[Fix, Test] (DirectVulkan, ShaderTranspiler, TraceReplay): repair iterationRP's missing reduction barrier

Program 203 reuses prefixSumCache for a second subgroup reduction before every workgroup invocation has consumed the first result. Add a fingerprint-gated SPIR-V pass that inserts the missing Workgroup acquire-release barrier while preserving native subgroup operations.

Keep the repair opt-in behind MOBILEGL_ITERATIONRP_FIX_BARRIER, cover insertion, pass-through, and idempotence, and enable it together with the existing iterationRP subgroup repairs for the matching Linux and Android CI retraces.

MobileGL/MG_Backend/DirectVulkan/Renderer/ProgramFactory.cpp

@@ -3190,10 +3190,25 @@ namespace MobileGL::MG_Backend::DirectVulkan {
             }
 
             // GL_KHR_shader_subgroup handling (SubgroupSupportPolicy.h). Native subgroup
-            // operations execute natively; two module repairs keep the GL contract intact
+            // operations execute natively; module repairs keep the GL contract intact
             // around them. The opt-in emulation path replaces them only on devices with no
             // subgroup support at all (MOBILEGL_MAGMA_EMULATE_SUBGROUP).
             if (shaders[i] && shaders[i]->GetShaderStage() == ShaderStage::Compute) {
+                // Program 203 broadcasts the first reduction through
+                // prefixSumCache[0], then lets the second reduction overwrite that
+                // scratch without first rendezvousing all readers. Patch that exact
+                // fingerprint before either native or emulated subgroup lowering.
+                if (m_subgroupPolicy.fixIterationRPBarrier) {
+                    Vector<Uint> patchedSpirv;
+                    if (MG_Util::ShaderTranspiler::ShaderCompiler::FixIterationRPBarrierForVulkan(
+                            moduleSpirvs[i], patchedSpirv, enableSpirvValidation)) {
+                        moduleSpirvs[i] = std::move(patchedSpirv);
+                    } else {
+                        MGLOG_E("ProgramFactory: iterationRP barrier patch failed for program %u; "
+                                "Program 203 keeps its shared-scratch race",
+                                program.GetExternalIndex());
+                    }
+                }
                 if (m_subgroupPolicy.emulateSubgroups) {
                     Vector<Uint> emulatedSpirv;
                     if (MG_Util::ShaderTranspiler::ShaderCompiler::EmulateSubgroupsForVulkan(

MobileGL/MG_Backend/DirectVulkan/Renderer/ProgramFactory.h

@@ -381,6 +381,7 @@ namespace MobileGL::MG_Backend::DirectVulkan {
         struct SubgroupLoweringPolicy {
             Bool emulateSubgroups = false;      // MOBILEGL_MAGMA_EMULATE_SUBGROUP, no-native-support devices
             Bool fixIterationRPSubgroupScratch = false; // patch iterationRP's under-declared scratch
+            Bool fixIterationRPBarrier = false; // repair Program 203's shared-scratch race
             Bool deriveNumSubgroups = false;    // repair the NumSubgroups builtin
             Bool requireFullSubgroups = false;  // computeFullSubgroups enabled on the device
             Uint32 nativeSubgroupSize = 0;

MobileGL/MG_Backend/DirectVulkan/Renderer/VulkanRenderer.cpp

@@ -3063,6 +3063,7 @@ void main() {
         subgroupPolicy.emulateSubgroups = ShouldEmulateSubgroups(m_nativeSubgroupSupported);
         subgroupPolicy.fixIterationRPSubgroupScratch =
             m_nativeSubgroupSupported && ShouldFixIterationRPSubgroupScratch();
+        subgroupPolicy.fixIterationRPBarrier = ShouldFixIterationRPBarrier();
         subgroupPolicy.deriveNumSubgroups =
             m_nativeSubgroupSupported && ShouldDeriveNumSubgroups();
         subgroupPolicy.requireFullSubgroups = m_computeFullSubgroupsFeatureEnabled;

MobileGL/MG_Backend/DirectVulkan/SubgroupSupportPolicy.h

@@ -18,9 +18,11 @@ namespace MobileGL::MG_Backend::DirectVulkan {
     //
     // Native subgroups are the implementation whenever the device has them, whatever
     // their width - subgroup operations execute on the hardware paths they were made
-    // for. Two module-level repairs keep the GL contract intact around them:
+    // for. Module-level repairs keep the GL contract intact around them:
     //   - FixIterationRPSubgroupScratchPass patches the one known pack bug: iterationRP's
     //     prefixSumCache[32], under-declared for sub-16-lane devices (8-lane lavapipe);
+    //   - FixIterationRPBarrierPass repairs Program 203's race between two reductions
+    //     reusing that scratch, when explicitly enabled;
     //   - DeriveNumSubgroupsPass replaces the one builtin drivers get wrong
     //     (gl_NumSubgroups) with the value the rest of the topology implies.
     // The 32-lane shared-memory emulation (EmulateSubgroupsPass) is a LAST RESORT for
@@ -47,6 +49,10 @@ namespace MobileGL::MG_Backend::DirectVulkan {
                MG_Config::QuirkOverride::ForceOff;
     }
 
+    inline Bool ShouldFixIterationRPBarrier() {
+        return MG_Config::Features.IterationRPFixBarrier;
+    }
+
     inline Bool ShouldDeriveNumSubgroups() {
         // Auto is ON: gl_NumSubgroups must agree with the gl_SubgroupID range for the GL
         // contract to hold, and the derived ceil() value is the one the renderer can pin