0  0x00000000 in ?? ()
#1  0x0808f28f in DeliverDeviceEvents (pWin=0x822b840, xE=0x94c86e8, grab=0x0, stopAt=0x0, 
    dev=0x9468db0, count=2) at events.c:2349
#2  0x08189a8c in ProcessOtherEvent (xE=0x94c86e8, device=0x9468db0, count=2) at exevents.c:1081
#3  0x080efb82 in mieqProcessInputEvents () at mieq.c:474
#4  0x080c59dd in ProcessInputEvents () at kinput.c:2350
#5  0x080b2c76 in Dispatch () at dispatch.c:399
#6  0x08097e6d in main (argc=8, argv=0xbfc7fcb4, envp=0x0) at main.c:397
(gdb)

I have no idea who and when should that ActivateGrab variable filled with something but I guess at least the crash would be possible to overcome if the content would be checked before the call. (I am just a tester so I am just guessing this.)

ADDITIONAL INFORMATION:

The above situation was also tested under Ubuntu 8.10 Intrepid with xserver-xephyr 1.5.2-2ubuntu3.1 and it was not possible to reproduce.

I have tried to compile also the newest version of xorg-xserver from GIT but I couldn't compile because of several dependencies just not available or not "new" enough in the ubuntu repositories. But I checked the latest events.c file and it seems the content is about the same :-) Sorry, but this is how far I was able to get with this bug as a tester.