mirror of
https://github.com/RetroPortingToolKit/psxrecomp
synced 2026-10-26 02:11:36 -04:00
Matthew Stanley
ff714d1ee1
Adds overlay_cps_probe (debug cmd) to record what the CPS interior-continuation dispatch decides for a watched PC. Used it to CONFIRM the root cause: func_80050B08 calls jal 0x89788 (init-array). 0x89788 isn't a registered entry, so overlay_find_by_range(0x89788) runs -- 6 loaded candidates have a range containing it -- and returns func_800896E0 (the crt0 bootstrap), whose range wrongly spans 0x89788. 0x89788 is not a case in its entry-switch, so default re-runs the bootstrap from the top: InitHeap/A0 spin, VBLANK-masked deadlock. func_800896E0's range covers 0x89788 because function_discovery.cpp:493-499 treats BREAK as fall-through; the bootstrap's "jal 0x50B08; break" (break guards the main-returned case) falls through at 0x89784 into the separate function at 0x89788, absorbing it. So the early break-no-op finding WAS the root -- damage is at discovery/range time, not runtime break execution. Interp is immune (executes 0x89788 bytes directly). Fix options + recommendation (clip function range at next entry / don't cross a function boundary on break fall-through) documented in docs/TOMBA2_NATIVE_FMV_FREEZE.md. Diagnostic only; no fix applied yet (needs regression on Tomba1/MMX6/Ape). Workaround: overlay_native_block 0x80050B08. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>