[220111]

Summary

Fixes a Persona 5 Royal (Steam 1687950) crash about 33 seconds in, and two JIT pool leaks that kept it very slow once it ran.

Crash: zeroed vector registers

The game's protection code suspends another thread, reads its floating-point context into a CONTEXT template inside the image, and jumps to the XMM13 slot. The server's Mach capture read only ARM_THREAD_STATE64, so every cross-thread GetThreadContext returned zeroed vector registers and the game executed zeros.

ios_fill_thread_context() now also reads ARM_NEON_STATE64. Under ARM64EC, FEX keeps guest XMM0-15 in V0-V15, so these are the guest's XMM registers. A thread blocked in a syscall reports the vector registers saved in its syscall frame instead. MADEIRA_CTX_FP=0 restores the old behaviour.

Pool: two code-buffer leaks

These held 256 MB of the 304 MB of live code buffers. Game threads were capped at 16 MB buffers and recompiled about 70% of the code they ran.

• Refused frees: a buffer FEX released while a thread was still running in it was refused and stayed live for the session, because FEX never releases a buffer twice. It is now freed as retired, so reuse waits for the grace period and the strict thread scan, as for a dead process's buffer. MADEIRA_POOL_CODE_DEFER_FREE=0 restores the refusal.
• Oversized reuse: crashpad_handler.exe took a free 16 MB buffer for a 16 KB request and a 128 MB buffer for a 16 MB request, and kept them for the session. A free buffer at least 4x the request is now kept back while the budget affords a fresh one, with a fallback to the kept buffer if the fresh one can't be made. MADEIRA_POOL_CODE_KEEP_BIG=0 restores the old policy.

Testing

On an iPhone 17 Pro Max (iOS 27.0.1), with all switches at their defaults:

• P5R booted, loaded saves, and played at a steady 33.3 ms per frame with a 62% JIT cache hit rate (27-37% before the pool fixes).
• Is This Seat Taken ran at 60 fps and exited cleanly.

The switches set to 0 were covered only by host tests, not on a device.

Added check-ctx-fp.py, which checks the frame offsets against struct syscall_frame, the dispatcher's register saves, the capture's gating and ordering, and the switch. Updated check-pool-code-exit.py and check-pool-startup-budget.py, which had asserted the old behaviour. 69 of 79 related host tests pass on macOS; the other 10 also fail without this change.

Review notes

• Deferred free: the thread scan checks current PCs, not return addresses into the old buffer on a thread's stack or FEX's call-return stack. It relies on FEX having released the buffer. ml557 was added after a crash from recycled code, so this deserves a careful look.
• Syscall frame: the FP override is on by default, while the neighbouring ml716 substitution is opt-in. It replaces only FP state and uses the same validation.
• Capture limits: inside a Unix call only q8-q15 are saved, so q0-q7 come from the last syscall. A thread stopped in FEX's own code reports host values. YMM upper halves are not reported.
• Threshold: the 4x rule is a judgement call, not a measured value.
• Catalog: ConfigCatalog.generated.swift is a full regeneration, so it also adds six entries main was missing and moves four.

🤖 Generated with Claude Code