When a table column pointer is read through a phi, the offset taken from
one arm is substituted into the image handle after the merge. An offset
computed inside an arm does not dominate that use, so planning now refuses
it instead of producing an invalid module.
Adds a case where each arm computes its own offset; it plans as a table on
the previous head and is refused with this change.
AI-assisted: yes. Written with AI assistance and reviewed by me.
On Linux sceKernelGetdirentries copied the host d_type, so a directory under app0 that is a host symlink was listed as a link, and a title that only descends into directory entries skipped it. Inside the app0 tree, report a symlink (or an entry of unknown type) as the type of its target; links elsewhere, and dangling links, stay links.
liveStacks, protectedStackPages and guestStackMappings were plain
globals, so libkernel's static destructors freed them at exit while
detached threads could still unregister their stacks or look one up.
ThreadSanitizer reports the race in guest_pthread_join_detach: the main
thread's static destruction of liveStacks against a detached thread's
UnregisterStack under stackLock. The maps are now created once and
never destroyed, as Apr.cpp does for its globals.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
StorageTexture throws when none of an image's guest pages is committed.
Three titles reach it intermittently in runs of a few minutes, on AMD and
NVIDIA, and the log names no address. The entry states the gap and that
the console behavior for such a descriptor is not known.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Two unwind queries a title makes went wrong on macOS, so a C++ exception the title would catch ended the process instead: God of War Sons of Sparta (PPSA28997) stops on an IL2CPP exception it normally handles.
- sceKernelGetModuleInfoForUnwind found a relinked image and its PT_GNU_EH_FRAME header but left eh_frame_addr and eh_frame_size at zero, so the title's unwinder found no FDE for its own frame. The tables are now read with EhFrame::ReadTables over the image's load segments, as ModuleInfo does on Linux, and eh_frame_size includes the zero terminator, as on Linux.
- sceSysmoduleGetModuleInfoForUnwind read /proc/self/maps outside Windows and threw on every call on macOS. It now answers from mach_vm_region, with the image path from dladdr, as the Linux branch answers from the mapping.
guest_unwind_module_info now runs on macOS: the test executable carries the __APS5DATA,__meta program headers that the macOS dl_iterate_phdr reads from a relinked image. guest_sysmodule checks the macOS answers against mach_vm_region.
Co-authored-by: mugurc <[email protected]>
The interpolation modes test rounds a generated value to half precision
with std::ilogb(value) - 10. For a zero value std::ilogb returns
FP_ILOGB0 (INT_MIN on Linux), so the subtraction overflows: UBSan reports
a signed integer overflow in agc_driver_interpolation_modes. A zero is
already a half value, so it is returned as is, as the wrapped result
gave.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
parse() declared each LoadedEntry without an initializer. Several State
members (hasColorTarget, topology, viewport, negativeOneToOne, cullMode,
frontFace, blend) have no default member initializer, so the graphics
recipe of a compute record, which is never decoded, held indeterminate
values. Moving the entry into the loaded list then read them: UBSan
reports "load of value 6, which is not a valid value for type 'bool'"
in State's move constructor in agc_driver_pipeline_journal.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A 3D image_store bound to a 2D-array T# addresses the layer as z. Add a 2D-array runtime mode for write-only 3D storage images and drop stores whose layer is past the array.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The test replaces readlink to swap a descriptor at the probe. SharedMemory.cpp
calls readlink with a buffer of known size, which GCC turns into
__readlink_chk when it cannot prove the length; the AddressSanitizer build
does that, so the replacement never ran and scenarios 6 to 17 failed with
"descriptor replacement did not run". Forward __readlink_chk to the same
replacement.
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Limbo's bundled libSceFios2.prx (CUSA01664) has DTPMOD64 relocations
against a local section symbol with section index 0 and value 0, in a
module without section headers. As for a TLS relocation without a
symbol, the module and offset are the module's own TLS block, so a
DTPMOD64 or DTPOFF64 against such a symbol is passed on without it. A
section symbol that names a section or has a value, a TPOFF64, a module
without PT_TLS and a DTPMOD64 with an addend still fail.
image_gather4_c_a and image_gather4_c_o_a compile when the S# dword 3
holds only a ballot in its reserved bits, like image_sample_a, while
image_gather4_c and image_gather4_c_o with the same S# still refuse it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01BywPXoZACVi8ALV4JKvuPZ
Death Stranding 2 (PPSA02015) registers shaders with both and stops on
0xc8 ("unsupported MIMG opcode 0xc8"). LLVM's gfx1030 disassembler reads
the same words with bit 0 clear as image_gather4_c and image_gather4_c_o,
and the _a rows already in the table are the base opcode plus 0x80 with the
adjust flag, so both reuse the existing compare gathers with the adjust
flag set.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01BywPXoZACVi8ALV4JKvuPZ
CaptureFrames dropped the first two captured addresses, taking them to
be its own frame and the export's. A frame the unwinder adds in between
shifts that: in an ANYPS5_ENABLE_ASAN build the sanitizer's backtrace
interceptor is one, so the first record was the export in libc.prx and
guest_backtrace failed with "first frame is not in the calling module".
The exports now pass their own return address, and the records start at
the captured address equal to it. When no captured address matches, the
first two are dropped as before.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The test loads guest_module_args_host into a relinked guest, so in an
ANYPS5_ENABLE_ASAN build the ASan runtime is not first in the initial
library list and the guest stops before it runs. The other relinker
tests that load that host already take verify_asan_link_order=0
through add_asan_test_options; this one was added after them.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The 4x4 32-bit linear T# in drawSnapshotTableSetTests describes a
surface with a 64-texel pitch, 1024 bytes, but the test backed it with
64 bytes. Building the image tables reads the whole surface, so the test
read 960 bytes past its array: an ASan build reports a
global-buffer-overflow in agc_draw_descriptors. Size the texels as the
next test does and require that the surface fits them.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Yossi Yadgar