red_zone_framer frames two leaves whose 4-byte cmp %rdi,(%rsp) sits
before a jne: after an add (inflate_fast's shape) and after a load below
rsp that heads the loop and moves by the shift inside the stub, and no
operand in a stub is also moved in place. A cmp whose loop branches back
to it stays refused, the widened stub covering the branch target. The
execution test runs both framed leaves under writes below rsp.
When the instruction after an rsp operand that cannot move in place is
a branch, a rip-relative instruction or a freeing add, the operand's stub
could stay shorter than a jump and the leaf was skipped. The stub now
also takes the contiguous sequential instructions before the operand,
moving their own rsp operands by the shift; the branch-target, site and
existing-stub checks run on the widened range, and the instructions it
covers leave the in-place moves. zlib's inflate_fast, whose only operand
left is a 4-byte cmp %rdi,(%rsp) between an add and a jne, frames this
way.
The backward extension is tibzejoker's, from their comment on
boykopovar/AnyPS5#5640: with it, 243 of Grand Theft Auto V's 991
red-zone leaves frame (240 before), inflate_fast among them, and one
leaf is left with no room for a stub.
red_zone_framer's leaf whose operand at rsp sits before a rip-relative
load now frames; the one before an exit stays refused, its forward
extension reaching the exit's pops.
Co-authored-by: tibzejoker <[email protected]>
scePthreadCreate returns ENAMETOOLONG for a name of 32 bytes or more without creating the thread, and scePthreadDetach returns ESRCH for a joined thread.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Retain DT_INIT presence when emitting the deferred Linux lifecycle slot. Check zero-valued initializers with and without preinit, native argument forwarding and return status, and the absent-tag case. Addresses the interaction with PR #6684 identified in review.
The new Windows loop cases in guest_directory required CreateSymbolicLinkW to succeed, so the test aborted on a host without Developer Mode or administrator rights. They now run only when CreateLinks created its links, which is how the other link checks in the file already skip, and keep their ELOOP assertions whenever link creation is allowed.
Increment returns -1 for an address outside every module and Decrement never fails, instead of throwing.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Measured on PS4 firmware 10.71 from processes compiled with SDK versions
0x01000051, 0x02ffffff, 0x03000000 and 0x05050001. From 0x03000000 on,
FormatRFC3339 returns INVALID_VALUE when the zone shift overflows or
underflows the tick, GetDayOfWeek checks the month before the year and
rejects years past 9999, and SetTime_t rejects negative seconds and
converts all 64 bits. 0x02ffffff and earlier keep the wrap, the year-first
order and the low 32 bits.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A 4-byte 256-bit store at the start of a segment followed by an AMD-only
site that can only be emitted in place (RDSEED, CLWB, MOVNTSS, ...) had no
preceding instruction to move, so WindowPlacer gave up with "No room for a
jump to the stub of 256-bit store within its neighbours or a nearby island".
Try a last-resort window placement that allows EmitOutOfLine to use the
in-place lowering for the follower. Preferred preceding and following moves
are unchanged.
A payload process on a PS5 (firmware 13.60) writes the mspace name at heap+0x3B0, its number at heap+0x3F4, the reason for error 1 and the pid and tid to standard output, then returns.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Felipebmaitan