Fix segfault when camera dispay closed. Closes #1372.

[hexonxons]

Description

Actually segfault happens in CBQueueCallback::call method while calling filter_->signalMessage(event_):

virtual CallResult call()
{
  if (success_)
  {
    filter_->signalMessage(event_);
  }
  else
  {
    filter_->signalFailure(event_, reason_);
  }

  return Success;
}

CBQueueCallback object is constructed in MessageFilter::messageReady method:

ros::CallbackInterfacePtr cb(new CBQueueCallback(this, evt, true, filter_failure_reasons::Unknown));
callback_queue_->addCallback(cb, (uint64_t)this);

and it holds MessageFilter pointer as argument:

 CBQueueCallback(MessageFilter* filter, const MEvent& event, bool success, FilterFailureReason reason)
    : event_(event)
    , filter_(filter)
    , reason_(reason)
    , success_(success)
    {}

At call time filter_ object is already destroyed in

rviz/src/rviz/image/image_display_base.cpp

Lines 204 to 208 in 57325fa

	void ImageDisplayBase::unsubscribe()
	{
	tf_filter_.reset();
	sub_.reset(new image_transport::SubscriberFilter());
	}

and this leads to segfault.

CBQueueCallback object is called from callback_queue_:

ros::CallbackInterfacePtr cb(new CBQueueCallback(this, evt, true, filter_failure_reasons::Unknown));
callback_queue_->addCallback(cb, (uint64_t)this);

which actually the same as update_nh_.getCallbackQueue():

• tf_filter constructed from update_nh_:

  rviz/src/rviz/image/image_display_base.cpp

  Lines 179 to 185 in 57325fa

  	tf_filter_.reset(new tf2_ros::MessageFilter<sensor_msgs::Image>(
  	*sub_,
  	*context_->getTF2BufferPtr(),
  	targetFrame_,
  	queue_size_property_->getInt(),
  	update_nh_
  	));

• MessageFilter ctor init callback_queue_ as callback_queue_(nh.getCallbackQueue()):

template<class F>
  MessageFilter(F& f, tf2::BufferCore& bc, const std::string& target_frame, uint32_t queue_size, const ros::NodeHandle& nh)
  : bc_(bc)
  , queue_size_(queue_size)
  , callback_queue_(nh.getCallbackQueue())
  {
    init();

    setTargetFrame(target_frame);

    connectInput(f);
  }

This all looks like a thread sync problem, but I wasn't able to track it.
I am unsure if it is bug in TF2 message filter, so I suggest to use less invasive method and fix this bug in RViz code by removing callback by id before message_filter reset.

[rhaschke]

Thanks a lot for your detailed analysis. Based on your work, I filed a PR in ros/geometry2#402. Closing here, as this should be fixed upstream.