mirror of
https://github.com/MobileGL-Dev/MobileGL
synced 2026-11-14 13:33:23 +09:00
swung0x48
4f2d4c4e83
CONTRACT-P7: the lane counts (magma-split 73 / spawn 52 / tcp 54; full-suite 510 x 3 with one StreamLink x Magma red), the census baseline (79 abort sites over 20 files, 43 family words, 0 unmarked), the ratchet baseline (186 = p7-magma 101 / espryt 14 / both 60 / core 11; espryt's clearable count is 9) and the @P7 count (15 sites / 4 files) replace the 待填 markers. Device window #1a (Redmi 2f7cbe2e, APK p7w1-d260f110, reboot-clean): E0a monolith 39/39 deterministic, three below threshold on monolith itself (create-indirect, 1.21.11 main-menu, iris-photon - Adreno refuses its pipelines with VK_ERROR_UNKNOWN); E0a inproc: OpenRA 0.976494 (run-ahead) / E1 lockstep 0.988998 - both historical numbers were OpenRA, and its client log shows a TextureResources verb answered from caps generation 0 (package F1); 26.3 / create-* SIGSEGV in the replayer's memcpy on BOTH backends and with the persistent-map push off (package X1); iterationt x2 die by name on Magma:mipmap-shader-format-or-shape (package B); bsl-esc-menu hits scudo OOM under inproc. Gate 3's denominator is 36; run-ahead and present credit are off the suspect list.
E4 · SIGSEGV 判别（runbook 之外临时加的两臂）
E0a 发现 26.3 / create-instancing / create-indirect 在 DirectVulkan inproc 下 SIGSEGV（SEGV_ACCERR，GL 线程 __memcpy_aarch64_nt ← libtrace_replay_runner.so，页对齐 fault addr），monolith 通过。两臂判别：
| 臂 | 环境 | 26.3 | create-instancing | 判别 |
|---|---|---|---|---|
| E4a | DirectGLES × inproc × pbuffer | SIGSEGV | SIGSEGV | 与后端无关 → 不是 Magma 的 |
| E4b | DirectGLES × inproc × MOBILEGL_IPC_PERSISTENT_BLOCK_KB=0（Config 行印 persistent-block=0KiB，库自己警告这是 E3(a) 负控、persistent-map push 已关） |
SIGSEGV | — | 与 persistent-map push 无关 → 不是（至少不只是）P5d 的 mprotect 脏页追踪 |
日志：E4a-gles-inproc.log、E4b-gles-inproc-noblock.log；原始 tombstone / maps 在 .trace-work/p7w1/{E4a-gles-inproc,E4b-gles-inproc-noblock}/<case>-DirectGLES/repeat-01/logcat.txt（不入库）。26.3 的 client 日志在崩溃前只有 caps 采纳行，无 Fatal{、无 tracker 警告。
判读：client 把一个不可写的页交给了应用（替换 glMapBufferRange 等返回的指针指向的映射在 client 视角是只读 / PROT_NONE），且这只在 Android 上发生（WSL lavapipe 的 inproc retrace 这几条都绿）——ART 的 sigchain、bionic 的 memcpy 非临时存储路径、零页注册 / shadow 页对齐分配（P5d）都在嫌疑名单上。→ wave 2 X1（notes/p7/PLAN-PH-P34B-P7.md 之外新增；集成者裁定它进 P7 出口门 3 的关键路径，因为 26.3 在分母里）。