fix: define decoded AGC state and bound size arithmetic

core/libs/prx/libSceAgcDriver/Execution/src/Driver/Draw/DrawCapture.cpp

@@ -88,9 +88,9 @@ std::shared_ptr<const ShaderRecompiler::RecompileResult> Driver::materializeDraw
         if (slot1 == dumpSlot1) {
             static_cast<void>(dumpRequest(program.binary.codeAddress, request));
             if (std::FILE* file = std::fopen("draw_slot1.regs", "w")) {
-                for (const auto& [offset, value] : queue.context) std::fprintf(file, "context %x %08x\n", offset, value);
-                for (const auto& [offset, value] : queue.userConfig) std::fprintf(file, "uconfig %x %08x\n", offset, value);
-                for (const auto& [offset, value] : queue.shader) std::fprintf(file, "shader %x %08x\n", offset, value);
+                for (const auto& [offset, value] : queue.context) std::fprintf(file, "context %x %08x\n", static_cast<unsigned>(offset), static_cast<unsigned>(value));
+                for (const auto& [offset, value] : queue.userConfig) std::fprintf(file, "uconfig %x %08x\n", static_cast<unsigned>(offset), static_cast<unsigned>(value));
+                for (const auto& [offset, value] : queue.shader) std::fprintf(file, "shader %x %08x\n", static_cast<unsigned>(offset), static_cast<unsigned>(value));
                 std::fclose(file);
             }
         }

core/libs/prx/libSceAgcDriver/Execution/src/Pm4.cpp

@@ -1018,7 +1018,7 @@ void Execute(std::span<const std::uint32_t> packet, QueueState& queue) {
                     if (!queue.markers.empty()) queue.markers.pop_back();
                     return;
                 case 0x1a:
-                    if (TraceContextState()) std::fprintf(stderr, "[context] op %u: %zu registers, saved %d, cb0 %x info %x mask %x\n", packet[1], queue.context.size(), queue.savedContext.has_value() ? 1 : 0, queue.context.contains(0x318) ? queue.context.at(0x318) : 0u, queue.context.contains(0x31c) ? queue.context.at(0x31c) : 0u, queue.context.contains(0x8e) ? queue.context.at(0x8e) : 0u);
+                    if (TraceContextState()) std::fprintf(stderr, "[context] op %u: %zu registers, saved %d, cb0 %x info %x mask %x\n", packet[1], queue.context.size(), queue.savedContext.has_value() ? 1 : 0, queue.context.contains(0x318) ? static_cast<std::uint32_t>(queue.context.at(0x318)) : 0u, queue.context.contains(0x31c) ? static_cast<std::uint32_t>(queue.context.at(0x31c)) : 0u, queue.context.contains(0x8e) ? static_cast<std::uint32_t>(queue.context.at(0x8e)) : 0u);
                     APS5_LOG_OUT_DEBUG("CONTEXT_STATE operation=%u targetMaskBefore=0x%x shaderMaskBefore=0x%x", packet[1], queue.context.contains(0x8e) ? queue.context.at(0x8e) : 0u, queue.context.contains(0x8f) ? queue.context.at(0x8f) : 0u);
                     switch (packet[1]) {
                         case 0: queue.ClearContext(); break;

core/libs/prx/libSceAgcDriver/Graphics/include/State.hpp

@@ -24,22 +24,22 @@ enum class ShaderPath {
 };
 
 struct ShaderStages {
-    ShaderPath path;
-    std::uint32_t registerValue;
-    std::uint32_t vertexWaveSize;
-    std::uint32_t fragmentWaveSize;
+    ShaderPath path = ShaderPath::Vertex;
+    std::uint32_t registerValue = 0;
+    std::uint32_t vertexWaveSize = 0;
+    std::uint32_t fragmentWaveSize = 0;
     std::optional<ShaderRecompiler::MeshConfiguration> mesh;
     std::optional<ShaderRecompiler::TessellationConfiguration> tessellation;
     float minTessellationLevel = 1.0f;
     float maxTessellationLevel = 64.0f;
 };
 
 struct ColorTarget {
-    std::uint64_t address;
-    VkExtent2D extent;
-    VkFormat format;
-    std::size_t bytes;
-    std::uint8_t componentMapping;
+    std::uint64_t address = 0;
+    VkExtent2D extent{};
+    VkFormat format = VK_FORMAT_UNDEFINED;
+    std::size_t bytes = 0;
+    std::uint8_t componentMapping = 0;
     ColorTileMode tileMode = ColorTileMode::Linear;
     std::uint32_t elementBytes = 4;
     ShaderRecompiler::ColorExportPacking packing = ShaderRecompiler::ColorExportPacking::None;
@@ -73,12 +73,12 @@ struct ColorTarget {
 };
 
 struct DepthTarget {
-    std::uint64_t address;
-    std::uint64_t stencilAddress;
-    VkExtent2D extent;
-    VkFormat format;
-    float clearDepth;
-    std::uint8_t clearStencil;
+    std::uint64_t address = 0;
+    std::uint64_t stencilAddress = 0;
+    VkExtent2D extent{};
+    VkFormat format = VK_FORMAT_UNDEFINED;
+    float clearDepth = 0.0f;
+    std::uint8_t clearStencil = 0;
     std::uint64_t htileAddress = 0;
     bool htileStencil = false;
     std::uint32_t samples = 1;
@@ -115,18 +115,18 @@ struct State {
     ColorTarget color;
     std::vector<ColorTarget> colors;
     std::vector<VkPipelineColorBlendAttachmentState> blends;
-    bool hasColorTarget;
+    bool hasColorTarget = false;
     bool rectList = false;
     bool quadList = false;
     bool dualSourceBlend = false;
     std::uint32_t reversedBlend = 0;
-    VkExtent2D renderExtent;
+    VkExtent2D renderExtent{};
     std::uint32_t renderLayers = 1;
     std::uint32_t layerExports = 0;
-    VkPrimitiveTopology topology;
+    VkPrimitiveTopology topology = VK_PRIMITIVE_TOPOLOGY_TRIANGLE_LIST;
     bool primitiveRestart = false;
-    VkViewport viewport;
-    bool negativeOneToOne;
+    VkViewport viewport{};
+    bool negativeOneToOne = false;
     bool depthClamp = false;
     float depthScale = 1;
     float depthOffset = 0;
@@ -144,13 +144,13 @@ struct State {
     bool mergedCoverage = false;
     bool truncatedCoverage = false;
     VkConservativeRasterizationModeEXT conservativeRasterization = VK_CONSERVATIVE_RASTERIZATION_MODE_DISABLED_EXT;
-    VkRect2D scissor;
-    VkCullModeFlags cullMode;
+    VkRect2D scissor{};
+    VkCullModeFlags cullMode = VK_CULL_MODE_NONE;
     VkPolygonMode polygonMode = VK_POLYGON_MODE_FILL;
-    VkFrontFace frontFace;
+    VkFrontFace frontFace = VK_FRONT_FACE_COUNTER_CLOCKWISE;
     VkProvokingVertexModeEXT provokingVertexMode = VK_PROVOKING_VERTEX_MODE_FIRST_VERTEX_EXT;
-    VkPipelineColorBlendAttachmentState blend;
-    std::array<float, 4> blendConstants;
+    VkPipelineColorBlendAttachmentState blend{};
+    std::array<float, 4> blendConstants{};
     std::uint32_t samples = 1;
     std::array<std::uint8_t, 32> sampleLocations{};
     bool customSampleLocations = false;

core/libs/prx/libSceAgcDriver/Graphics/src/DepthSurface.cpp

@@ -1846,8 +1846,8 @@ std::uint64_t MultisampledDepthBytes_nid_no_patch(VkExtent2D extent, std::uint32
     const auto widthBits = (pixelBits + ((sampleBits & 1u) == 0u ? 1u : 0u)) / 2u;
     const auto blockWidth = 1u << widthBits;
     const auto blockHeight = 1u << (pixelBits - widthBits);
-    const auto width = static_cast<std::uint64_t>((extent.width + blockWidth - 1u) / blockWidth * blockWidth);
-    const auto height = static_cast<std::uint64_t>((extent.height + blockHeight - 1u) / blockHeight * blockHeight);
+    const auto width = ((static_cast<std::uint64_t>(extent.width) + blockWidth - 1u) / blockWidth) * blockWidth;
+    const auto height = ((static_cast<std::uint64_t>(extent.height) + blockHeight - 1u) / blockHeight) * blockHeight;
     return width * height * bytesPerTexel * samples;
 }
 

core/libs/prx/libSceAgcDriver/Graphics/src/PipelineJournal.cpp

@@ -904,8 +904,8 @@ class Replay : public PipelineJournalReplay {
     }
 
     ~Replay() override {
-        Cancel();
-        Wait();
+        Replay::Cancel();
+        Replay::Wait();
     }
 
     void Cancel() override { cancelled.store(true, std::memory_order_relaxed); }

core/libs/prx/libSceAgcDriver/Graphics/src/Recorder.cpp

@@ -137,6 +137,7 @@ thread_local double threadWaitedMs = 0;
 
 void CountThreadSync(int source, double ms) {
     threadWaitedMs += ms;
+    if (source < 0 || source >= 5) source = 4;
     const auto tag = GuestMemory::GpuLockThreadTag();
     std::lock_guard lock(threadSyncsMutex);
     auto it = std::find_if(threadSyncs.begin(), threadSyncs.end(), [&](const ThreadSyncs& thread) { return thread.tag == tag; });
@@ -3920,7 +3921,7 @@ bool Recorder::syncThroughUnlocked(std::uint64_t address, std::uint64_t end, int
         // totals of the [recorder] line keep their meaning; the unlocked count says how many were
         // not held. The relock's wait for the mutex is kept apart (the [lock] line also counts it
         // under 'hook' waits, for a cross-check).
-        syncWaitedMs[source] += ms;
+        if (source >= 0 && source < 5) syncWaitedMs[source] += ms;
         CountThreadSync(source, ms);
         CountSiteWait(ms);
         ++holdCounters.hookUnlockedWaits;
@@ -4033,7 +4034,7 @@ void Recorder::finish(std::unique_ptr<Batch> batch, bool wait, int source, bool
                 const auto now = std::chrono::steady_clock::now();
                 const auto ms = std::chrono::duration<double, std::milli>(now - start).count();
                 waitedMs += ms;
-                syncWaitedMs[source] += ms;
+                if (source >= 0 && source < 5) syncWaitedMs[source] += ms;
                 ++waits;
                 CountThreadSync(source, ms);
                 CountSiteWait(ms);

core/libs/prx/libSceAgcDriver/Graphics/src/ShaderInputState.cpp

@@ -255,7 +255,7 @@ ShaderRecompiler::ShaderVertexStageInfo DecodeVertexStageInfo(std::span<const st
         }
         const auto readWords = [](std::uint64_t base, std::uint32_t stride, std::uint32_t first, std::uint32_t last, std::vector<std::uint32_t>& words, auto&& wanted) {
             const auto wordsPer = stride / 4u;
-            words.assign(static_cast<std::size_t>(last - first + 1u) * wordsPer, 0u);
+            words.assign((static_cast<std::size_t>(last) - first + 1u) * wordsPer, 0u);
             const auto begin = base + static_cast<std::uint64_t>(first) * stride;
             if (AgcDriver::GuestMemory::Accessible(reinterpret_cast<const void*>(begin), words.size() * 4u)) {
                 AgcDriver::GuestMemory::Read(begin, std::as_writable_bytes(std::span(words)), 4);

core/libs/prx/libSceAgcDriver/Graphics/src/State.cpp

@@ -2232,9 +2232,9 @@ bool StencilOperationValueReplaces(const Registers& context) {
 
 bool StencilReferenceUnused(const State& state) {
     if (!state.depth || !state.stencilTest) return true;
-    if (state.depthTest && (state.depthCompare < VK_COMPARE_OP_NEVER || state.depthCompare > VK_COMPARE_OP_ALWAYS)) return false;
+    if (state.depthTest && state.depthCompare > VK_COMPARE_OP_ALWAYS) return false;
     const auto faceUnused = [&](const VkStencilOpState& face) {
-        if (face.compareOp < VK_COMPARE_OP_NEVER || face.compareOp > VK_COMPARE_OP_ALWAYS) return false;
+        if (face.compareOp > VK_COMPARE_OP_ALWAYS) return false;
         for (const auto op : {face.failOp, face.passOp, face.depthFailOp}) {
             if (op < VK_STENCIL_OP_KEEP || op > VK_STENCIL_OP_DECREMENT_AND_WRAP) return false;
         }

core/libs/prx/libSceAgcDriver/Graphics/src/Texture.cpp

@@ -2961,7 +2961,7 @@ std::vector<StorageTexture::SliceWindow> StorageTexture::sliceWindows(std::span<
                 // One region per block row; whole rows merge (a run's middle rows are whole).
                 for (auto row = firstRow; row <= lastRow; ++row) {
                     const auto rowFirst = std::max<std::uint64_t>(firstBlock, static_cast<std::uint64_t>(row) * mip.blocksPerRow);
-                    const auto rowLast = std::min<std::uint64_t>(lastBlock, static_cast<std::uint64_t>(row + 1u) * mip.blocksPerRow - 1u);
+                    const auto rowLast = std::min<std::uint64_t>(lastBlock, (static_cast<std::uint64_t>(row) + 1u) * mip.blocksPerRow - 1u);
                     const auto x0 = static_cast<std::uint32_t>(rowFirst - static_cast<std::uint64_t>(row) * mip.blocksPerRow) * block[1];
                     const auto x1 = std::min(mip.width, static_cast<std::uint32_t>(rowLast - static_cast<std::uint64_t>(row) * mip.blocksPerRow + 1u) * block[1]);
                     const auto y0 = row * block[2];

core/libs/prx/libSceIme/include/ImeFilterText.hpp

@@ -134,7 +134,7 @@ inline std::uint32_t FilterText(char16_t* dst, std::int32_t* out_length, std::ui
     if (dst == nullptr || out_length == nullptr || param == nullptr || src == nullptr) return kErrorInvalidAddress;
     if (capacity < 2) return kErrorInvalidParam;
     const std::uint32_t type = param->type;
-    if (type >= 5 && type - 0x100 > 3) return kErrorInvalidParam;
+    if (type >= 5 && (type < 0x100 || type - 0x100 > 3)) return kErrorInvalidParam;
 
     std::uint64_t mask = param->mask;
     if (mask == 0) mask = DerivedMask(param->version, param->variant);

core/libs/prx/libSceJobManager/Export.cpp

@@ -344,10 +344,12 @@ int Sequence::Dispatch(JobEntry entry, void* argument, std::uint32_t count, cons
 
 void Sequence::SubmitCompute(const Item& item) {
     const auto* bytes = static_cast<const std::uint8_t*>(item.shader);
-    const ShaderRegister* registers = nullptr;
-    const std::uint8_t* specials = nullptr;
-    std::memcpy(&registers, bytes + 0x20, sizeof(registers));
-    std::memcpy(&specials, bytes + 0x28, sizeof(specials));
+    std::uintptr_t registerAddress = 0;
+    std::uintptr_t specialsAddress = 0;
+    std::memcpy(&registerAddress, bytes + 0x20, sizeof(registerAddress));
+    std::memcpy(&specialsAddress, bytes + 0x28, sizeof(specialsAddress));
+    const auto* registers = reinterpret_cast<const ShaderRegister*>(registerAddress);
+    const auto* specials = reinterpret_cast<const std::uint8_t*>(specialsAddress);
     const std::uint32_t registerCount = bytes[0x5c];
     std::uint32_t modifier = 0;
     std::memcpy(&modifier, specials + 0x10, sizeof(modifier));

core/libs/prx/libSceNgs2.native/src/Custom.cpp

@@ -2,6 +2,7 @@
 #include <cstddef>
 #include <cstdint>
 #include <cstring>
+#include <optional>
 #include <stdexcept>
 #include <string>
 #include <vector>
@@ -22,7 +23,8 @@ static const char* BuiltInModuleName(std::uint32_t moduleId) {
     }
 }
 
-static std::uint32_t OptionWord(const Ngs2CustomModuleOption& option) {
+static std::optional<std::uint32_t> OptionWord(const Ngs2CustomModuleOption& option) {
+    if (option.size < sizeof(Ngs2CustomModuleOption) + sizeof(std::uint32_t)) return std::nullopt;
     std::uint32_t word = 0;
     std::memcpy(&word, reinterpret_cast<const std::uint8_t*>(&option) + sizeof(option), sizeof(word));
     return word;
@@ -35,11 +37,15 @@ static int CheckBuiltInModule(const Ngs2CustomRackModuleInfo& info) {
     } else if (info.module_id == SCE_NGS2_CUSTOM_MODULE_ID_REVERB) {
         if (!stateSizeIs(0)) return SCE_NGS2_ERROR_INVALID_STATE_SIZE;
         if (info.option != nullptr && info.option->size != SCE_NGS2_CUSTOM_REVERB_OPTION_SIZE) return SCE_NGS2_ERROR_INVALID_OPTION_SIZE;
-        if (info.option != nullptr && OptionWord(*info.option) > 1) return SCE_NGS2_ERROR_INVALID_REVERB_OPTION;
+        if (info.option != nullptr) {
+            const auto word = OptionWord(*info.option);
+            if (!word || *word > 1) return SCE_NGS2_ERROR_INVALID_REVERB_OPTION;
+        }
     } else if (info.module_id == SCE_NGS2_CUSTOM_MODULE_ID_PITCH_SHIFT) {
         if (!stateSizeIs(SCE_NGS2_CUSTOM_PITCH_SHIFT_STATE_SIZE)) return SCE_NGS2_ERROR_INVALID_STATE_SIZE;
-        if (info.option != nullptr && info.option->size == SCE_NGS2_CUSTOM_PITCH_SHIFT_OPTION_SIZE && OptionWord(*info.option) != 0) {
-            return SCE_NGS2_ERROR_INVALID_PITCH_SHIFT_OPTION;
+        if (info.option != nullptr && info.option->size == SCE_NGS2_CUSTOM_PITCH_SHIFT_OPTION_SIZE) {
+            const auto word = OptionWord(*info.option);
+            if (!word || *word != 0) return SCE_NGS2_ERROR_INVALID_PITCH_SHIFT_OPTION;
         }
     }
     return SCE_NGS2_OK;

core/libs/prx/libSceVideoOut/src/VideoOutDriver.cpp

@@ -548,7 +548,7 @@ void VideoOutDriver::processFlip(FlipRequest& req) {
             std::fprintf(stderr, "[videoout] display no longer supports 119.88 Hz; fell back to 59.94 Hz\n");
         }
         require(req.ready && !req.terminal && req.generation == req.cfg->generation, "stale or incomplete flip request");
-        const auto interval = static_cast<uint64_t>(req.flipRate + 1);
+        const auto interval = static_cast<uint64_t>(req.flipRate) + 1u;
         require(req.cfg->lastFlipVblank <= std::numeric_limits<uint64_t>::max() - interval, "flip interval overflow");
         const auto target = req.cfg->lastFlipVblank + interval;
         timing.Mark("validate");

core/libs/prx/libc/src/Mspace.cpp

@@ -165,7 +165,10 @@ void* APS5_VABI sceLibcMspaceCreate_nid_postfix(const char* name, void* base,
     const auto first = start + ArenaHeaderBytes;
     const auto last = start + (size & ~(Granule - 1));
     AddFree(*arena, first, last);
-    arenas.emplace(start, std::move(arena));
+    if (!arenas.try_emplace(start, std::move(arena)).second) {
+        Error(22);
+        return nullptr;
+    }
     return base;
 }
 

core/relinker/codegen/include/codegen/x86/X64InstructionRewriter.hpp

@@ -38,7 +38,6 @@ class X64InstructionRewriter : public IInstructionRewriter {
     [[nodiscard]] static std::int64_t AdjustedDelta(
         std::int64_t instrPosition,
         std::int64_t targetPosition,
-        std::int64_t cutStart,
         std::int64_t cutEnd,
         std::int64_t sliceSize,
         std::int64_t delta

core/relinker/codegen/src/x86/X64InstructionRewriter.cpp

@@ -49,7 +49,6 @@ void X64InstructionRewriter::WriteInt32(std::uint8_t* data, std::int32_t value)
 std::int64_t X64InstructionRewriter::AdjustedDelta(
     std::int64_t instrPosition,
     std::int64_t targetPosition,
-    std::int64_t cutStart,
     std::int64_t cutEnd,
     std::int64_t sliceSize,
     std::int64_t delta
@@ -121,7 +120,7 @@ RewriteResult X64InstructionRewriter::Rewrite(
                 const auto disp = static_cast<std::int8_t>(codeSection[fieldPosition]);
                 const std::int64_t targetPosition = instrEnd + disp;
                 const std::int64_t adjust = AdjustedDelta(
-                    matchOffset, targetPosition, cutStart, cutEnd,
+                    matchOffset, targetPosition, cutEnd,
                     static_cast<std::int64_t>(codeSection.size()), delta);
 
                 if (adjust != 0) {
@@ -141,7 +140,7 @@ RewriteResult X64InstructionRewriter::Rewrite(
                 const auto disp = ReadInt32(codeSection.data() + fieldPosition);
                 const std::int64_t targetPosition = instrEnd + disp;
                 const std::int64_t adjust = AdjustedDelta(
-                    matchOffset, targetPosition, cutStart, cutEnd,
+                    matchOffset, targetPosition, cutEnd,
                     static_cast<std::int64_t>(codeSection.size()), delta);
 
                 if (adjust != 0) {

core/relinker/elfpatcher/src/macos/MacOsImage.cpp

@@ -592,7 +592,7 @@ std::vector<std::uint8_t> WriteMacOsImage(MacOsImageInput& input) {
 
             auto& site = SegmentAt(segments, access.Rva, access.Length);
             const auto at = access.Rva - site.Rva;
-            const auto displacement = static_cast<std::int64_t>(stub) - static_cast<std::int64_t>(access.Rva + 5);
+            const auto displacement = static_cast<std::int64_t>(stub) - (static_cast<std::int64_t>(access.Rva) + 5);
             std::fill_n(site.Data.begin() + static_cast<std::ptrdiff_t>(at), access.Length, 0x90);
             site.Data[at] = 0xe9;
             Io::WriteU32(site.Data, at + 1, static_cast<std::uint32_t>(static_cast<std::int32_t>(displacement)));

core/shader/recompiler/Optimization/src/TessellationLowering.cpp

@@ -765,6 +765,9 @@ class Lowering {
                     Fail("the merged hull program reads LDS outside its patch's control point records", access.pc);
                 }
                 break;
+            case TessellationAttribute::InstanceInput:
+            case TessellationAttribute::InstanceOutput:
+                break;
             case TessellationAttribute::PatchOutput:
                 break;
             }

core/shader/recompiler/ThreadOwned.hpp

@@ -39,7 +39,12 @@ inline void DestroyAtThreadExit(void* object, void (*destroy)(void*)) {
             throw std::runtime_error("ThreadOwned: pthread_setspecific failed");
         }
     }
-    owned->push_back({object, destroy});
+    try {
+        owned->push_back({object, destroy});
+    } catch (...) {
+        destroy(object);
+        throw;
+    }
 }
 
 }