Core Stack

gsignal+0x38/0x78 (libc-2.23.so +0x31528)
uselocale+0x2f4/0x68 (libc-2.23.so +0x2ac04)
__assert_fail+0x4c/0x4c (libc-2.23.so +0x2acac)
_ZN5boost15recursive_mutex4lockEv+0x78/0xa0
_ZN5boost11unique_lockINS_15recursive_mutexEE4lockEv+0x13c/0x230
_ZN3ros10Connection4dropENS0_10DropReasonE+0x84/0x2b4 (libroscpp.so +0xa1554)

Crash Site

scoped_lock is using typedef boost::unique_lock, assertion with unique_lock is either no mutex or already owns the mutex in the same thread. in this case, expecting the former, which means Connection object owns this drop_mutex_ is gone at this time.

Expected Scenario

1. Publisher::Impl::unadvertise (thread-A) Publication::dropAllConnections() here it will call ConnectionManager::onConnectionDropped to push the connection in disconnected list. during deleting TransportSubscriberLink list, it gets context switch. (TransportSubscriberLink also possess the shared pointer to connection.)
2. PollManager::threadFunc (thread-B) ConnectionManager::removeDroppedConnections() disconnected list is swapped, so deleting the shared pointers which belonged to ConnectionManager. (at this point, connection objects are still alive, because TransportSubscriberLink still has reference.)
3. PollManager::threadFunc (thread-B) Connection::drop(), at the entrance it gets context switched.
4. thread-A resumes, delete Connection::drop completely. this means reference to connection from TransportSubscriberLink is now gone. Connection object gone.
5. thread-B resumes, accessing Connection object members which are already freed. boom!!!!