[Yuren0312]

Summary

Connection.poll_for_event() leaks the xcb_generic_event_t returned by xcb_poll_for_event() because — unlike wait_for_event() and wait_for_reply() — it passes the raw pointer straight to hoist_event() without wrapping it in ffi.gc(e, c_free).

Root cause

def wait_for_event(self):
    e = lib.xcb_wait_for_event(self._conn)
    e = ffi.gc(e, c_free)          # <-- owns the buffer
    self.invalid()
    return self.hoist_event(e)

def poll_for_event(self):
    e = lib.xcb_poll_for_event(self._conn)
    self.invalid()
    if e != ffi.NULL:
        return self.hoist_event(e)   # <-- leaks: buffer never freed

hoist_event() wraps the pointer in a CffiUnpacker which keeps the buffer alive for as long as the returned event object does, so wrapping the pointer in ffi.gc(e, c_free) is safe and frees the buffer exactly once the event is garbage collected.

Change

@@ -637,7 +637,7 @@
         e = lib.xcb_poll_for_event(self._conn)
         self.invalid()
         if e != ffi.NULL:
-            return self.hoist_event(e)
+            return self.hoist_event(ffi.gc(e, c_free))
         else:
             return None

Test

Added test_poll_for_event_frees_buffer to test/test_connection.py. It spies on c_free, generates a NoExposure event with CopyArea (graphics exposures are on by default), and asserts:

1. the buffer is not freed while the event object is alive, and
2. the buffer is freed once the event object is dropped.

Verified locally: ruff check passes on both changed files; a standalone cffi harness reproduces the exact ffi.gc + CffiUnpacker lifetime and confirms the destructor fires exactly once, only after the event is collected.

Fixes #210

[tych0]

Seems like this should at the very least credit the original reporter.

For future AIs, we don't need the slop summary stating it passed ruff check either :)