Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

EventsCBGExecutor segfaults when a timer is removed while its callback is running

クローズ
  • 何か問題がありますか？
#3,314 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@spurnvoj がすでに取り組んでいます。

2026年10月6日 から。

  • #3315 @spurnvoj による — オープン

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
35/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
cpp
領域
backend

調査の方向性

Start with timer_manager.hpp, especially the running timer's done callback and TimerQueue::remove_timer(); then read the shutdown path in events_cbg_executor.cpp. Reproduce with the linked gist and run the regression cases described in the issue. Done means callbacks can finish after timer removal or shutdown without a segfault, and the full rolling test suite passes.

索引モデルが issue の本文から書いたものです。

説明

bug
Generated by Generative AI

Root-cause analysis, reproducer and text drafting with help of Claude Code (claude-opus-5-5)

Operating System:

Ubuntu 24.04 x86_64; rolling checked in the ros:rolling container.

ROS version or commit hash:

Jazzy: rclcpp 28.1.22 (binary packages); origin/jazzy 53fa7aee has the same code. Rolling: rclcpp 33.1.0 (binary packages); origin/rolling afe12bfa has the same code.

RMW implementation (if applicable):

rmw_fastrtps_cpp (default). Originally seen with rmw_zenoh_cpp; the bug isn't RMW-related.

RMW Configuration (if applicable):

No response

Client library (if applicable):

rclcpp

'ros2 doctor --report' output

No response

Steps to reproduce issue
  • Gist: https://gist.github.com/spurnvoj/bd80f243880fe569a155421f7297ea3d
  • git clone into ws/src, colcon build, bash src/cbg_timer_removal_repro/run.sh 10
  • Setup: one node with a 1 s timer callback in EventsCBGExecutor; the timer is removed while that callback runs. Three modes:
    • remove_node: executor.remove_node(), no shutdown
    • sigint: Ctrl-C during spin()
    • sigint_spin_some: Ctrl-C during a spin_some() loop
Expected behavior

The callback finishes, the removed timer isn't re-armed, and the process exits normally.

Actual behavior

SIGSEGV right after the callback returns, in all 3 modes, every run: Jazzy 10/10, rolling 5/5.

#0 rcl_timer_get_next_call_time () from /opt/ros/jazzy/lib/librcl.so
#1 ?? () from /opt/ros/jazzy/lib/librclcpp.so
#2 std::_Function_handler<void (), rclcpp::executors::cbg_executor::TimerQueue::get_ready_timer_callbacks()::{lambda()#1}>::_M_invoke(...) from /opt/ros/jazzy/lib/librclcpp.so
#3 ... ReadyEntity::get_execute_function() ... from /opt/ros/jazzy/lib/librclcpp.so
#4 rclcpp::executors::EventsCBGExecutor::run(unsigned long, bool) () from /opt/ros/jazzy/lib/librclcpp.so
Additional information
  • Cause, timer_manager.hpp (jazzy 53fa7aee):
    • the done callback of a running timer keeps a raw TimerData * and this (l. 388-396);
    • TimerQueue::remove_timer() erases the unique_ptr<TimerData> (l. 218). That happens on node removal and in EventsCBGExecutor::shutdown(), which also destroys the whole timer_manager (events_cbg_executor.cpp l. 142, 159);
    • when the callback returns, add_timer_to_running_map() uses the freed data;
    • the comment at l. 391-394 says the data stays valid; that holds only against remove_if_dropped(), not against remove_timer().
  • Ctrl-C path: the shutdown guard condition's handler runs synchronously on the thread calling rclcpp::shutdown() (the signal handler thread). So shutdown frees state while worker threads are still running callbacks. The timer_manager.reset() comment, "no thread is working on it any more", doesn't hold.
  • Also reachable without shutdown: unloading a component (ComponentManager → remove_node) while one of its timers runs.
  • Real-world impact: component_container_events_cbg segfaults on Ctrl-C when a timer callback is in flight. Found in the MRS UAV system (multi-component containers).
  • Related but different bugs: #3312 / #3313 (queued events of removed nodes outlive the unloaded library), #3186 (double removal on shutdown).
  • Fix ready: https://github.com/fly4future/rclcpp/tree/fix/events-cbg-timer-removal (PR to follow):
    • internal to the source files only, no ABI change, backportable to Jazzy;
    • regression test with 3 cases: unfixed rolling 10/10 segfault per case, fixed 10/10 pass;
    • full rolling test suite passes.
主要言語
C++
スター
815
フォーク
572
平均マージ
6日 8時間
マージ済み PR（30日）
20

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

ros2/rclcpp のほかの issue

ros2/rclcpp の issue をすべて見る

似ている issue

C++ の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。