Fix dyld crash on macOS < 15 from unguarded quick_exit reference (#2564)

* Fix dyld crash on macOS < 15 from unguarded quick_exit reference

quick_exit only entered libSystem in macOS 15.0, and the SDK declares it
with no availability annotation:

    void	quick_exit(int) __dead2;        // _stdlib.h

It is gated on __DARWIN_C_LEVEL/C11 -- a compile-time feature gate, not an
OS-version gate -- so the compiler has no version information to act on. It
cannot warn (-Wunguarded-availability) and cannot weak-link. Building
against the macOS 15 SDK with an older deployment target therefore emits a
hard reference and links cleanly against the SDK's libSystem stub, but the
binary aborts on load on macOS < 15:

    dyld: Symbol not found: _quick_exit
      Referenced from: .../lib/libInterface_Application.dylib
      Expected in:     /usr/lib/libSystem.B.dylib

Xcode 16 ships only the macOS 15 SDK, so on macOS 14 this silently produces
a binary that cannot load on the machine that built it. SCIRun_test hit this
via the two regression-mode exits added in a0e0954.

Extract the call behind Core::quickExit, which falls back to _Exit when the
deployment target is below macOS 15.0. _Exit is C99 and always present, and
since nothing registers at_quick_exit handlers the two are equivalent here.

The literal 150000 is deliberate rather than __MAC_15_0: that constant is
undefined on SDKs older than 15 and would evaluate to 0, inverting the test
and reintroducing the crash on exactly the configurations it guards.

Verified on macOS 14.5 / Xcode 16.2: no _quick_exit references remain in the
build, both preprocessor branches compile (min 14.5 -> _Exit, min 15.0 ->
quick_exit), and lldb confirms the regression-mode path reaches _Exit and
propagates its exit code.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Add macOS 14 GUI build with an executable smoke test

CI had no job building the GUI on macOS < 15, for two independent reasons:
every mac-gui job runs on macOS-latest (currently the macos-26 image), and
the only macOS 14 jobs are headless -- where src/CMakeLists.txt:632 skips
ADD_SUBDIRECTORY(Interface) entirely. So nothing compiled src/Interface
against an older SDK and deployment target.

That gap is what let the previous commit's bug ship green: a macOS-15-only
libSystem symbol (quick_exit) linked cleanly on the macOS 26 runners and
aborted at load on macOS 14.

Add mac-gui-14-arm, pinned to the oldest available image (macos-13 is
retired; macos-14 is deprecated but still offered). Pinned rather than
tracking macOS-latest on purpose: the newest macOS is already covered
several times over, and only the oldest image exercises a lower deployment
target.

Also add a run-smoke-test input that executes the built binary. A green
build cannot detect this class of failure -- the dynamic loader resolves
linked libraries before main, so a reference to a symbol the host lacks
links cleanly and only aborts on execution. --help is sufficient, since the
loader has already resolved every dependency by the time main runs, and it
routes to ConsoleApplication (src/Main/scirunMain.cc) so no window server is
needed. --version is deliberately not used: it currently falls through to
GuiApplication and crashes on exit on macOS.

Unlike the existing test steps, the smoke step omits continue-on-error: it
must be able to fail the job, or it gates nothing. It selects SCIRun_test
where present (built on APPLE only, per src/Main/CMakeLists.txt) and falls
back to SCIRun elsewhere, failing loudly if neither exists.

Verified against a deliberately reverted build: the smoke test exits 134
with the original "dyld: Symbol not found: _quick_exit", and exits 0 with
the fix in place.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Enable the smoke test on the macOS headless builds

These jobs already build SCIRun_test -- src/Main/CMakeLists.txt adds it
unconditionally under IF(APPLE), regardless of BUILD_HEADLESS -- so
executing it costs seconds on top of an existing build and catches
load-time failures the build itself cannot.

Scope note: these jobs cannot catch the quick_exit class of bug on their
own. Headless builds skip ADD_SUBDIRECTORY(Interface) (src/CMakeLists.txt),
so they never compile the GUI libraries where that symbol was referenced;
mac-gui-14-arm remains the only job covering those. What these add is the
same load-time check over the Core/Dataflow/Modules dylibs, across macOS
14/15/26 and both arm64 and x86_64.

--help routes to ConsoleApplication in headless builds (the BUILD_HEADLESS
branch of src/Main/scirunMain.cc), so no window server is involved.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Always take _Exit on Apple instead of gating on deployment target

The version gate this replaces could not have worked. Nothing in the build sets
CMAKE_OSX_DEPLOYMENT_TARGET, so __MAC_OS_X_VERSION_MIN_REQUIRED follows the build
host and reads 150000 on exactly the macOS 15 builders that emit the hard
_quick_exit reference. The trigger is the SDK, not the host: a macOS 14 machine
with Xcode 16 installed builds the broken binary.

Both spellings also fail to compile against SDKs older than 15, which do not
declare quick_exit at all -- bare quick_exit as an undeclared identifier,
std::quick_exit as a reference to an unresolved using declaration, since libc++'s
<cstdlib> has no ::quick_exit to pull in.

_Exit is equivalent here as nothing registers at_quick_exit handlers, so take it
unconditionally on Apple and drop the version arithmetic entirely.

Verified against the 13.3 and 15.2 SDKs: compiles on both, and nm -u shows __Exit
with no _quick_exit reference. For contrast, std::quick_exit against the 15.2 SDK
compiles clean and emits _quick_exit, which is the load-time failure on macOS < 15.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: dcwhite

.github/workflows/mac.yml

@@ -39,6 +39,27 @@ jobs:
       build-with-python: true
       artifact-name: SCIRunMacInstaller-26-intel
 
+  # Oldest available macOS image, built with the GUI. Every other mac-gui job runs
+  # on macOS-latest (currently the macos-26 image), and the only macOS 14 jobs are
+  # headless -- but src/CMakeLists.txt skips ADD_SUBDIRECTORY(Interface) when
+  # BUILD_HEADLESS is on, so without this job nothing compiles src/Interface for an
+  # older macOS at all. That gap let a macOS-15-only libSystem symbol (quick_exit)
+  # link cleanly on the 26 runners and abort at load on macOS 14 (PR #2564).
+  #
+  # Pinned deliberately to the oldest image rather than macOS-latest: running the
+  # newest macOS is already covered several times over, and only the oldest one
+  # exercises the lower deployment target. macOS-14 is deprecated by GitHub, so when
+  # it is retired this should be bumped to the next-oldest image, not deleted.
+  mac-gui-14-arm:
+    uses: ./.github/workflows/reusable-build.yml
+    with:
+      runner: macOS-14
+      qt-version: '6.10.2'
+      scirun-qt-min-version: '6.3.1'
+      variant: gui
+      build-with-python: true
+      run-smoke-test: true
+
   mac-gui-nonpython:
     uses: ./.github/workflows/reusable-build.yml
     with:
@@ -69,13 +90,15 @@ jobs:
       runner: macOS-latest
       variant: headless
       build-testing: true
+      run-smoke-test: true
 
   mac-headless-14-arm:
     uses: ./.github/workflows/reusable-build.yml
     with:
       runner: macOS-14
       variant: headless
       build-testing: true
+      run-smoke-test: true
 
   mac-headless-14-arm-slim:
     uses: ./.github/workflows/reusable-build.yml
@@ -85,13 +108,15 @@ jobs:
       build-testing: true
       build-with-python: false
       run-unit-tests: true
+      run-smoke-test: true
 
   mac-headless-15-arm:
     uses: ./.github/workflows/reusable-build.yml
     with:
       runner: macOS-15
       variant: headless
       build-testing: true
+      run-smoke-test: true
 
   mac-headless-15-arm-slim:
     uses: ./.github/workflows/reusable-build.yml
@@ -101,13 +126,15 @@ jobs:
       build-testing: true
       build-with-python: false
       run-unit-tests: true
+      run-smoke-test: true
 
   mac-headless-15-intel:
     uses: ./.github/workflows/reusable-build.yml
     with:
       runner: macOS-15-intel
       variant: headless
       build-testing: true
+      run-smoke-test: true
 
   mac-headless-15-intel-slim:
     uses: ./.github/workflows/reusable-build.yml
@@ -117,10 +144,12 @@ jobs:
       build-testing: true
       build-with-python: false
       run-unit-tests: true
+      run-smoke-test: true
 
   mac-headless-26:
     uses: ./.github/workflows/reusable-build.yml
     with:
       runner: macOS-26
       variant: headless
       build-testing: true
+      run-smoke-test: true

.github/workflows/reusable-build.yml

@@ -38,6 +38,10 @@ on:
         required: false
         type: boolean
         default: false
+      run-smoke-test:
+        required: false
+        type: boolean
+        default: false
       run-regression-tests:
         required: false
         type: boolean
@@ -203,6 +207,34 @@ jobs:
 
           Pop-Location
 
+      - name: Smoke test - executable loads and runs (Unix)
+        if: ${{ inputs.run-smoke-test && runner.os != 'Windows' }}
+        working-directory: bin/SCIRun
+        # A successful build does NOT prove the binary can start. The dynamic loader
+        # resolves linked libraries at load time, before main, so a reference to a
+        # symbol the host OS lacks links cleanly and only aborts on execution.
+        # Actually running the executable is what catches that class of failure;
+        # --help suffices, because the loader has already resolved every dependency
+        # by the time main runs, and --help routes to ConsoleApplication (see
+        # src/Main/scirunMain.cc) so no window server is needed.
+        #
+        # Deliberately NO continue-on-error: unlike the test steps below, this step
+        # must be able to fail the job, or it gates nothing.
+        run: |
+          set -eux
+          # SCIRun_test is the unbundled executable, built on APPLE only
+          # (src/Main/CMakeLists.txt); other platforms build SCIRun directly.
+          if [ -x ./SCIRun_test ]; then
+            APP=./SCIRun_test
+          elif [ -x ./SCIRun ]; then
+            APP=./SCIRun
+          else
+            echo "No SCIRun executable found in $(pwd)" >&2
+            ls -la
+            exit 1
+          fi
+          "$APP" --help
+
       - name: Package (optional - Unix/macOS)
         if: ${{ inputs.artifact-name != '' && runner.os != 'Windows' }}
         shell: bash

src/Core/Utils/CMakeLists.txt

@@ -38,6 +38,7 @@ SET(Core_Utils_HEADERS
   FileUtil.h
   Lockable.h
   Macros.h
+  QuickExit.h
   Singleton.h
   StringContainer.h
   StringUtil.h

src/Core/Utils/QuickExit.h

@@ -0,0 +1,75 @@
+/*
+   For more information, please see: http://software.sci.utah.edu
+
+   The MIT License
+
+   Copyright (c) 2020 Scientific Computing and Imaging Institute,
+   University of Utah.
+
+   Permission is hereby granted, free of charge, to any person obtaining a
+   copy of this software and associated documentation files (the "Software"),
+   to deal in the Software without restriction, including without limitation
+   the rights to use, copy, modify, merge, publish, distribute, sublicense,
+   and/or sell copies of the Software, and to permit persons to whom the
+   Software is furnished to do so, subject to the following conditions:
+
+   The above copyright notice and this permission notice shall be included
+   in all copies or substantial portions of the Software.
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+   THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+   LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+   FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+   DEALINGS IN THE SOFTWARE.
+*/
+
+
+#ifndef CORE_UTILS_QUICKEXIT_H
+#define CORE_UTILS_QUICKEXIT_H
+
+#include <cstdlib>
+
+namespace SCIRun
+{
+namespace Core
+{
+
+/// Terminates the process immediately, skipping static destructors and atexit
+/// handlers, while still propagating @a code to the caller (e.g. CTest). Used in
+/// regression mode to avoid hangs and crashes in async teardown paths where
+/// streaming execution threads outlive the GUI objects.
+///
+/// Apple always takes _Exit so that one build runs on every supported macOS.
+/// quick_exit entered libSystem in macOS 15.0, which breaks both directions:
+///
+///   - Against SDKs older than 15, it is not declared at all. Both spellings fail to
+///     compile -- "quick_exit" as an undeclared identifier, "std::quick_exit" as a
+///     reference to an unresolved using declaration, since libc++'s <cstdlib> has no
+///     ::quick_exit to pull in.
+///   - Against the 15 SDK it is declared ("void quick_exit(int) __dead2;" in
+///     _stdlib.h) gated only on __DARWIN_C_LEVEL/C11 -- a compile-time feature gate
+///     carrying no availability annotation -- so the compiler can neither warn nor
+///     weak-link. The object gets a hard _quick_exit reference and aborts on load on
+///     macOS < 15 with "dyld: Symbol not found: _quick_exit".
+///
+/// The trigger is the SDK, not the host: a macOS 14 machine with Xcode 16 installed
+/// builds the broken binary. Gating on __MAC_OS_X_VERSION_MIN_REQUIRED does not help
+/// either, because the deployment target is not pinned -- it follows the build host,
+/// and so reads 150000 on exactly the builders that emit the hard reference.
+///
+/// The two branches are equivalent only so long as nothing registers at_quick_exit
+/// handlers: _Exit does not run them.
+[[noreturn]] inline void quickExit(int code)
+{
+#ifdef __APPLE__
+  std::_Exit(code);
+#else
+  std::quick_exit(code);
+#endif
+}
+
+}}
+
+#endif

src/Interface/Application/GuiCommands.cc

@@ -31,6 +31,7 @@
 #include <numeric>
 #include <Core/Algorithms/Base/AlgorithmVariableNames.h>
 #include <Core/Application/Preferences/Preferences.h>
+#include <Core/Utils/QuickExit.h>
 #include <Interface/Application/SCIRunMainWindow.h>
 #include <Interface/Application/GuiCommands.h>
 #include <Interface/Application/GuiLogger.h>
@@ -268,10 +269,10 @@ bool NetworkFileProcessCommand::execute()
   if (failTestOnError() && Application::Instance().parameters()->isRegressionMode())
   {
     GuiLogger::logErrorStd("Regression import failed, exiting non-zero: " + filename);
-    // Mirrors SCIRunMainWindow::exitApplication's regression-mode behavior
-    // (which calls quick_exit) so the regression test reports a failure. Done
-    // directly here because exitApplication is a private slot.
-    std::quick_exit(1);
+    // Mirrors SCIRunMainWindow::exitApplication's regression-mode behavior so the
+    // regression test reports a failure. Done directly here because
+    // exitApplication is a private slot.
+    quickExit(1);
   }
   return false;
 }

src/Interface/Application/SCIRunMainWindowQtOverrides.cc

@@ -27,6 +27,7 @@
 
 #include <cstdlib>
 #include <Core/Application/Application.h>
+#include <Core/Utils/QuickExit.h>
 #include <Core/Application/Preferences/Preferences.h>
 #include <Core/Logging/Log.h>
 #include <Core/Utils/Legacy/MemoryUtil.h>
@@ -66,12 +67,12 @@ void SCIRunMainWindow::exitApplication(int code)
   if (Application::Instance().parameters()->saveViewSceneScreenshotsOnQuit())
   { networkEditor_->saveImages(); }
   returnCode_ = code;
-  // In regression mode, use quick_exit to avoid hangs/crashes in async teardown
+  // In regression mode, exit immediately to avoid hangs/crashes in async teardown
   // paths where streaming execution threads outlive the GUI objects (e.g. the
   // async streaming test networks). The exit code is still propagated to CTest.
   if (Application::Instance().parameters()->isRegressionMode())
   {
-    std::quick_exit(code);
+    quickExit(code);
   }
   close();
   qApp->exit(code);