Savestate: Defer operations while the GE debugger holds a list

The list belongs to the sceGe call still in progress, whose end would have
run on the loaded CPU state. Also stop the camera and GPS when a state has
them off, don't restart capture when saving, and fix a double free of the
pmp frame queue (it only holds the media engine's own frame).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

Core/HLE/sceMpeg.cpp

@@ -1049,10 +1049,7 @@ void __VideoPmpInit() {
 
 void __VideoPmpShutdown() {
 #ifdef USE_FFMPEG
-	// We need to empty pmp_queue to not leak memory.
-	for (auto it = pmp_queue.begin(); it != pmp_queue.end(); ++it){
-		av_free(*it);
-	}
+	// The queued frames are the media engine's own m_pFrameRGB, which it frees.
 	pmp_queue.clear();
 	pmp_ContextList.clear();
 	delete pmpframes;

Core/HLE/sceUsbCam.cpp

@@ -63,10 +63,15 @@ void __UsbCamDoState(PointerWrap &p) {
 		return;
 	}
 
+	const bool wasCapturing = config->mode == Camera::Mode::Video;
 	Do(p, *config);
-	if (config->mode == Camera::Mode::Video) { // stillImage? TBD
-		Camera::stopCapture();
-		Camera::startCapture();
+	if (p.mode == p.MODE_READ) {
+		if (config->mode == Camera::Mode::Video) { // stillImage? TBD
+			Camera::stopCapture();
+			Camera::startCapture();
+		} else if (wasCapturing) {
+			Camera::stopCapture();
+		}
 	}
 }
 

Core/HLE/sceUsbGps.cpp

@@ -49,10 +49,15 @@ void __UsbGpsDoState(PointerWrap &p) {
 	if (!s)
 		return;
 
+	const bool wasOn = gpsStatus == GPS_STATE_ON;
 	Do(p, gpsStatus);
-	if (gpsStatus == GPS_STATE_ON) {
-		GPS::init();
-		System_GPSCommand("open");
+	if (p.mode == p.MODE_READ) {
+		if (gpsStatus == GPS_STATE_ON) {
+			GPS::init();
+			System_GPSCommand("open");
+		} else if (wasOn) {
+			System_GPSCommand("close");
+		}
 	}
 }
 

Core/MIPS/ARM/ArmJit.cpp

@@ -131,10 +131,10 @@ void ArmJit::DoState(PointerWrap &p)
 	if (!s)
 		return;
 
+	Do(p, js.startDefaultPrefix);
 	if (p.mode == PointerWrap::MODE_READ && !js.startDefaultPrefix) {
 		WARN_LOG(Log::CPU, "Jit: An uneaten prefix was previously detected. Jitting in unknown-prefix mode.");
 	}
-	Do(p, js.startDefaultPrefix);
 	if (s >= 2) {
 		Do(p, js.hasSetRounding);
 		if (p.mode == PointerWrap::MODE_READ) {

Core/SaveState.cpp

@@ -852,6 +852,11 @@ int g_screenshotFailures;
 
 		if (!needsProcess)
 			return;
+		if (coreState == CORE_STEPPING_GE || coreState == CORE_RUNNING_GE) {
+			// A display list stopped in the GE debugger still belongs to the sceGe call that started
+			// it, which finishes when the list does. Wait for that.
+			return;
+		}
 		needsProcess = false;
 
 		if (!__KernelIsRunning()) {