Comment 51 for bug 220628

(In reply to comment #25)
> The xid comes from xcb_generate_id, so I peeked in there at the algorithm it
> uses, and noticed something funny. xcb_generate_id stores its state in the
> dpy->xcb->connection->xid struct. At the time of the crash, some members of
> this struct:
> xid.base == 56623104
> xid.inc == 1
> xid.last == 57206504
> xid.max == 57206499
>
> By my reading, it should be impossible for xid.last to exceed xid.max, yet here
> we are.

(In reply to comment #26)
> Asked on the xcb list:
> http://lists.freedesktop.org/archives/xcb/2009-January/004247.html

Nice detective work. Thanks!