With no symbol, a jr ra above pc ends the scan for a leaf's entry. But when ra
points between that jr ra and pc, it's stale from a call this function made,
so the jr ra is an early return of its own, and the scan carries on to its
prologue.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The scan for the prologue took the addiu sp as the entry, which is past the
start when the function does something first (a lui, a move).
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- Fixes#17664
With no symbol for the current function, the scan for a prologue ran on
into the function before it, took that one's entry and stack frame, and
read a bogus ra from the stack, so the walk ended there. Now a jr ra above
the current pc ends the scan: the innermost frame is taken as a leaf
starting right after it, using ra from the register.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The JITs used to find a block by overwriting its first instruction with an "emuhack" holding
the offset into the code space, and replacement functions installed their own emuhack the same
way. Anything that read code (savestates, the debugger, memory dumps, cheats, the function
hasher, games reading their own code) had to translate them back.
Blocks now live in a block shadow: one u32 per guest instruction, indexed by the PC masked with
BLOCK_SHADOW_MASK (1GB on 64-bit, folding the kernel and uncached mirrors; 256MB on 32-bit, iOS
and Switch, where address space is short), with the low bits cleared so a misaligned PC can't
read across two entries. Only the ranges under memory views are committed, so a bad PC still
faults in the dispatcher, and the shadow is reserved before the memory map so it can't land in
a gap of the 4GB window. Entries hold full 32-bit offsets, lifting the 16MB limit. The
dispatchers on every backend, and the IR interpreter's loop, look blocks up there.
A hooked instruction without a compiled block gets the JIT's hook value in its entry: the offset
of the dispatcher's compile path (1 for the interpreters, the IR arena keeping that offset
empty), so dispatching there compiles a block, and the frontends substitute the hook. Compiling
replaces the entry with the block's, and destroying the block puts the hook value back. The hook
value is rewritten when the JIT changes or regenerates its dispatcher.
Hooks live in a map keyed by the masked address, and are dropped when the game overwrites the
hooked instruction, or when an icache invalidation finds the function's hash (immediates masked,
as when matching it) changed. Those checks run when queued invalidations are processed, since
cheats and the debugger queue them before writing. Installing and removing hooks invalidates
deferred, as it happens in HLE calls that can run inside a block. The cache instruction goes
through MIPSState, so it drops changed hooks too.
With clean memory, the save/clear/restore around savestates, memory reads and dumps goes away,
as do the source-range invalidations in the memcpy replacements, sceDmac and the cheats.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
* Print simple stack traces to log on crashes.
* Display stack traces on crash screen
* Show the in-function offset in the printed callstacks.
* Libretro buildfix attempt
It was spending 0.5s in debug scanning all of memory for an entry (due to
some fp/sp tricks that aren't well detected yet.) Let's just assume a 1MB
func doesn't need to be walked properly.
