Created attachment 8794 [details] [review]
Patch to fix problem.

Created attachment 8800 [details] [review]
Better...

This fixes a potential problem if dixLookupWindow fails, but I think maybe the entire thing is wrong. 

This all seems to be wrong though as I misunderstood what REQUEST is supposed to do.

Created attachment 8801 [details] [review]
Release passive grabs by walking tree

This should work but it's quite possible there is a better way to do it.

Created attachment 8810 [details] [review]
Release passive grabs by walking tree

The reason for the last change is using 
g->next isn't a good idea after deleting the grab and sometimes leads to a segfault.

Just doing
while ((g=wPassiveGrabs(pWin)))
works fine

Created attachment 8811 [details] [review]
Release passive grabs by walking tree

This last patch seems to be necessary when clients get closed down in an order like:
xterm opens app
close xterm app dies xterm dies

Not all the time though. I think I understand why it happens but it's difficult to explain...maybe someone else will be able to articulate it better.

The fact that this is necessary makes me wonder again if there is a better approach to this.

Sorry about the phenomenal bug spam, guys.  Adding xorg-team@ to the QA contact so bugs don't get lost in future.

Passive grabs are stored in the resource system and thus freed in FreeClientRessources().
Not sure if that was already the case when you reported the bug but they are freed now.