An invalid-descriptor fault check of a GPU-descriptor buffer access, and the
swizzle-selector check of a formatted load, is not emitted when an identical
check on the same descriptor under the same execution guard sits earlier in
the same IR block or in a dominating block. The fault record, the invocation
stop and the host error stay the same; only the pc stored for a fault that two
invocations race to record can differ. APS5_NO_FAULT_CHECK_DEDUP restores every
check.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A cached draw whose read-only inputs moved (MovedReadOnlyBuffers) snapshotted the moved inputs whatever their size, while PrepareDrawBindings binds any other input over the draw snapshot budget in place. A move whose inputs together exceed the budget is now refused, so the draw builds its resources and binds those inputs in place.
Console title libc.prx (PPSA26344) and libSceLibcInternal export aK1Ymf-NhAs as STT_OBJECT st_size 104; the previous sixteen-slot export was three entries long.
Apply review request from 2026-11-02: remove the source note and the per-string
code comments from the sceAjmStrError table (the provenance is in
docs/dev/debt/libSceAjm.native.md) and cut that debt entry below the
1,000-character limit, keeping the measured gap.
Co-authored-by: danzaio <[email protected]>
On macOS under Rosetta, Aps5StartGuest moves the main thread off the host
stack and releases the old range to the guest arena. dyld keeps its own
pointers into the process start block at the top of that range and offers
no call that redirects them, where argv and environ have one:
_NSGetExecutablePath copies the path string out of the block on every
call, so the first call after the move read unmapped memory and the
process died with KERN_PROTECTION_FAILURE. A title does not have to call
it: libxpc reaches it from xpc_connection_resume, and ShaderCacheDirectory
calls it for the shader disk cache.
Release the old stack only up to the pages that hold the block, and only
while argv still points into the stack. They are the top two pages, 8 KiB
of the 8372224-byte stack here, so a title that fixes a mapping over that
range now fails with a host region overlap; the rest is free as before.
guest_main_stack_move asked for a 64 KiB guest mapping aligned down from
a local of main, which falls inside the kept pages. It now probes the
64 KiB below them, requires the kept pages to be refused, and calls
_NSGetExecutablePath after the move, which segfaults without this change.
Resolve the HTTP/1.x transport merge (#11611): keep both includes in Transport.cpp, and add Cookie and CookieFlood to the test Mode enum after StallUpload, outside the Http10..Http1Plain and EarlyFinal ranges.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Dean Galvin