Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

EventsCBGExecutor segfaults when a timer is removed while its callback is running

Cerrado
  • ¿Algo no está bien?
#3,314 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@spurnvoj ya está trabajando en esto.

Desde el 6/10/2026.

  • #3315 de @spurnvoj — abierto

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
cpp
Área
backend

Línea de trabajo

Start with timer_manager.hpp, especially the running timer's done callback and TimerQueue::remove_timer(); then read the shutdown path in events_cbg_executor.cpp. Reproduce with the linked gist and run the regression cases described in the issue. Done means callbacks can finish after timer removal or shutdown without a segfault, and the full rolling test suite passes.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug
Generated by Generative AI

Root-cause analysis, reproducer and text drafting with help of Claude Code (claude-opus-5-5)

Operating System:

Ubuntu 24.04 x86_64; rolling checked in the ros:rolling container.

ROS version or commit hash:

Jazzy: rclcpp 28.1.22 (binary packages); origin/jazzy 53fa7aee has the same code. Rolling: rclcpp 33.1.0 (binary packages); origin/rolling afe12bfa has the same code.

RMW implementation (if applicable):

rmw_fastrtps_cpp (default). Originally seen with rmw_zenoh_cpp; the bug isn't RMW-related.

RMW Configuration (if applicable):

No response

Client library (if applicable):

rclcpp

'ros2 doctor --report' output

No response

Steps to reproduce issue
  • Gist: https://gist.github.com/spurnvoj/bd80f243880fe569a155421f7297ea3d
  • git clone into ws/src, colcon build, bash src/cbg_timer_removal_repro/run.sh 10
  • Setup: one node with a 1 s timer callback in EventsCBGExecutor; the timer is removed while that callback runs. Three modes:
    • remove_node: executor.remove_node(), no shutdown
    • sigint: Ctrl-C during spin()
    • sigint_spin_some: Ctrl-C during a spin_some() loop
Expected behavior

The callback finishes, the removed timer isn't re-armed, and the process exits normally.

Actual behavior

SIGSEGV right after the callback returns, in all 3 modes, every run: Jazzy 10/10, rolling 5/5.

#0 rcl_timer_get_next_call_time () from /opt/ros/jazzy/lib/librcl.so
#1 ?? () from /opt/ros/jazzy/lib/librclcpp.so
#2 std::_Function_handler<void (), rclcpp::executors::cbg_executor::TimerQueue::get_ready_timer_callbacks()::{lambda()#1}>::_M_invoke(...) from /opt/ros/jazzy/lib/librclcpp.so
#3 ... ReadyEntity::get_execute_function() ... from /opt/ros/jazzy/lib/librclcpp.so
#4 rclcpp::executors::EventsCBGExecutor::run(unsigned long, bool) () from /opt/ros/jazzy/lib/librclcpp.so
Additional information
  • Cause, timer_manager.hpp (jazzy 53fa7aee):
    • the done callback of a running timer keeps a raw TimerData * and this (l. 388-396);
    • TimerQueue::remove_timer() erases the unique_ptr<TimerData> (l. 218). That happens on node removal and in EventsCBGExecutor::shutdown(), which also destroys the whole timer_manager (events_cbg_executor.cpp l. 142, 159);
    • when the callback returns, add_timer_to_running_map() uses the freed data;
    • the comment at l. 391-394 says the data stays valid; that holds only against remove_if_dropped(), not against remove_timer().
  • Ctrl-C path: the shutdown guard condition's handler runs synchronously on the thread calling rclcpp::shutdown() (the signal handler thread). So shutdown frees state while worker threads are still running callbacks. The timer_manager.reset() comment, "no thread is working on it any more", doesn't hold.
  • Also reachable without shutdown: unloading a component (ComponentManager → remove_node) while one of its timers runs.
  • Real-world impact: component_container_events_cbg segfaults on Ctrl-C when a timer callback is in flight. Found in the MRS UAV system (multi-component containers).
  • Related but different bugs: #3312 / #3313 (queued events of removed nodes outlive the unloaded library), #3186 (double removal on shutdown).
  • Fix ready: https://github.com/fly4future/rclcpp/tree/fix/events-cbg-timer-removal (PR to follow):
    • internal to the source files only, no ABI change, backportable to Jazzy;
    • regression test with 3 cases: unfixed rolling 10/10 segfault per case, fixed 10/10 pass;
    • full rolling test suite passes.
Lenguaje dominante
C++
Estrellas
815
Forks
572
Merge medio
6 d 8 h
PR fusionados (30 d)
20

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de ros2/rclcpp

Todos los issues de ros2/rclcpp

Issues similares

Más issues de C++

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.