Embedded vertex-fetch lifting can use a stale offset or pre-add index #11977

What happens

Two asset-free vertex programs fetch the wrong rows when embedded vertex fetching is lifted:

• A: the entry offset in s16 is 16, but the shader overwrites it with 2 before the index add. The direct draw still folds the entry value 16.
• B: the formatted fetch reads an index saved before the offset add. The direct draw still treats that fetch as using the post-add index.
• C: a normal post-add snapshot is the positive control. It should keep lifting.

Reproduced on main 75f3702aed32762d0efcde60e998e7edb93c8ae2 using Windows 11 Pro build 26200, WinLibs GCC 15.2.0/UCRT r7 and an NVIDIA GeForce RTX 3080 Laptop GPU, driver 610.74. All intended and poison fetch regions in the fixture are allocated; this checks wrong values, without an intentional GPU fault.

Results

The same executable was run in separate processes against independently built main and candidate libraries. Its SHA-256 is b1e47570876516ab419f202077f3289623c3d79fafdd22ad8d0e42797ac78170. The loaded libSceAgcDriver.prx path was checked for each process.

For A/B on main, slots 0–2 stay deadbeef while the values appear in slots 3–5. With the candidate, all six slots match the independent expected values. C retains its lifted attributes and offset metadata.

Every numerical run selected the RTX 3080 and inserted VK_LAYER_KHRONOS_validation, with ANYPS5_REQUIRE_VULKAN=1 and ANYPS5_NO_SHADER_CACHE=1. No VUID- errors or missing-requested-layer message appeared. The local loader also reported missing optional EOS-overlay manifests; the requested Khronos layer loaded and the tests completed.

Reproducer and candidate

Candidate commit · Public synthetic fixture

1. Build main 75f3702aed32762d0efcde60e998e7edb93c8ae2 and candidate ea18b41b9e275cd94403fd1ad4b7149d12f0c99e separately using BUILD.md, with BUILD_TESTING=ON and ANYPS5_AGC_EXECUTION_TESTS=DrawOffsetIndices.
2. Build agc_driver_draw_offset_indices_tests. Copy the candidate executable to an empty probe directory containing no AnyPS5 .prx libraries.
3. Set the Vulkan environment above, the installed validation-layer path and ANYPS5_GPU for the tested GPU. Prepend one build's core/libs/libs/unpatched directory to PATH, keeping the compiler runtime available.
4. Run agc_driver_draw_offset_indices_tests.exe A, then B and C, each in a new process. Repeat with the other build's library directory first in PATH, using the same executable.

The candidate proves the entry scalar and each lifted fetch's index origin, otherwise keeping ordinary translation. It also rejects prefixes whose buffer status write footprint is unmodelled. This does not implement buffer status results or prove the inherited descriptor/CNDMASK selector rules and fallback opcodes complete. Valid forms outside this conservative proof may lose lifting or GPU-indirect eligibility; that remaining coverage is recorded in shader debt.

Related work: #2285 supplies compensation for valid folds; mrfelek's #7591 covers after-add reload/shared analysis; yabanana's #6919 recognizes no-carry adds; #3258 was submitted by oneandonlydean while crediting Scramblrrrr's original branch. This report concerns the remaining direct lift/fold provenance gap and preserves those contributions.

No actual game's startup, watchdog, gameplay or performance improvement is claimed. The candidate's three focused CTests pass, including 84 new wave32/wave64 analyzer comparisons. Linux, AMD GPUs, PS5 hardware and full hosted CI were not tested.

AI-assisted: Codex