Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

EventsCBGExecutor segfaults when a timer is removed while its callback is running

Aperta
  • Qualcosa non va?
#3,314 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@spurnvoj ci sta già lavorando.

Dal 6/10/2026.

  • #3315 di @spurnvoj — aperta

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
cpp
Ambito
backend

Direzione di ricerca

Start with timer_manager.hpp, especially the running timer's done callback and TimerQueue::remove_timer(); then read the shutdown path in events_cbg_executor.cpp. Reproduce with the linked gist and run the regression cases described in the issue. Done means callbacks can finish after timer removal or shutdown without a segfault, and the full rolling test suite passes.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug
Generated by Generative AI

Root-cause analysis, reproducer and text drafting with help of Claude Code (claude-opus-5-5)

Operating System:

Ubuntu 24.04 x86_64; rolling checked in the ros:rolling container.

ROS version or commit hash:

Jazzy: rclcpp 28.1.22 (binary packages); origin/jazzy 53fa7aee has the same code. Rolling: rclcpp 33.1.0 (binary packages); origin/rolling afe12bfa has the same code.

RMW implementation (if applicable):

rmw_fastrtps_cpp (default). Originally seen with rmw_zenoh_cpp; the bug isn't RMW-related.

RMW Configuration (if applicable):

No response

Client library (if applicable):

rclcpp

'ros2 doctor --report' output

No response

Steps to reproduce issue
  • Gist: https://gist.github.com/spurnvoj/bd80f243880fe569a155421f7297ea3d
  • git clone into ws/src, colcon build, bash src/cbg_timer_removal_repro/run.sh 10
  • Setup: one node with a 1 s timer callback in EventsCBGExecutor; the timer is removed while that callback runs. Three modes:
    • remove_node: executor.remove_node(), no shutdown
    • sigint: Ctrl-C during spin()
    • sigint_spin_some: Ctrl-C during a spin_some() loop
Expected behavior

The callback finishes, the removed timer isn't re-armed, and the process exits normally.

Actual behavior

SIGSEGV right after the callback returns, in all 3 modes, every run: Jazzy 10/10, rolling 5/5.

#0 rcl_timer_get_next_call_time () from /opt/ros/jazzy/lib/librcl.so
#1 ?? () from /opt/ros/jazzy/lib/librclcpp.so
#2 std::_Function_handler<void (), rclcpp::executors::cbg_executor::TimerQueue::get_ready_timer_callbacks()::{lambda()#1}>::_M_invoke(...) from /opt/ros/jazzy/lib/librclcpp.so
#3 ... ReadyEntity::get_execute_function() ... from /opt/ros/jazzy/lib/librclcpp.so
#4 rclcpp::executors::EventsCBGExecutor::run(unsigned long, bool) () from /opt/ros/jazzy/lib/librclcpp.so
Additional information
  • Cause, timer_manager.hpp (jazzy 53fa7aee):
    • the done callback of a running timer keeps a raw TimerData * and this (l. 388-396);
    • TimerQueue::remove_timer() erases the unique_ptr<TimerData> (l. 218). That happens on node removal and in EventsCBGExecutor::shutdown(), which also destroys the whole timer_manager (events_cbg_executor.cpp l. 142, 159);
    • when the callback returns, add_timer_to_running_map() uses the freed data;
    • the comment at l. 391-394 says the data stays valid; that holds only against remove_if_dropped(), not against remove_timer().
  • Ctrl-C path: the shutdown guard condition's handler runs synchronously on the thread calling rclcpp::shutdown() (the signal handler thread). So shutdown frees state while worker threads are still running callbacks. The timer_manager.reset() comment, "no thread is working on it any more", doesn't hold.
  • Also reachable without shutdown: unloading a component (ComponentManager → remove_node) while one of its timers runs.
  • Real-world impact: component_container_events_cbg segfaults on Ctrl-C when a timer callback is in flight. Found in the MRS UAV system (multi-component containers).
  • Related but different bugs: #3312 / #3313 (queued events of removed nodes outlive the unloaded library), #3186 (double removal on shutdown).
  • Fix ready: https://github.com/fly4future/rclcpp/tree/fix/events-cbg-timer-removal (PR to follow):
    • internal to the source files only, no ABI change, backportable to Jazzy;
    • regression test with 3 cases: unfixed rolling 10/10 segfault per case, fixed 10/10 pass;
    • full rolling test suite passes.
Lingua principale
C++
Stelle
814
Fork
572
Merge medio
5g 3h
PR unite (30g)
17

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di ros2/rclcpp

Tutte le issue di ros2/rclcpp

Issue simili

Altre issue su C++

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.