[chotchki]

When running Skylanders Giants with SPU LLVM, the game crashes. I used Claude to isolate down to a minimal fix and test case. Post fix the title launches correctly.

In giga block mode, a brsl whose return address holds a stop (0x0) word gets a return-point block during discovery that the cleanup pass then deletes (its result.data word is 0) without dropping the m_targets edge pointing at it. The reg-state walk follows that dangling edge into initiate_patterns, where ::at32(m_bbs, bpc) range-check-fails and freezes the SPU thread (reproduced on Skylanders Giants, giga + SPU LLVM).

Guard the lookup the same way get_block_targets/get_block_preds already do.

Add tests/test_spu_analyser.cpp: a claude-written SPU program that reproduces the crash on the unpatched analyser.

[elad335]

This fix is incomplete, you need to remove the dead targets from m_targets

[digant73]

maybe the test file needs to be added also in rpcs3_test.vcxproj

[chotchki]

So I had originally kept the fix very narrow since based on how the other guards worked I didn't think pruning was right. This set of commits fixes that. I also had Claude scan across the SPUCommonRecompiler.cpp‎ for any other range violations and it also found a typo. I've had it implement tests for all the changes and picked up @digant73's note about the CMake vs Visual Studio project miss (I don't have a Windows box handy so I'm hoping CI catches any errors on that edit).

• Prune the dead targets from m_targets (the core ask): the cleanup pass now also drops in-range target edges whose block was removed (|| !m_block_info[*it2/4]), so the dangling edges never reach m_bbs — not just guarded against downstream.
• out_target_list is now exported after the prune — it ran before, so the exported map still leaked the dead edges.
• Kept the initiate_patterns guard and added a matching one in the cond_next loop-body walk as defense-in-depth (the existing get_block_targets/get_block_preds guards stay too).
• Also fixed a pre-existing /41 → /4 index typo in the Giga "Fill more block info" re-decode — it read the wrong word and corrupted per-block reg_const/reg_val32. It's a separate commit; happy to pull it into its own PR if you'd prefer.
• Added test_spu_analyser.cpp to rpcs3_test.vcxproj — thanks @digant73.

Tests: the original stop-trap regression plus three more. The exported-map test is discriminating (fails without the prune); the loop-body-walk and re-decode tests are positive coverage (the /41 effect is internal-only, so it can't be pinned through analyse()'s public output). All four pass locally via rpcs3_test; every SPU word is made-up data.