PPSA14632 (Unreal Engine) writes sceAgcCbBranch(mode 1, compare
function 0, mask 0, reference 0) with a then buffer and a null else
buffer of 0 dwords. It leaves the compare address uninitialised, so it
is sometimes only 4-byte aligned. The writer rejected the null else
buffer and the misaligned compare address, and the driver accepted
opcode 0x3f only as the 4-dword INDIRECT_BUFFER, so the 14-dword branch
would have failed at submission.
sceAgcCbBranch no longer checks the compare address of an always-pass
branch, which reads nothing, or the address of a buffer of 0 dwords.
The driver runs the first buffer of an always-pass COND_INDIRECT_BUFFER
in modes 1 and 2 (if-then and if-then-else) in place of the packet. A
comparison, a predicated branch and other modes throw.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The 106-key (Japanese) arrangement threw. Its alphanumeric layer now
follows the JIS layout of the HID usages: the symbol keys right of the
digits and letters, the Ro key (0x87) and the Yen key (0x89). With the
Kana LED set it still throws, as the kana the console returns are
unknown.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A thread suspended inside a system call returns through sysret, which
overwrites rcx and r11, so the delivery address passed in rcx was
garbage when the redirected thread resumed. PPSA12544 crashed that way
on its SaveDataProcessQueue thread, blocked in a host wait when Unity's
GC raised SIGUSR1. The redirected rip is now an entry stub that takes
the delivery from its fixed place above rsp. It also stores the live
general registers into the delivery's context first: the snapshot taken
while the thread was in the system call still holds the call number in
rax instead of its result, which the restore would have handed back to
the wait.
The guest test raises at a thread blocked on a host mutex in 20 rounds
and expects each delivery once the wait returns; it fails without this
change.
AI-assisted: yes
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A selection inside a loop whose arm either joins the other target or
continues/breaks (`if (a) { if (b) continue; x; }`) got the nearest
common post-dominator as its merge. When the loop exits after the outer
join, that is the outer selection's merge, so both selections shared
it. splitSharedMergeBlocks then inserted a forwarding block in front of
it, recomputed the same merge, and repeated until the budget ran out:
PPSA14632's compute shader 0x1a80ee0000 stopped with "CFG shared merge
splitting exceeded budget: originalBlocks=92 currentBlocks=460".
findSelectionMerge now picks the joined target when the other arm is a
conditional block with the header as its only predecessor, and every
successor of that arm is the joined target or the loop's continue or
merge block. The shader structures with 13 added blocks and no clones
or route variables.
In the result the outer selection header dominates the loop's continue
target, so the test's verifyStructured counted the continue target as a
selection member that branches outside (back to the loop header).
SPIR-V uses structural dominance, where the loop header's edge to its
continue target keeps it out of the selection, so verifyStructured now
skips the continue construct of an enclosing loop. spirv-val accepts
the new test's SPIR-V for both subgroup sizes.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A paused player returned no video at all. Unity's video player prepares
a clip by starting it, pausing, jumping to the start and polling
sceAvPlayerGetVideoDataEx until the frame at the jump arrives, and only
then resumes; PPSA12544 waited there forever on a black screen in its
intro cinematic. While paused, the first frame after a jump is now
delivered (the paused clock rebased to it); other frames are still held
until the player resumes. The guest test pauses, jumps and expects that
one frame and nothing after it.
AI-assisted: yes
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Its only NotImplemented_nid_no_patch call guarded the int range limit on the consumed byte count, so tools/progress.py listed the implemented function as missing. Throw std::out_of_range like sceHttpParseResponseHeader does for the same limit.
Four sources defined NOMINMAX unconditionally, which redefines the macro the build already passes and warns on every MinGW build. Use the #ifndef guard the rest of the tree uses.
sceAjmBatchJobControl threw. It now appends a control job that keeps
the sideband input pointer and runs at sceAjmBatchStart: RESET (bit 13)
clears the context as sceAjmBatchJobClearContext does, INITIALIZE
(bit 14) initializes the codec, and SIDEBAND_GAPLESS_DECODE (bit 45)
overwrites the gapless total and skip counts, in this order.
The sideband input holds the gapless decode first, then the codec's
initialize parameters: 8 bytes for ATRAC9, 12 for Opus, none for MP3.
The output is the 8-byte result. Other flags, INITIALIZE for other
codecs, and other sizes throw. SIDEBAND_GAPLESS_DECODE without RESET
throws too: RPCSX and shadPS4 keep zero counts there. The bits and the
order follow shadPS4 (PS4), the overwrite with RESET follows RPCSX, and
the sizes follow the one title seen.
PPSA14632 calls scePadReadState (eboot 0x4593a8) for the open pad and
then for a second pad slot it never opened, whose handle is 0. The
title skips only negative handles and ignores the result, but
scePadReadState threw for any handle other than the open one. It now
returns PAD_ERROR_INVALID_HANDLE (0x80920003), as the other pad
functions do and as shadPS4's scePadRead does for an unknown handle;
scePadRead passes it on.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
PPSA14632 calls sceAudioOut2Set3DLatency(0xFF, 1) during its audio
setup (eboot 0x5613e2c) and fails the setup on a nonzero return. Only
latency 2 from PPSA26344 was accepted, so the call threw. Latency 1 and
2 are now accepted for the system user; 0, 3 and other users still
throw.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
scePlayerInvitationDialogGetResult makes the common dialog checks of
sceWebBrowserDialogGetResult: NOT_INITIALIZED before the dialog is
initialized, ARG_NULL for a null result and NOT_FINISHED until the
dialog finishes. The dialog shows no UI and sends no invitation, so the
finished dialog reports USER_CANCELED with error code 0. The 40-byte
result layout (error code, result, 32 reserved bytes) is taken from
SharpProspero.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Report the spacing the writing line applies: the modelled line places
each run at the sum of the previous advances, so every space is 0.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The plain-named twin of std::_Execute_once delegates to that symbol and inherits its call_once semantics; the name-equivalence assumption is recorded in TechnicalDebt. Registers guest_std_execute_once_tests.
