From ad7e322c7e7d2db94e31e2d3c05d4a52bebb9f94 Mon Sep 17 00:00:00 2001
From: "Unknown W. Brackets" <checkins@unknownbrackets.org>
Date: Sun, 10 Mar 2019 15:27:53 -0700
Subject: [PATCH] interp: Correct Vsgn out of swizzle bounds.

---
 Core/MIPS/IR/IRCompVFPU.cpp |  2 +-
 Core/MIPS/MIPSIntVFPU.cpp   | 10 ++++++++--
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/Core/MIPS/IR/IRCompVFPU.cpp b/Core/MIPS/IR/IRCompVFPU.cpp
index 734c81b721..298fd262c3 100644
--- a/Core/MIPS/IR/IRCompVFPU.cpp
+++ b/Core/MIPS/IR/IRCompVFPU.cpp
@@ -1841,7 +1841,7 @@ namespace MIPSComp {
 
 	void IRFrontend::Comp_Vsgn(MIPSOpcode op) {
 		CONDITIONAL_DISABLE(VFPU_VEC);
-		if (js.HasUnknownPrefix()) {
+		if (js.HasUnknownPrefix() || !IsPrefixWithinSize(js.prefixS, op) || !IsPrefixWithinSize(js.prefixT, op)) {
 			DISABLE;
 		}
 
diff --git a/Core/MIPS/MIPSIntVFPU.cpp b/Core/MIPS/MIPSIntVFPU.cpp
index e1cb4c59eb..9b4a1d1314 100644
--- a/Core/MIPS/MIPSIntVFPU.cpp
+++ b/Core/MIPS/MIPSIntVFPU.cpp
@@ -659,14 +659,20 @@ namespace MIPSInt
 		int vs = _VS;
 		VectorSize sz = GetVecSize(op);
 		ReadVector(s, sz, vs);
-		ApplySwizzleS(s, sz);
 
 		// Not sure who would do this, but using abs/neg allows a compare against 3 or -3.
 		u32 tprefixRemove = VFPU_ANY_SWIZZLE();
 		u32 tprefixAdd = VFPU_CONST(1, 1, 1, 1) | VFPU_SWIZZLE(0, 0, 0, 0);
 		ApplyPrefixST(t, VFPURewritePrefix(VFPU_CTRL_TPREFIX, tprefixRemove, tprefixAdd), sz);
 
-		for (int i = 0; i < GetNumVectorElements(sz); i++) {
+		int n = GetNumVectorElements(sz);
+		if (n < 4) {
+			// Compare with a swizzled value out of bounds always produces 0.
+			memcpy(&s[n], &t[n], sizeof(float) * (4 - n));
+		}
+		ApplySwizzleS(s, V_Quad);
+
+		for (int i = 0; i < n; i++) {
 			float diff = s[i] - t[i];
 			// To handle NaNs correctly, we do this with integer hackery
 			u32 val;