Copy constructor exception leaks intra-process message allocation

The leak is reported in rclcpp/experimental/intra_process_manager.hpp, inside IntraProcessManager::add_owned_msg_to_buffers() where allocation succeeds before message construction throws. Start by reading that function and its callers in the same header; use the provided reproducer with AddressSanitizer and LeakSanitizer to confirm behavior. Done means the failed copy propagates its exception and LeakSanitizer reports no leak. An open linked pull request already addresses this issue.

Generated by Generative AI

OpenAI Codex CLI 0.162.1 (model gpt-6-sol) assisted with the reproducer, source analysis, and issue text.

Operating System:

Ubuntu 24.04.5 LTS / x86_64 (Jazzy isolated rootfs); Ubuntu 26.04.1 LTS / x86_64 (Rolling isolated rootfs).

ROS version or commit hash:

Source-built rclcpp Jazzy 28.1.22 at 53fa7aeea86e8ed484f9465fa14059faf13a71f1; Rolling 33.1.0 at e7363f1027d5ea391500359bc1a2b17cb9d8d66f.

RMW implementation (if applicable):

rmw_fastrtps_cpp (Fast DDS) in both runs.

RMW Configuration (if applicable):

Default RMW configuration; ROS_LOCALHOST_ONLY=1, isolated ROS_DOMAIN_ID per run.

Client library (if applicable):

rclcpp.

'ros2 doctor --report' output

Not run inside the isolated rootfs. The source-built rclcpp commits, distro-specific underlays, operating systems, and RMW used for the reproducer are given above.

Steps to reproduce issue

1. Build the indicated rclcpp commit against its matching Jazzy or Rolling underlay. For a conventional installed workspace, source /opt/ros/<distro>/setup.bash and then the source-built workspace's install/setup.bash, and verify that both the headers and librclcpp come from the selected source build. The actual isolated runs below instead sourced only the matching underlay and explicitly selected the source-built header and library paths; they did not source an install overlay.
2. Put this complete file in repro.cpp:

#include <iostream>
#include <memory>
#include <stdexcept>
#include <string>
#include "rclcpp/rclcpp.hpp"
#include "std_msgs/msg/string.hpp"

struct ThrowingMessage
{
  std::string text;
  inline static bool fail_copy = false;
  ThrowingMessage() = default;
  ThrowingMessage(const ThrowingMessage & other) : text(other.text)
  {
    if (fail_copy) {throw std::runtime_error("controlled custom copy failure");}
  }
};

template<>
struct rclcpp::TypeAdapter<ThrowingMessage, std_msgs::msg::String>
{
  using is_specialized = std::true_type;
  using custom_type = ThrowingMessage;
  using ros_message_type = std_msgs::msg::String;
  static void convert_to_ros_message(const custom_type & source, ros_message_type & destination)
  {destination.data = source.text;}
  static void convert_to_custom(const ros_message_type & source, custom_type & destination)
  {destination.text = source.data;}
};

int main(int argc, char ** argv)
{
  rclcpp::init(argc, argv);
  int exit_code = 0;
  {
    using Adapter = rclcpp::TypeAdapter<ThrowingMessage, std_msgs::msg::String>;
    auto node = std::make_shared<rclcpp::Node>(
      "copy_exception", rclcpp::NodeOptions().use_intra_process_comms(true));
    auto pub = node->create_publisher<Adapter>("copy", 10);
    auto a = node->create_subscription<Adapter>("copy", 10,
      [](std::unique_ptr<ThrowingMessage>) {});
    auto b = node->create_subscription<Adapter>("copy", 10,
      [](std::unique_ptr<ThrowingMessage>) {});
    ThrowingMessage::fail_copy = true;
    try {
      pub->publish(std::make_unique<ThrowingMessage>());
      std::cerr << "copy exception was not propagated\n";
      exit_code = 2;
    } catch (const std::runtime_error & error) {
      std::cout << "expected exception: " << error.what() << std::endl;
    }
  }
  rclcpp::shutdown();
  return exit_code;
}

3. In the same directory, create CMakeLists.txt:

cmake_minimum_required(VERSION 3.16)
project(ipc_copy_exception_leak_repro)
find_package(ament_cmake REQUIRED)
find_package(rclcpp REQUIRED)
find_package(std_msgs REQUIRED)
add_executable(repro repro.cpp)
ament_target_dependencies(repro rclcpp std_msgs)

4. Configure, build, and run with LeakSanitizer enabled. Ensure the selected headers and librclcpp both come from the indicated source build:

cmake -S . -B build \
  -DCMAKE_CXX_FLAGS='-fsanitize=address,undefined -fno-omit-frame-pointer -g' \
  -DCMAKE_EXE_LINKER_FLAGS='-fsanitize=address,undefined'
cmake --build build -j2
ASAN_OPTIONS=detect_leaks=1:halt_on_error=1 ./build/repro

The recorded isolated runs used this environment and source selection (shown with the paths mounted inside each rootfs):

export ROS_DISTRO=rolling  # or jazzy, with its matching rootfs and source tree
source /opt/ros/$ROS_DISTRO/setup.bash
export LD_LIBRARY_PATH=/tmp/previous/runs/$ROS_DISTRO-baseline/build/rclcpp:${LD_LIBRARY_PATH:-}
cmake -S /tmp/task -B /tmp/ws/build \
  -DRCLCPP_SOURCE=/tmp/source \
  -DSOURCE_BUILD=/tmp/previous/runs/$ROS_DISTRO-baseline/build \
  -DSANITIZER=address,undefined
cmake --build /tmp/ws/build -j2 --target exception_probe
ASAN_OPTIONS=detect_leaks=1:halt_on_error=1 \
  UBSAN_OPTIONS=halt_on_error=1 /tmp/ws/build/exception_probe

Here /tmp/task contains the standalone exception_probe.cpp and a harness CMakeLists.txt that puts /tmp/source/rclcpp/include before underlay headers and points imported rclcpp::rclcpp to ${SOURCE_BUILD}/rclcpp/librclcpp.so. The simpler CMake file above assumes a correctly sourced conventional overlay. The source selection above is what produced the logs below; an install/setup.bash overlay was not sourced in the isolated runs.

The reproducer stores an unexpected no-exception result in exit_code and always calls rclcpp::shutdown() on that path. It only leaks when a copy constructor throws while a custom message is distributed to multiple owning intra-process buffers; a normal publish() is not claimed to leak.

Expected behavior

publish() propagates the copy exception, and storage allocated for the failed copy is released. With the controlled exception, LeakSanitizer reports no leak.

Actual behavior

Both unchanged source-built distributions propagate the exception and exit 1 under LeakSanitizer. Full allocation stacks from the final standalone reproducer runs:

Jazzy original source:

expected exception: controlled custom copy failure

=================================================================
==483029==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 32 byte(s) in 1 object(s) allocated from:
    #0 0x7818d4efe548 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:95
    #1 0x5dad038da8b4 in std::__new_allocator<ThrowingMessage>::allocate(unsigned long, void const*) /usr/include/c++/13/bits/new_allocator.h:151
    #2 0x5dad038981f2 in std::allocator_traits<std::allocator<ThrowingMessage> >::allocate(std::allocator<ThrowingMessage>&, unsigned long) /usr/include/c++/13/bits/alloc_traits.h:482
    #3 0x5dad038981f2 in void rclcpp::experimental::IntraProcessManager::add_owned_msg_to_buffers<ThrowingMessage, std::allocator<void>, std::default_delete<ThrowingMessage>, std_msgs::msg::String_<std::allocator<void> > >(std::unique_ptr<ThrowingMessage, std::default_delete<ThrowingMessage> >, std::vector<unsigned long, std::allocator<unsigned long> >, rclcpp::allocator::AllocRebind<ThrowingMessage>::allocator_type&) /tmp/source/rclcpp/include/rclcpp/experimental/intra_process_manager.hpp:586
    #4 0x5dad0387c3ac in void rclcpp::experimental::IntraProcessManager::do_intra_process_publish<ThrowingMessage, std_msgs::msg::String_<std::allocator<void> >, std::allocator<void>, std::default_delete<ThrowingMessage> >(unsigned long, std::unique_ptr<ThrowingMessage, std::default_delete<ThrowingMessage> >, rclcpp::allocator::AllocRebind<ThrowingMessage>::allocator_type&) /tmp/source/rclcpp/include/rclcpp/experimental/intra_process_manager.hpp:262
    #5 0x5dad0386eea4 in rclcpp::Publisher<rclcpp::TypeAdapter<ThrowingMessage, std_msgs::msg::String_<std::allocator<void> >, void>, std::allocator<void> >::do_intra_process_publish(std::unique_ptr<ThrowingMessage, std::default_delete<ThrowingMessage> >) /tmp/source/rclcpp/include/rclcpp/publisher.hpp:528
    #6 0x5dad0385d04d in std::enable_if<std::integral_constant<bool, true>::value&&std::is_same<ThrowingMessage, ThrowingMessage>::value, void>::type rclcpp::Publisher<rclcpp::TypeAdapter<ThrowingMessage, std_msgs::msg::String_<std::allocator<void> >, void>, std::allocator<void> >::publish<ThrowingMessage>(std::unique_ptr<ThrowingMessage, std::default_delete<ThrowingMessage> >) /tmp/source/rclcpp/include/rclcpp/publisher.hpp:356
    #7 0x5dad0380e350 in main /tmp/task/exception_probe.cpp:46
    #8 0x7818d362a1c9  (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: a4a7992a8e66555c8141ab2a08a8465ff6e0ea65)
    #9 0x7818d362a28a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: a4a7992a8e66555c8141ab2a08a8465ff6e0ea65)
    #10 0x5dad0380d024 in _start (/tmp/ws/build/exception_probe+0x67f024) (BuildId: 022b46cc23a191a59398e8a3add0ab916580016f)

SUMMARY: AddressSanitizer: 32 byte(s) leaked in 1 allocation(s).

Rolling original source:

expected exception: controlled custom copy failure

=================================================================
==482972==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 32 byte(s) in 1 object(s) allocated from:
    #0 0x70ba7692c73f in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:109
    #1 0x57482354a16a in std::__new_allocator<ThrowingMessage>::allocate(unsigned long, void const*) /usr/include/c++/15/bits/new_allocator.h:151
    #2 0x5748234ffa7d in std::allocator<ThrowingMessage>::allocate(unsigned long) /usr/include/c++/15/bits/allocator.h:203
    #3 0x5748234ffa7d in std::allocator_traits<std::allocator<ThrowingMessage> >::allocate(std::allocator<ThrowingMessage>&, unsigned long) /usr/include/c++/15/bits/alloc_traits.h:614
    #4 0x5748234ffa7d in void rclcpp::experimental::IntraProcessManager::add_owned_msg_to_buffers<ThrowingMessage, std::allocator<void>, std::default_delete<ThrowingMessage>, std_msgs::msg::String_<std::allocator<void> > >(std::unique_ptr<ThrowingMessage, std::default_delete<ThrowingMessage> >, std::vector<unsigned long, std::allocator<unsigned long> >, rclcpp::allocator::AllocRebind<ThrowingMessage>::allocator_type&) /tmp/source/rclcpp/include/rclcpp/experimental/intra_process_manager.hpp:630
    #5 0x5748234e8e53 in void rclcpp::experimental::IntraProcessManager::do_intra_process_publish<ThrowingMessage, std_msgs::msg::String_<std::allocator<void> >, std::allocator<void>, std::default_delete<ThrowingMessage> >(unsigned long, std::unique_ptr<ThrowingMessage, std::default_delete<ThrowingMessage> >, rclcpp::allocator::AllocRebind<ThrowingMessage>::allocator_type&) /tmp/source/rclcpp/include/rclcpp/experimental/intra_process_manager.hpp:263
    #6 0x5748234db861 in rclcpp::Publisher<rclcpp::TypeAdapter<ThrowingMessage, std_msgs::msg::String_<std::allocator<void> >, void>, std::allocator<void> >::do_intra_process_publish(std::unique_ptr<ThrowingMessage, std::default_delete<ThrowingMessage> >) /tmp/source/rclcpp/include/rclcpp/publisher.hpp:500
    #7 0x5748234cfe2c in std::enable_if<std::integral_constant<bool, true>::value&&std::is_same<ThrowingMessage, ThrowingMessage>::value, void>::type rclcpp::Publisher<rclcpp::TypeAdapter<ThrowingMessage, std_msgs::msg::String_<std::allocator<void> >, void>, std::allocator<void> >::publish<ThrowingMessage>(std::unique_ptr<ThrowingMessage, std::default_delete<ThrowingMessage> >) /tmp/source/rclcpp/include/rclcpp/publisher.hpp:335
    #8 0x57482349ebe0 in main /tmp/task/exception_probe.cpp:46
    #9 0x70ba7502a600  (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a600) (BuildId: 066527e430a32768d82741e00b81eebb1a872294)
    #10 0x70ba7502a717 in __libc_start_main (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a717) (BuildId: 066527e430a32768d82741e00b81eebb1a872294)
    #11 0x57482349dac4 in _start (/tmp/ws/build/exception_probe+0x5dbac4) (BuildId: e8a45ec3bc355cea50eb47906163d7a6b35b9f94)

SUMMARY: AddressSanitizer: 32 byte(s) leaked in 1 allocation(s).

The allocation occurs in IntraProcessManager::add_owned_msg_to_buffers() at MessageAllocTraits::allocate(allocator, 1). The next MessageAllocTraits::construct(allocator, ptr, *message) throws before the pointer is wrapped in MessageUniquePtr. A related copy site in that helper has the same allocation-before-ownership pattern for a ROS-message buffer.

Additional information

The fix can use a local allocation-only guard that calls MessageAllocTraits::deallocate(allocator, ptr, 1) if construction throws, then releases that guard after the existing MessageUniquePtr owns the successfully constructed object. The unconstructed object must not be destroyed.

A parameterized regression fixture with the same source on baseline and patched headers checks custom and ROS owning buffers: the two normal cases pass on both; the two constructor-throw cases fail on the original and pass with that narrow fix. The standalone repro's 32-byte leak and the test fixture's 8-byte leaked storage per failing case reflect different message types.

I searched open/closed issues and pull requests for the helper, constructor exceptions, leaks and intra-process delivery, and reviewed current open PR titles/bodies. No exact issue or active PR for this failure was found in that scope. Related #1519 / #1530 concern expired-subscription cleanup and a different deadlock. This report concerns copy-constructor failure only.