Segfault from Undefined Behavior

When I tried to run a harmless looking code snippet from Figure 11.5 Thread Cleanup Handler of book Advanced Programming in Unix Environment¹, I kept getting this "segmentation fault" or "bus error" in macOS. This sample code demonstrates the usage of cleanup handlers for pthreads, and a simplified version is listed below for referene:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <pthread.h>

void
cleanup(void *arg)
{
  fprintf(stdout, "cleanup: %s\n", (char *)arg);
}

void *
thr_fn1(void *arg)
{
  fprintf(stdout, "thread 1 start\n");
  pthread_cleanup_push(cleanup, "thread 1 first handler");
  pthread_cleanup_push(cleanup, "thread 1 second handler");

  fprintf(stdout, "thread 1 push complete\n");
  if (arg) {
    return ((void *)1);
  }
  pthread_cleanup_pop(0);
  pthread_cleanup_pop(0);

  return ((void *)1);
}

int
main(void)
{
  int err;
  pthread_t tid1;
  void *tret;

  err = pthread_create(&tid1, NULL, thr_fn1, (void *)1);
  if (err != 0)
    fprintf(stderr, "Can't create thread 1: %s\n", strerror(err)), exit(1); 

  err = pthread_join(tid1, &tret);
  if (err !=0 )
    fprintf(stderr, "can't join with thread 1: %s\n", strerror(err)), exit(1);

  fprintf(stdout, "thread 1 exit code %ld\n", (long)tret);
  exit(0);
}

Run the code and the reslult looks like this:

thread 1 start
thread 1 push complete
cleanup: thread 1 second handler
Segmentation fault: 11

Since the error was thrown in the line of pthread_join(3), I initially thought there's something wrong with the way I invoke this library function. What makes things worse, is that the manual of these pthread functions in macOS all claim that they conform to the standard, e.g. The pthread_join() function conforms to ISO/IEC 9945-1:1996 (“POSIX.1”). So what exactly is going on?

As it turns out, those claims are indeed true. However, the POSIX.1 standard for pthread_cleanup_push and pthread_cleanup_pop includes the following words: "The effect of the use of return, break, continue, and goto to prematurely leave a code block described by a pair of pthread_cleanup_push() and pthread_cleanup_pop() functions calls is undefined." – And this undefined part depends on implementation: GNU/Linux and macOS handle it differently.

As expressed in the POSIX.1 standard and explicitly stated in the book¹, the "portable way to return in between these two functions is to call pthread_exit". In order to make the code above work across different systems, the only change needed is to replace the first return ((void *)1); with pthread_exit((void *)1);. With this one line change applied, code run now results into the expected output:

thread 1 start
thread 1 push complete
cleanup: thread 1 second handler
cleanup: thread 1 first handler
thread 1 exit code 1

End of story.

This undefined behavior is a new concept to me, since I rarely saw them in my previous spec readings. I assume it will become more common when one is getting closer to system programming.

Also, I choose to put content of Figure 11.6 from the same book¹ here for reference. More entries might get added here as I delve deeper into the topic.