The three framebuffer upload paths took Memory::GetPointerUnchecked() on a
GE-supplied source address and then read height rows of it, without ever checking
that span was mapped. Only the destination was validated (and DoBlockTransfer's own
memcpy is carefully guarded, so the intent was clearly there). A copy whose source
starts near the end of RAM walks straight off the end of the view. Clamp the row
count to what's actually mapped, and warn when we do.
GhidraClient dereferenced getArray()->value for both "symbols" and "types" without a
null check, and the getTag() test underneath could never catch it - getArray() has
already filtered by tag, so it returns either a JSON_ARRAY node or nullptr. Any
HTTP 200 that parses as JSON but isn't the shape we expect - {}, a bare array, an
incompatible ghidra-rest-api, or the host/port pointed at some other JSON service -
crashed the worker thread. FetchTypes() runs first, so that's the one you'd hit.
RiscV and LoongArch CPU detection divided TotalLogicalCount() by ProcessorCount()
before checking it. ProcessorCount() returns 0 whenever /proc/cpuinfo can't be read
or doesn't parse, which is SIGFPE during static init of the cpu_info global - before
anything could handle it. The existing <= 0 guard sat after the division.
314 pspautotests pass; frametests show the same 3 pre-existing failures as master.
Some games render HLE sceFont glyphs into small VRAM-backed framebuffers and immediately sample them as textures. This needs both the source glyph buffer and the temporary render target to be preserved before later commands overwrite or rebind them.
Save first-frame data from the previous render target before creating a new framebuffer, since ResizeFramebufFBO() makes the new framebuffer current. Also flush pending draws before PGF writes over a glyph buffer that may still be referenced by queued texture draws.
Backend software transform normally reports safe framebuffer size during draw flush, but first-frame readback can happen before queued draws reach that path. Estimate through-mode rectangle/triangle bounds before SubmitPrim() and feed those bounds to SetSafeSize(), using actual vertices clamped to scissor instead of a tiny-target heuristic.
Fixes missing text in Evangelion JO.
Fix block transfer clipping that happened due to code not taking block
transfer offsets into account when finding framebuffers for block
transfer and when creating ram framebuffer.
The game actually implements proper shadow mapping using some wicked
trickery, including framebuffer color reinterpretation. This finally
gets it working, by filling in some gaps in the existing mechanisms.
Unfortunately there's some precision issue that needs to be looked at,
as it can currently look quite stripy, very typical of shadow mapping.
Henrik Rydgård