From 1c655b3084a2ff0c831ab8baae2a7853e3661358 Mon Sep 17 00:00:00 2001 From: Chris Lalancette Date: Wed, 16 Dec 2020 19:56:47 +0000 Subject: [PATCH] Move the guard condition cleanup after removing callback. Otherwise, the callback could attempt to take a reference to a guard condition that has already been deleted. Signed-off-by: Chris Lalancette --- rcl/src/rcl/timer.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/rcl/src/rcl/timer.c b/rcl/src/rcl/timer.c index c4f9880ab..52423ea41 100644 --- a/rcl/src/rcl/timer.c +++ b/rcl/src/rcl/timer.c @@ -209,16 +209,19 @@ rcl_timer_fini(rcl_timer_t * timer) // Will return either RCL_RET_OK or RCL_RET_ERROR since the timer is valid. rcl_ret_t result = rcl_timer_cancel(timer); rcl_allocator_t allocator = timer->impl->allocator; - rcl_ret_t fail_ret = rcl_guard_condition_fini(&(timer->impl->guard_condition)); - if (RCL_RET_OK != fail_ret) { - RCL_SET_ERROR_MSG("Failure to fini guard condition"); - } + rcl_ret_t fail_ret; if (RCL_ROS_TIME == timer->impl->clock->type) { + // The jump callbacks use the guard condition, so we have to remove it + // before freeing the guard condition below. fail_ret = rcl_clock_remove_jump_callback(timer->impl->clock, _rcl_timer_time_jump, timer); if (RCL_RET_OK != fail_ret) { RCUTILS_LOG_ERROR_NAMED(ROS_PACKAGE_NAME, "Failed to remove timer jump callback"); } } + fail_ret = rcl_guard_condition_fini(&(timer->impl->guard_condition)); + if (RCL_RET_OK != fail_ret) { + RCL_SET_ERROR_MSG("Failure to fini guard condition"); + } allocator.deallocate(timer->impl, allocator.state); timer->impl = NULL; return result;