SBITS/UBITS and the getBits word copier performed typed u32/s32 loads
and stores at byte-aligned bitstream positions, and SBITS left-shifted
in the signed domain (shift of 1430899995 by 2 overflows int). All
converted to memcpy plus an unsigned-domain shift; the 16157-line
differential trace is byte-identical pre/post and now runs clean under
UBSAN_OPTIONS=halt_on_error=1 with zero ASan/LSan reports.
The harness itself did not compile (conflicting 'buf' redeclaration in
main - so CI never builds tests/) and golden_baseline.txt predated the
harness's own label-format change and 157 added sweep cases; fixed the
redeclaration and committed the regenerated golden. The mismatch was
test-infrastructure rot, not a decode regression.
Follow-up to the CBP_7 truncation. Each VLC array is addressed as
base + (window >> S) - B, with the window value bounded by the guard
at its call site; every one of those bounds is now a static_assert
next to the table, with the guard it follows written out. A table
built too small is a compile error naming the table, instead of a
read past the end that turns into garbage decode output.
Mutation-tested rather than assumed: shrinking CBP_7 to 64, MV_10 to
32, and mba11 to 64 each fail the build with the matching message.
The harness also grows a coverage sweep - VDEC at every TBL
selection and picture type, BDEC, and IDEC over pseudo-random
bitstreams, 16000 trace lines. Reported honestly: this sweep does
NOT catch the CBP_7 truncation. Random bytes hit an invalid VLC
almost immediately, so the deep index ranges are never reached; that
is exactly why the bug shipped, and it is why the bounds live in
static_asserts rather than in a stream test. The sweep's value is
locking current decode behaviour across future refactors of the
command surface, not bounds checking.
Gates: static link, cmake configure, cmake common+pcsx2 targets,
golden trace byte-exact, three mutation tests.
Standalone test driver that links the repo's built IPU objects
against a ~15-line stub layer and exercises the real entry points:
IPUCMD_WRITE, IPUProcessInterrupt, and both hardware FIFOs, with a
pending-input model that tops up IPU_in_FIFO inside the pump loop
the way DMA refills do on stalls. Records a golden trace of every
output qword plus end-of-command CTRL/BP/IFC/FP/CMD/TOP state.
Coverage: CSC to RGB32 and to dithered RGB16, SETVQ + PACK to INDX4
and to dithered RGB16, SETIQ intra and non-intra, VDEC (real symbol
decode with result and TOP peek asserted), FDEC, and two BDEC
streams (all-zero and pseudo-random) whose deterministic end states
gate the coefficient-decode paths. Output sizes assert the manual's
conversions: 64/32/8/32 qwords for RGB32/RGB16/INDX4/RGB16.
The trace is byte-stable across runs; golden_baseline.txt is the
committed reference. The mpeg2_vlc.h retirement and the fused
single-table DCT coefficient lookup must reproduce it exactly -
that is the definition of done for the refactor, per house rules on
byte-exact verification before perf claims.
Not wired into either build system (both enumerate sources
explicitly); build.sh documents the link recipe against the
already-built core objects.
LibretroAdmin