https://bugs.documentfoundation.org/show_bug.cgi?id=173917
Bug ID: 173917
Summary: CRASH on startup (SIGABRT): insertThreadId() aborts on
macOS 27.0.x because pthread_threadid_np returns
thread IDs larger than UINT32_MAX
Product: LibreOffice
Version: 26.2.4.2 release
Hardware: ARM
OS: macOS (All)
Status: UNCONFIRMED
Severity: normal
Priority: medium
Component: LibreOffice
Assignee: [email protected]
Reporter: [email protected]
Description:
CRASH on startup (SIGABRT): insertThreadId() aborts on macOS 27.0.x because
pthread_threadid_np returns thread IDs larger than UINT32_MAX
Steps to Reproduce:
Launch LibreOffice (any module, or just the app itself). In this case, from the
Applications folder.
Actual Results:
Immediate crash — EXC_CRASH (SIGABRT), abort() called — before any window
appears. Happens on every launch.
Expected Results:
LibreOffice opens normally.
Reproducible: Always
User Profile Reset: Yes
Additional Info:
Crashing thread (main thread):
0 __pthread_kill
1 pthread_kill
2 abort
3 insertThreadId(_opaque_pthread_t*) + 352 [libuno_sal.dylib.3]
4 InitVCL() + 132 [libmergedlo.dylib]
5 ImplSVMain() + 308
6 soffice_main + 208
7 main + 20
Root cause (verified):
In sal/osl/unx/thread.cxx, insertThreadId() on macOS does:
uint64_t mac_tid;
pthread_threadid_np(nullptr, &mac_tid);
if (mac_tid > SAL_MAX_UINT32)
std::abort();
On macOS 27, pthread_threadid_np returns 64-bit thread IDs larger than 2^32 -
1.
Measured live on macOS 27.0.1: the main thread's TID was **7366983048
(0x1b71b3d88)** — for both nullptr and pthread_self() arguments, with return
value 0 (success). So the abort fires on every startup. Notably, the source
comment at that exact site anticipates this:
currently the value of pthread_threadid_np is the same [as]
syscall(SYS_thread_selfid), which returns an int as the TID.
may change, as the syscall interface was deprecated.
Additional notes:
Reproduced with a completely fresh user profile (renamed
~/Library/Application Support/LibreOffice/4/user away first) — this is not
profile corruption.
Affects every LibreOffice version carrying this check, on macOS 27.
(The check is still present in current master.)
Locally confirmed the diagnosis by NOP-ing the abort branch in the shipped
libuno_sal.dylib.3: LibreOffice then starts and runs normally.
Suggested fix:
Stop assuming thread IDs fit in 32 bits — e.g. widen oslThreadIdentifier
or fold/hash the 64-bit TID into the identifier space instead of aborting.
Full .ips crash report available.
Version: 26.8.1.1 (AARCH64)
Build ID: bf6ef2662401c7d6dce671ab4deb26ee0af3a7c1
CPU threads: 10; OS: macOS 27.0.1; UI render: Skia/Raster; VCL: osx
Locale: en-US (en_US.UTF-8); UI: en-US
Calc: threaded
--
You are receiving this mail because:
You are the assignee for the bug.
