macOS 26 – NSSound/CoreAudio causes SIGILL crash in caulk allocator

To learn more about this I need to see a full Apple crash report. Please post one, per the advice in Posting a Crash Report.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Hello DTS Engineer,

Please find attached whole log ,

You are correct that:

• This is memory management code.
• It’s trapped due to a failed assert.

Consider this:

(lldb) disas -a 0x00007ff821039082
caulk`caulk::alloc::consolidating_free_map<caulk::alloc::page_allocator, 10485760ul>::maybe_create_free_node:
    …
    0x7ff8210390a1 <+31>:  js     0x7ff8210390f9 ; <+119>
    …
    0x7ff8210390bb <+57>:  js     0x7ff8210390f9 ; <+119>
    …
    0x7ff8210390f9 <+119>: ud2    
    0x7ff8210390fb <+121>: nop    

As you can see, the instruction at +119 is a ud2, which is the canonical trap instruction for Intel code. There are two ways to get there, which isn’t as helpful as it could be, but the difference doesn’t really matter because both traps are associated with various invariant failures.

How reproducible is this? Are you debugging it based on reports coming in from the field? Or can you reproduce it in your office?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

I have reports from one user of our software with the exact same issue with macOS 26.4.1 We call [NSSound play] on a background thread in our app since ~ 2012. Maybe it should now be called on main thread ? However we have not had reports from other users, so I have asked them if they are using a different Audio Output to the Mac Built-in output. As maybe that is the difference. I have attached the crash log.

So, lemme see if I understand this correctly:

• You have one user who’s consistently experienced this crash on macOS 26.
• You’ve not received reports of it from other users.
• You can’t reproduce it yourself.

Is that right?

Has that users seen it on all versions of macOS 26? Or just macOS 26.4?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

I've encountered the same issue on both macOS 26.4 and macOS 26.5. The crash report is attached.

I've encountered the same issue

OK. Then I have the same question for you: How reproducible is it?

We’ve definitely seen bug reports about this. The conclusion is that, yeah, something is corrupting memory. It’s hard to be sure what that is, but we’ve made some changes to the OS to help debug it (r. 170652193). However, those changes are not yet in any released or seeded version of macOS.

If you’re hitting this, try running your app under the standard memory debugging tools. Those tools aim to turn hard-to-reproduce memory management issues into reproducible ones, and if they do that in this case then that’ll be a significant step in the direction of a fix.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Hello ,

Yes, we have been able to reproduce this issue in our office as well, but only 2 times so far on macOS 26.4.1. It appears to be an intermittent issue, and we are not able to reproduce it consistently or quickly.

Based on our investigation, this seems to occur in scenarios involving audio playback. We also made changes to ensure sound playback happens on the main thread and shared that build with the customer. However, the customer is still encountering the crash on their end.

We are attaching the customer crash log for reference. Please let us know if there are any specific areas in the crash log that we should focus on or if additional diagnostics would help.

I don’t think you’ll learn more from these crash reports. My advice is that you try to find a way to make this more reproducible. That’s what we need to further investigate the bug.

See my previous post for suggestions on how you might go about this.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Some of my clients have also experienced this type of crash, all of whom are running Android 26.4+ on an x86 architecture, and the problems are all related to audio playback. My product has two audio playback methods: one uses NSSound to play actual files, resulting in the same crash stack as others; the other uses OpenAL to play audio data, with the following crash stack:

Thread 60 Crashed: 0 caulk 0x00007ff825914090 _ZN5caulk5alloc16tiered_allocatorIJNS0_15size_range_tierILm0ELm1008ENS0_14tree_allocatorINS0_15chunk_allocatorINS0_14page_allocatorENS0_16bitmap_allocatorENS0_18embed_block_memoryELm16384EJLm16ELm6EEEEEEEENS2_ILm1009ELm256000ENS0_23guarded_edges_allocato + 598 1 AudioToolboxCore 0x00007ff81b3b3866 ExtendedAudioBufferList_Destroy + 98 2 AudioToolboxCore 0x00007ff81b196e06 _ZN4acv218AudioConverterBaseD2Ev + 226 3 AudioToolboxCore 0x00007ff81b362004 _ZN4acv213PCMConverter2D0Ev + 14 4 AudioToolboxCore 0x00007ff81b1f57b0 _ZNSt3__16vectorINS_10unique_ptrI10Resampler2NS_14default_deleteIS2_EEEENS_9allocatorIS5_EEE16__destroy_vectorclB9nqe210106Ev + 56 5 AudioToolboxCore 0x00007ff81b2d68e3 ZNSt3__110unique_ptrIN4acv219AudioConverterChainENS_14default_deleteIS2_EEE5resetB9nqe210106EPS2 + 25 6 AudioToolboxCore 0x00007ff81b2d4160 _ZN4acv216AudioConverterV2D0Ev + 30 7 AudioToolboxCore 0x00007ff81b2d923b AudioConverterDispose + 198 8 OpenAL 0x00007ffb278290f1 _ZN5ACMap19RemoveAllConvertersEv + 31 9 OpenAL 0x00007ffb27828f3e _ZN9OALSourceD2Ev + 226 10 OpenAL 0x00007ffb278259c4 _ZN10OALContext21CleanUpDeadSourceListEv + 124 11 OpenAL 0x00007ffb27825d52 _ZN10OALContext9AddSourceEj + 140 12 OpenAL 0x00007fFB2782006a alGenSources + 78 13 WSPlayer.dylib 0x00000001411b9aff SoundPlayer::Open(int, int, int) + 64255 (OpenAlSound.h:239)

0   caulk                                0x00007ff825914090 _ZN5caulk5alloc16tiered_allocatorIJNS0_15size_range_tierILm0ELm1008ENS0_14tree_allocatorINS0_15chunk_allocatorINS0_14page_allocatorENS0_16bitmap_allocatorENS0_18embed_block_memoryELm16384EJLm16ELm6EEEEEEEENS2_ILm1009ELm256000ENS0_23guarded_edges_allocato + 598
1   AudioToolboxCore                     0x00007ff81b3b3866 ExtendedAudioBufferList_Destroy + 98
2   AudioToolboxCore                     0x00007ff81b196e06 _ZN4acv218AudioConverterBaseD2Ev + 226
3   AudioToolboxCore                     0x00007ff81b362004 _ZN4acv213PCMConverter2D0Ev + 14
4   AudioToolboxCore                     0x00007ff81b1f57b0 _ZNSt3__16vectorINS_10unique_ptrI10Resampler2NS_14default_deleteIS2_EEEENS_9allocatorIS5_EEE16__destroy_vectorclB9nqe210106Ev + 56
5   AudioToolboxCore                     0x00007ff81b2d68e3 _ZNSt3__110unique_ptrIN4acv219AudioConverterChainENS_14default_deleteIS2_EEE5resetB9nqe210106EPS2_ + 25
6   AudioToolboxCore                     0x00007ff81b2d4160 _ZN4acv216AudioConverterV2D0Ev + 30
7   AudioToolboxCore                     0x00007ff81b2d923b AudioConverterDispose + 198
8   OpenAL                               0x00007ffb278290f1 _ZN5ACMap19RemoveAllConvertersEv + 31
9   OpenAL                               0x00007ffb27828f3e _ZN9OALSourceD2Ev + 226
10  OpenAL                               0x00007ffb278259c4 _ZN10OALContext21CleanUpDeadSourceListEv + 124
11  OpenAL                               0x00007ffb27825d52 _ZN10OALContext9AddSourceEj + 140
12  OpenAL                               0x00007ffb2782006a alGenSources + 78
13  WSPlayer.dylib                       0x00000001411b9aff SoundPlayer::Open(int, int, int) + 64255 (OpenAlSound.h:239)