A sampler descriptor with BORDER_COLOR_TYPE 3 names an entry of the border
colour table, but the hardware reads it only through an axis that addresses
the border (clamp modes 4 to 7). DecodeSamplerResource threw for every
table border colour, so a sampler that clamps to the edge on all axes, as
PPSA21567's Armadillo Challenge 2 compute shader uses, stopped the title
although its border colour is never sampled. It now throws only when an
axis uses a border mode, the same rule the colour compare emulation
applies, and otherwise uses a fixed Vulkan border colour.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
s_movrels and s_movrelsd_2 read the source register through a chain of
selects keyed on the M0 offset, and the relative destination write is a
select between that value and the old register. When the old register
also appears in the chain, the NVIDIA compiler (RTX 5080, 610.74)
evaluates select(a, select(b, x, y), x) as select(a || b, y, x) instead
of select(a && !b, y, x), so s_movrelsd_2_b32 clobbered s13 whenever the
source offset was 3. Rewriting the select, a branch with a phi, a masked
xor or a small function array all fold back into the same form.
Build the read as an OR of select(offset == k, s[base + k], 0) terms, with
the base register used for offsets outside [1, count) as before. The
result is unchanged, and the select nesting the compiler mishandles no
longer forms.
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
The test now catches the exception that Parser::parse throws for a number
that overflows a double. Windows test executables need
configure_windows_unwind, as guest_png_dec_tests has, or the exception
cannot be unwound and the process terminates.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01R5WJS4ZdQynAJesCZKH5hb
Whether the console's parser rejects 1e309 or stores an infinite real
is unknown, and RFC 8259 allows both. Following the exact-or-throw rule,
sce::Json::Parser::parse now throws with the number text and a note that
the behaviour is unverified, instead of returning JsonErrorParse. The
partially built tree is freed before the exception leaves the parser.
The case is listed under unknown function info in TechnicalDebt.md.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01R5WJS4ZdQynAJesCZKH5hb
The parser stored strtod's result for 1e309 and similar numbers, so a
document with such a value parsed as an infinite real. Serializing it
then threw "cannot serialize a non-finite number", which escaped the
guest call and terminated the process. sce::Json::Parser::parse now
returns JsonErrorParse for a number that is not finite after conversion.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01R5WJS4ZdQynAJesCZKH5hb
3D textures in the 64 KiB Z and S XOR swizzles threw. As in AMD
addrlib's GFX10 rules, a Z_X volume is thin: each depth slice is laid
out like an array slice with the 2D Z_X equation, as the R_X and D_X
volumes already were. An S_X volume is thick: it takes the standard
64 KiB thick block and mip tail with its own S3 XOR equation, generated
from addrlib for the same configuration as the other equations.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The Smurfs Dreams (Unreal Engine) asks only for the game details and
passes a null data pointer; on success it reads the trophy count from the
details, on a negative result it takes its error path. The function
already fills each output only when it is given, but rejected the call
unless both were. Only a call without either output is rejected now.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A T# of type 12 (1D array) threw while decoding. It now decodes to a
1D array dimension, checked like a 2D array with a height of one, and
holds depth + 1 layers laid out as a 2D array's. Its Vulkan image is
1D with that many layers, viewed as VK_IMAGE_VIEW_TYPE_1D_ARRAY for
sampling and storage, and the recompiler declares a 1D array shape for
arrayed 1D image resources instead of failing.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
image_gather4_lz_o on a 1D view threw. The 1D gather emulation picks
the two texels around the coordinate itself, so the 6-bit x offset of
the address is added to the left texel index before both texel
centres are sampled, as the hardware offsets the footprint.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Titles that link the native module (The Smurfs Dreams imports
sceAudiodecClearContext and the other decoder exports from
libSceAudiodec.native) found only the dummy export there. Both modules
are now built from the same sources, as libSceFont and libSceAvPlayer
already do for their native modules.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
scePadVrControllerRead and scePadVrControllerGetDeviceInformation are
imported by titles that open PSVR2 Sense controller port types. No
library exported them, so eager binding failed at startup.
Declare them as throwing stubs: the VR controller port types are not
supported, and scePadOpen already rejects them.
sceAgcWriteDataPatchSetDst, sceAgcWriteDataPatchSetCachePolicy, their
Async forms and sceAgcAsyncWriteDataPatchSetAddressOrOffset threw. They
now rewrite a WRITE_DATA packet in place: the destination in the
graphics (sceAgcDcbWriteData) or compute (sceAgcAcbWriteData) encoding,
the cache policy in bits 25-26 and the address in dwords 2-3, so the
patched packet equals the one written with those values. A register
destination is rejected when the packet requests write confirmation,
as when the packet is written.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Unreal Engine reserves SET_*_REG_INDIRECT packets with a null register
list and no registers, and fills them in later with the
sceAgcSet*RegIndirectPatch* functions. The writers rejected the null
address. A null list is now accepted when it holds no registers, which
reads nothing; a null list with registers still throws.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
PPSA14632 (Unreal Engine) writes sceAgcCbBranch(mode 1, compare
function 0, mask 0, reference 0) with a then buffer and a null else
buffer of 0 dwords. It leaves the compare address uninitialised, so it
is sometimes only 4-byte aligned. The writer rejected the null else
buffer and the misaligned compare address, and the driver accepted
opcode 0x3f only as the 4-dword INDIRECT_BUFFER, so the 14-dword branch
would have failed at submission.
sceAgcCbBranch no longer checks the compare address of an always-pass
branch, which reads nothing, or the address of a buffer of 0 dwords.
The driver runs the first buffer of an always-pass COND_INDIRECT_BUFFER
in modes 1 and 2 (if-then and if-then-else) in place of the packet. A
comparison, a predicated branch and other modes throw.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The 106-key (Japanese) arrangement threw. Its alphanumeric layer now
follows the JIS layout of the HID usages: the symbol keys right of the
digits and letters, the Ro key (0x87) and the Yen key (0x89). With the
Kana LED set it still throws, as the kana the console returns are
unknown.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A thread suspended inside a system call returns through sysret, which
overwrites rcx and r11, so the delivery address passed in rcx was
garbage when the redirected thread resumed. PPSA12544 crashed that way
on its SaveDataProcessQueue thread, blocked in a host wait when Unity's
GC raised SIGUSR1. The redirected rip is now an entry stub that takes
the delivery from its fixed place above rsp. It also stores the live
general registers into the delivery's context first: the snapshot taken
while the thread was in the system call still holds the call number in
rax instead of its result, which the restore would have handed back to
the wait.
The guest test raises at a thread blocked on a host mutex in 20 rounds
and expects each delivery once the wait returns; it fails without this
change.
AI-assisted: yes
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A selection inside a loop whose arm either joins the other target or
continues/breaks (`if (a) { if (b) continue; x; }`) got the nearest
common post-dominator as its merge. When the loop exits after the outer
join, that is the outer selection's merge, so both selections shared
it. splitSharedMergeBlocks then inserted a forwarding block in front of
it, recomputed the same merge, and repeated until the budget ran out:
PPSA14632's compute shader 0x1a80ee0000 stopped with "CFG shared merge
splitting exceeded budget: originalBlocks=92 currentBlocks=460".
findSelectionMerge now picks the joined target when the other arm is a
conditional block with the header as its only predecessor, and every
successor of that arm is the joined target or the loop's continue or
merge block. The shader structures with 13 added blocks and no clones
or route variables.
In the result the outer selection header dominates the loop's continue
target, so the test's verifyStructured counted the continue target as a
selection member that branches outside (back to the loop header).
SPIR-V uses structural dominance, where the loop header's edge to its
continue target keeps it out of the selection, so verifyStructured now
skips the continue construct of an enclosing loop. spirv-val accepts
the new test's SPIR-V for both subgroup sizes.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A paused player returned no video at all. Unity's video player prepares
a clip by starting it, pausing, jumping to the start and polling
sceAvPlayerGetVideoDataEx until the frame at the jump arrives, and only
then resumes; PPSA12544 waited there forever on a black screen in its
intro cinematic. While paused, the first frame after a jump is now
delivered (the paused clock rebased to it); other frames are still held
until the player resumes. The guest test pauses, jumps and expects that
one frame and nothing after it.
AI-assisted: yes
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Its only NotImplemented_nid_no_patch call guarded the int range limit on the consumed byte count, so tools/progress.py listed the implemented function as missing. Throw std::out_of_range like sceHttpParseResponseHeader does for the same limit.
Four sources defined NOMINMAX unconditionally, which redefines the macro the build already passes and warns on every MinGW build. Use the #ifndef guard the rest of the tree uses.
sceAjmBatchJobControl threw. It now appends a control job that keeps
the sideband input pointer and runs at sceAjmBatchStart: RESET (bit 13)
clears the context as sceAjmBatchJobClearContext does, INITIALIZE
(bit 14) initializes the codec, and SIDEBAND_GAPLESS_DECODE (bit 45)
overwrites the gapless total and skip counts, in this order.
The sideband input holds the gapless decode first, then the codec's
initialize parameters: 8 bytes for ATRAC9, 12 for Opus, none for MP3.
The output is the 8-byte result. Other flags, INITIALIZE for other
codecs, and other sizes throw. SIDEBAND_GAPLESS_DECODE without RESET
throws too: RPCSX and shadPS4 keep zero counts there. The bits and the
order follow shadPS4 (PS4), the overwrite with RESET follows RPCSX, and
the sizes follow the one title seen.
PPSA14632 calls scePadReadState (eboot 0x4593a8) for the open pad and
then for a second pad slot it never opened, whose handle is 0. The
title skips only negative handles and ignores the result, but
scePadReadState threw for any handle other than the open one. It now
returns PAD_ERROR_INVALID_HANDLE (0x80920003), as the other pad
functions do and as shadPS4's scePadRead does for an unknown handle;
scePadRead passes it on.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
PPSA14632 calls sceAudioOut2Set3DLatency(0xFF, 1) during its audio
setup (eboot 0x5613e2c) and fails the setup on a nonzero return. Only
latency 2 from PPSA26344 was accepted, so the call threw. Latency 1 and
2 are now accepted for the system user; 0, 3 and other users still
throw.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
scePlayerInvitationDialogGetResult makes the common dialog checks of
sceWebBrowserDialogGetResult: NOT_INITIALIZED before the dialog is
initialized, ARG_NULL for a null result and NOT_FINISHED until the
dialog finishes. The dialog shows no UI and sends no invitation, so the
finished dialog reports USER_CANCELED with error code 0. The 40-byte
result layout (error code, result, 32 reserved bytes) is taken from
SharpProspero.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
