fix(Executor): Fix segfault if callback group is deleted during rmw_wait

Signed-off-by: Janosch Machowinski <[email protected]>

Author: Janosch Machowinski

rclcpp/src/rclcpp/executor.cpp

@@ -729,18 +729,35 @@ Executor::wait_for_work(std::chrono::nanoseconds timeout)
   // Clear any previous wait result
   this->wait_result_.reset();
 
+  // we need to make sure that callback groups don't get out of scope
+  // during the wait. As in jazzy, they are not covered by the DynamicStorage,
+  // we explicitly hold them here as a bugfix
+  std::vector<rclcpp::CallbackGroup::SharedPtr> cbgs;
+
   {
     std::lock_guard<std::mutex> guard(mutex_);
+
     if (this->entities_need_rebuild_.exchange(false) || current_collection_.empty()) {
       this->collect_entities();
     }
+
+    auto callback_groups = this->collector_.get_all_callback_groups();
+    cbgs.resize(callback_groups.size());
+    for(const auto & w_ptr : callback_groups) {
+      auto shr_ptr = w_ptr.lock();
+      if(shr_ptr) {
+        cbgs.push_back(std::move(shr_ptr));
+      }
+    }
   }
   this->wait_result_.emplace(wait_set_.wait(timeout));
   if (!this->wait_result_ || this->wait_result_->kind() == WaitResultKind::Empty) {
     RCUTILS_LOG_WARN_NAMED(
       "rclcpp",
       "empty wait set received in wait(). This should never happen.");
   } else {
+    // drop references to the callback groups, before trying to execute anything
+    cbgs.clear();
     if (this->wait_result_->kind() == WaitResultKind::Ready && current_notify_waitable_) {
       auto & rcl_wait_set = this->wait_result_->get_wait_set().get_rcl_wait_set();
       if (current_notify_waitable_->is_ready(rcl_wait_set)) {