SIGSEGV in `td::ActorInfo::init` on macOS ARM64 (Apple Silicon) with BOM 3.5.0+td.1.8.62

[saydov]

Environment

OS	macOS 26.4 (Darwin 25.4.0)
CPU	Apple M4 Pro, arm64
JDK	Corretto 21.0.7+6-LTS (also reproduced on Homebrew OpenJDK 23.0.2)
BOM	it.tdlight:tdlight-java-bom:3.5.0+td.1.8.62
Natives	it.tdlight:tdlight-natives:4.0.585, classifier macos_arm64

Description

The JVM crashes with SIGSEGV during TDLib initialization on macOS ARM64 (Apple Silicon). The crash occurs in td::ActorInfo::init at offset +0x568, triggered from td::Td::init_managers(). It happens every time - 100% reproducible, no intermittent behavior.

The crash is a null pointer dereference: register x8=0x0000000000000000, the instruction stores to [x8, #0x8] → si_addr: 0x0000000000000008.

Downgrading to 3.4.4+td.1.8.52 (natives 4.0.558) resolves the issue. This suggests a regression in the td 1.8.62 native build for macOS ARM64.

Native stack trace

C  [libtdjni.macos_arm64...dylib+0x635bf8]  td::ActorInfo::init(...)+0x568
C  [libtdjni.macos_arm64...dylib+0x17e3e78]  td::Td::init_managers()+0x30d34
C  [libtdjni.macos_arm64...dylib+0x17aa7f8]  td::Td::init(td::Td::Parameters, td::Result<td::TdDb::OpenedDatabase>)+0x3128
C  [libtdjni.macos_arm64...dylib+0x17ec13c]  td::ClosureEvent<...>::run(td::Actor*)+0x70
C  [libtdjni.macos_arm64...dylib+0x2d92ed0]  td::Scheduler::do_event(td::ActorInfo*, td::Event&&)+0xa84
C  [libtdjni.macos_arm64...dylib+0x631490]  td::Scheduler::send_immediately_impl<...>(...)+0x25c
C  [libtdjni.macos_arm64...dylib+0x2d8bc64]  td::Scheduler::ServiceActor::loop()+0xa14
C  [libtdjni.macos_arm64...dylib+0x2d92ff4]  td::Scheduler::do_event(td::ActorInfo*, td::Event&&)+0xba8
C  [libtdjni.macos_arm64...dylib+0x2d97a00]  td::Scheduler::flush_mailbox(td::ActorInfo*)+0x100
C  [libtdjni.macos_arm64...dylib+0x2d97d1c]  td::Scheduler::run_mailbox()+0x210
C  [libtdjni.macos_arm64...dylib+0x2d98800]  td::Scheduler::run_events(td::Timestamp)+0x3c8
C  [libtdjni.macos_arm64...dylib+0x2d98a24]  td::Scheduler::run_no_guard(td::Timestamp)+0x124
C  [libtdjni.macos_arm64...dylib+0x2d898ac]  td::ConcurrentScheduler::run_main(td::Timestamp)+0xac
C  [libtdjni.macos_arm64...dylib+0x6369ec]  td::MultiImpl::MultiImpl(...)::lambda+0x4c
C  [libtdjni.macos_arm64...dylib+0x6367d4]  td::detail::ThreadPthread::run_thread(void*)+0xdc
C  [libsystem_pthread.dylib+0x6c58]  _pthread_start+0x88

Signal info: si_signo: 11 (SIGSEGV), si_code: 2 (SEGV_ACCERR), si_addr: 0x0000000000000008

Registers at crash

x8=0x0000000000000000  <- null pointer
x9=0x0000000b696df480

The faulting instruction attempts str x9, [x8, #0x8] - a store through a null pointer at offset 8.

Minimal reproducer

import it.tdlight.Init;
import it.tdlight.client.*;
import it.tdlight.jni.TdApi;
import java.nio.file.Path;
import java.util.concurrent.CountDownLatch;
import java.util.concurrent.TimeUnit;

public class TdLightCrashReproducer {
    public static void main(String[] args) throws Exception {
        Init.init();
        var settings = TDLibSettings.create(new APIToken(12345, "dummy_hash"));
        settings.setDatabaseDirectoryPath(Path.of("tdlib-test"));
        settings.setDownloadedFilesDirectoryPath(Path.of("tdlib-test", "downloads"));

        var factory = new SimpleTelegramClientFactory();
        var builder = factory.builder(settings);
        builder.addUpdateHandler(TdApi.UpdateAuthorizationState.class, u ->
            System.out.println("State: " + u.authorizationState.getClass().getSimpleName()));

        // Crashes in native code before auth prompt appears
        var client = builder.build(AuthenticationSupplier.user("+10000000000"));
        new CountDownLatch(1).await(30, TimeUnit.SECONDS);
        factory.close();
    }
}

pom.xml dependencies

<dependency>
    <groupId>it.tdlight</groupId>
    <artifactId>tdlight-java</artifactId>
</dependency>
<dependency>
    <groupId>it.tdlight</groupId>
    <artifactId>tdlight-natives</artifactId>
    <classifier>macos_arm64</classifier>
</dependency>

With BOM 3.5.0+td.1.8.62.

Workaround

Downgrade to BOM 3.4.4+td.1.8.52 (natives 4.0.558). The crash does not occur with this version.

Additional notes

• Tested with both JDK 21 (Corretto 21.0.7) and JDK 23 (Homebrew OpenJDK 23.0.2) - same crash on both.
• Deleting tdlib/ directory (fresh session) does not help.
• The crash happens during Td::init_managers(), before any user interaction.
• Linux ARM64 natives are not affected (tested via Docker).

[saydov]

@cavallium

[neverwhatlose]

reproduced on macOS 25.3.1 (Apple M3). Downgrading to BOM 3.4.4+td.1.8.52 fixed it.