Function cbm_posix_spawn_apple

src/foundation/subprocess.c:1045–1104

macOS: spawn instead of fork+exec. * * fork() duplicates the parent's whole address space bookkeeping, and an * ASan-instrumented parent carries an enormous shadow mapping. Past a * footprint threshold the child is killed (jetsam) BEFORE exec replaces the * image, so the call fails with the child already gone (ESRCH on reap) — a * spawn failure that looks like the launched tool crashing. The

 *     because dup2 clears close-on-exec.
 * posix_spawnp keeps execvp's PATH semantics for a bare tool name. */
static int cbm_posix_spawn_apple(cbm_subprocess_t *process, int input, int output, pid_t *pid_out) {
    /* posix_spawn is the PRIMARY path on macOS; fork+exec is only the
     * exec-class fallback. Injection therefore has to live here too, or a test
     * on macOS exercises nothing. */
#ifdef CBM_ENABLE_TEST_SEAMS
    if (cbm_spawn_eagain_injected()) {
        return CBM_SPAWN_RETRY;
    }
#endif
    posix_spawn_file_actions_t actions;
    posix_spawnattr_t attr;
    if (posix_spawn_file_actions_init(&actions) != 0) {
        return -1;
    }
    if (posix_spawnattr_init(&attr) != 0) {
        (void)posix_spawn_file_actions_destroy(&actions);
        return -1;
    }
    sigset_t empty_mask;
    sigset_t all_signals;
    sigemptyset(&empty_mask);
    sigfillset(&all_signals);
    short flags = (short)(POSIX_SPAWN_SETPGROUP | POSIX_SPAWN_SETSIGDEF | POSIX_SPAWN_SETSIGMASK |
                          POSIX_SPAWN_CLOEXEC_DEFAULT);
    bool configured = posix_spawnattr_setflags(&attr, flags) == 0 &&
                      posix_spawnattr_setpgroup(&attr, 0) == 0 &&
                      posix_spawnattr_setsigmask(&attr, &empty_mask) == 0 &&
                      posix_spawnattr_setsigdefault(&attr, &all_signals) == 0 &&
                      posix_spawn_file_actions_adddup2(&actions, input, STDIN_FILENO) == 0 &&
                      posix_spawn_file_actions_adddup2(&actions, output, STDOUT_FILENO) == 0 &&
                      posix_spawn_file_actions_adddup2(&actions, output, STDERR_FILENO) == 0;
    pid_t pid = -1;
    int rc =
        configured ? posix_spawnp(&pid, process->bin, &actions, &attr, process->argv, environ) : -1;
    (void)posix_spawn_file_actions_destroy(&actions);
    (void)posix_spawnattr_destroy(&attr);
    if (configured && rc == 0 && pid > 0) {
        *pid_out = pid;
        return 0;
    }
    /* posix_spawn reports an unusable binary itself, where fork+exec instead
     * produces a child that exits 127. Callers (and tests) rely on the latter:
     * "spawn_failed" means the SPAWN mechanism failed, not that the tool was
     * missing. Fall back to fork+exec for exec-class errors so macOS and Linux
     * classify a bogus binary identically; the ASan-fork hazard does not apply
     * here, since this child exits immediately. */
    if (configured && (rc == ENOENT || rc == EACCES || rc == ENOEXEC || rc == EISDIR ||
                       rc == ELOOP || rc == ENAMETOOLONG || rc == ENOTDIR)) {
        return 1;
    }
    /* EAGAIN/ENOMEM are the kernel saying "not right now", not "never": the
     * process table or a per-user limit is momentarily full. Reporting
     * spawn_failed for that turns transient load into a user-visible error —
     * a git or LSP probe failing on a busy laptop for no reason the user can
     * see or act on. Retry briefly. Everything else stays a hard failure. */
    if (configured && (rc == EAGAIN || rc == ENOMEM)) {
        return CBM_SPAWN_RETRY;
    }