diff -u libxfixes-5.0/debian/changelog libxfixes-5.0/debian/changelog
--- libxfixes-5.0/debian/changelog
+++ libxfixes-5.0/debian/changelog
@@ -1,3 +1,11 @@
+libxfixes (1:5.0-4ubuntu2) precise; urgency=low
+
+  * debian/patches/01_fixesproto-v6.diff:
+    - Fix BarrierNotifyEvent layout, so that the xany union member
+      contains a valid Display.  Fixes crashes in Qt event handling.
+
+ -- Christopher James Halse Rogers <raof@ubuntu.com>  Tue, 13 Mar 2012 10:01:44 +1100
+
 libxfixes (1:5.0-4ubuntu1) precise; urgency=low
 
   * debian/control:
diff -u libxfixes-5.0/debian/patches/01_fixesproto-v6.diff libxfixes-5.0/debian/patches/01_fixesproto-v6.diff
--- libxfixes-5.0/debian/patches/01_fixesproto-v6.diff
+++ libxfixes-5.0/debian/patches/01_fixesproto-v6.diff
@@ -4,11 +4,11 @@
 
     libXFixes v6: Pointer barrier improvements
 
-diff --git a/include/X11/extensions/Xfixes.h b/include/X11/extensions/Xfixes.h
-index 8995d14..992bff1 100644
---- a/include/X11/extensions/Xfixes.h
-+++ b/include/X11/extensions/Xfixes.h
-@@ -259,11 +259,48 @@ XFixesCreatePointerBarrier(Display *dpy, Window w, int x1, int y1,
+Index: libxfixes-dev/include/X11/extensions/Xfixes.h
+===================================================================
+--- libxfixes-dev.orig/include/X11/extensions/Xfixes.h	2012-03-13 09:36:56.810984004 +1100
++++ libxfixes-dev/include/X11/extensions/Xfixes.h	2012-03-13 09:39:08.842990643 +1100
+@@ -259,11 +259,48 @@
  			   int x2, int y2, int directions,
  			   int num_devices, int *devices);
  
@@ -28,11 +28,11 @@
 +
 +typedef struct {
 +    int type;			/* event base */
-+    int subtype;
 +    unsigned long serial;
 +    Bool send_event;
 +    Display *display;
 +    Window window;
++    int subtype;
 +    BarrierEventID event_id;
 +    int directions;
 +    PointerBarrier barrier;
@@ -57,11 +57,11 @@
  _XFUNCPROTOEND
  
  #endif /* _XFIXES_H_ */
-diff --git a/src/Cursor.c b/src/Cursor.c
-index b3dfed1..6053046 100644
---- a/src/Cursor.c
-+++ b/src/Cursor.c
-@@ -334,3 +334,84 @@ XFixesDestroyPointerBarrier(Display *dpy, PointerBarrier b)
+Index: libxfixes-dev/src/Cursor.c
+===================================================================
+--- libxfixes-dev.orig/src/Cursor.c	2012-03-13 09:36:56.810984004 +1100
++++ libxfixes-dev/src/Cursor.c	2012-03-13 09:38:44.842989436 +1100
+@@ -334,3 +334,84 @@
      UnlockDisplay (dpy);
      SyncHandle();
  }
@@ -146,11 +146,11 @@
 +    UnlockDisplay (dpy);
 +    SyncHandle();
 +}
-diff --git a/src/Xfixes.c b/src/Xfixes.c
-index c32ee39..dc41e25 100644
---- a/src/Xfixes.c
-+++ b/src/Xfixes.c
-@@ -253,6 +253,26 @@ XFixesWireToEvent(Display *dpy, XEvent *event, xEvent *wire)
+Index: libxfixes-dev/src/Xfixes.c
+===================================================================
+--- libxfixes-dev.orig/src/Xfixes.c	2012-03-13 09:36:56.810984004 +1100
++++ libxfixes-dev/src/Xfixes.c	2012-03-13 09:38:44.842989436 +1100
+@@ -253,6 +253,26 @@
  	aevent->cursor_name = awire->name;
  	return True;
      }
@@ -177,7 +177,7 @@
      }
      return False;
  }
-@@ -292,6 +312,22 @@ XFixesEventToWire(Display *dpy, XEvent *event, xEvent *wire)
+@@ -292,6 +312,22 @@
  	awire->cursorSerial = aevent->cursor_serial;
  	awire->name = aevent->cursor_name;
      }