metal: multisample textures allocated with Shared storage on integrated Intel GPUs — MTLTextureDescriptor validation abort

[AnyCPU]

Summary

Running a simple example app on an Intel Mac with integrated graphics (Iris Plus 655), the process aborts on the very first frame with a Metal validation failure:

-[MTLTextureDescriptorInternal validateWithDevice:]:1405: failed assertion `Texture Descriptor Validation
MTLTextureDescriptor: Multisample textures cannot be allocated with MTLStorageModeShared or MTLStorageModeManaged on this device.
'
SIGABRT: abort

This happens during device/canvas setup, before anything renders — the library is unusable on this class of hardware.

Affected code

hal/metal/device.go, (*Device).CreateTexture, at v0.30.20 (current release), lines 214–226:

storageMode := MTLStorageModePrivate
isShared := false
if d.hasUnifiedMemory {
    storageMode = MTLStorageModeShared
    isShared = true
}
_ = MsgSend(texDesc, Sel("setStorageMode:"), uintptr(storageMode))

sampleCount (computed a few lines above, normalized 0→1) is never consulted here — only hasUnifiedMemory is.

Root cause

hasUnifiedMemory is set from [MTLDevice hasUnifiedMemory] at device creation (device.go:57), and the surrounding comment treats hasUnifiedMemory == YES as synonymous with "Apple Silicon":

// Detect Apple Silicon (UMA): hasUnifiedMemory returns YES on M-series chips.

But integrated Intel GPUs (like the Iris Plus 655) also report hasUnifiedMemory == YES — they share system RAM with the CPU too. So on Intel-integrated hardware, CreateTexture unconditionally picks MTLStorageModeShared for every texture, including multisample ones.

The actual Metal rule: Apple-GPU-family devices (Apple Silicon) tolerate Shared-storage multisample textures, but non-Apple-family Metal devices reject the combination outright — hence the assertion above. That's also why this reproduces only on Intel/AMD Macs and is invisible on Apple Silicon.

Expected vs. actual

• Expected: a 4x MSAA render target allocates normally regardless of GPU vendor.
• Actual: the texture descriptor fails Metal's validation and the process aborts.

Suggested fix

Force Private storage whenever sampleCount > 1, independent of hasUnifiedMemory:

func textureStorageMode(hasUnifiedMemory bool, sampleCount uint32) (MTLStorageMode, bool) {
	if hasUnifiedMemory && sampleCount <= 1 {
		return MTLStorageModeShared, true
	}
	return MTLStorageModePrivate, false
}

Private is valid on every device family, so this is a pure widening of an already-existing safe path — it's exactly what discrete-GPU Macs already do for every texture today. One trade-off worth flagging: on Apple Silicon, MSAA textures move from Shared to Private, forfeiting the setPurgeableState(empty) prompt-reclaim optimization for those specific allocations. That seems acceptable since MSAA render targets are typically pooled and reused, not churned per frame — but you'd know better than me whether that matters for a workload I'm not aware of.

Patch

hal-metal-msaa-storage-mode.diff

diff --git a/hal/metal/conv.go b/hal/metal/conv.go
index 8977d9f..ab83b87 100644
--- a/hal/metal/conv.go
+++ b/hal/metal/conv.go
@@ -120,6 +120,30 @@ func textureUsageToMTL(usage gputypes.TextureUsage) MTLTextureUsage {
 	return mtlUsage
 }
 
+// textureStorageMode selects the Metal storage mode for a texture.
+//
+// Unified-memory GPUs (hasUnifiedMemory == YES — both Apple Silicon and
+// integrated Intel, which also shares system RAM) use Shared storage for
+// single-sample textures: physical memory is identical to Private, but Shared
+// permits direct CPU writes (replaceRegion:) and honours
+// setPurgeableState(empty) for prompt reclaim.
+//
+// Multisample textures (sampleCount > 1) are always Private, regardless of
+// hasUnifiedMemory. This is NOT "Metal forbids Shared MSAA everywhere" —
+// Apple-GPU-family devices (Apple Silicon) do allow it, which is why this bug
+// was invisible there. Non-Apple-family Metal devices (Intel/AMD Macs,
+// including integrated Intel iGPUs that still report hasUnifiedMemory==YES)
+// reject Shared/Managed storage for multisample textures outright
+// ("[MTLTextureDescriptor validateWithDevice:] ... cannot be allocated with
+// MTLStorageModeShared or MTLStorageModeManaged on this device"). Private is
+// valid on every device family, so it is used unconditionally for MSAA.
+func textureStorageMode(hasUnifiedMemory bool, sampleCount uint32) (MTLStorageMode, bool) {
+	if hasUnifiedMemory && sampleCount <= 1 {
+		return MTLStorageModeShared, true
+	}
+	return MTLStorageModePrivate, false
+}
+
 // textureTypeFromDimension converts WebGPU texture dimension to Metal texture type.
 func textureTypeFromDimension(dimension gputypes.TextureDimension, sampleCount, depth uint32) MTLTextureType {
 	switch dimension {
diff --git a/hal/metal/device.go b/hal/metal/device.go
index 66cabfa..f7df7cc 100644
--- a/hal/metal/device.go
+++ b/hal/metal/device.go
@@ -211,18 +211,7 @@ func (d *Device) CreateTexture(desc *hal.TextureDescriptor) (hal.Texture, error)
 	usage := textureUsageToMTL(desc.Usage)
 	_ = MsgSend(texDesc, Sel("setUsage:"), uintptr(usage))
 
-	// On Apple Silicon (UMA), use Shared storage instead of Private.
-	// Physical memory is identical on UMA — the only differences are:
-	//   (a) Shared supports direct CPU writes via replaceRegion: (no staging copy)
-	//   (b) Shared honours setPurgeableState(empty) which immediately returns
-	//       physical pages to the OS; Private silently ignores this call.
-	// On discrete-GPU Macs, keep Private (VRAM-resident, no CPU penalty per frame).
-	storageMode := MTLStorageModePrivate
-	isShared := false
-	if d.hasUnifiedMemory {
-		storageMode = MTLStorageModeShared
-		isShared = true
-	}
+	storageMode, isShared := textureStorageMode(d.hasUnifiedMemory, sampleCount)
 	_ = MsgSend(texDesc, Sel("setStorageMode:"), uintptr(storageMode))
 
 	raw := MsgSend(d.raw, Sel("newTextureWithDescriptor:"), uintptr(texDesc))
diff --git a/hal/metal/msaa_storage_test.go b/hal/metal/msaa_storage_test.go
new file mode 100644
index 0000000..bf3b222
--- /dev/null
+++ b/hal/metal/msaa_storage_test.go
@@ -0,0 +1,44 @@
+// Copyright 2025 The GoGPU Authors
+// SPDX-License-Identifier: MIT
+
+//go:build darwin && !(js && wasm)
+
+package metal
+
+import "testing"
+
+// TestTextureStorageMode pins the storage-mode decision that fixes this bug:
+// on Metal, multisample textures must always be Private — Shared/Managed is
+// rejected on non-Apple-family devices (integrated Intel included, since it
+// also reports hasUnifiedMemory == YES), even though Apple Silicon tolerates
+// Shared MSAA storage. Single-sample textures keep the pre-existing
+// UMA-vs-discrete behavior unchanged.
+func TestTextureStorageMode(t *testing.T) {
+	tests := []struct {
+		name             string
+		hasUnifiedMemory bool
+		sampleCount      uint32
+		wantMode         MTLStorageMode
+		wantIsShared     bool
+	}{
+		{"UMA single-sample", true, 1, MTLStorageModeShared, true},
+		{"UMA multisample (regression guard)", true, 4, MTLStorageModePrivate, false},
+		{"discrete single-sample", false, 1, MTLStorageModePrivate, false},
+		{"discrete multisample", false, 4, MTLStorageModePrivate, false},
+		{"UMA zero-sample treated as single-sample", true, 0, MTLStorageModeShared, true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			mode, isShared := textureStorageMode(tt.hasUnifiedMemory, tt.sampleCount)
+			if mode != tt.wantMode {
+				t.Errorf("textureStorageMode(%v, %d) mode = %v, want %v",
+					tt.hasUnifiedMemory, tt.sampleCount, mode, tt.wantMode)
+			}
+			if isShared != tt.wantIsShared {
+				t.Errorf("textureStorageMode(%v, %d) isShared = %v, want %v",
+					tt.hasUnifiedMemory, tt.sampleCount, isShared, tt.wantIsShared)
+			}
+		})
+	}
+}

git apply --check succeeds against a clean v0.30.20 checkout.

Verification

Added a small table test for the new helper (unified-memory × sample-count combinations, including a hasUnifiedMemory=true, sampleCount=4 → Private regression case) — pure logic, no GPU needed. Confirmed the example app that previously aborted immediately now runs stably and renders its window correctly on the same Intel Iris Plus 655 machine.

Environment

• gogpu/wgpu v0.30.20
• Go 1.26.5, CGO_ENABLED=0
• macOS 15.7.7, darwin/amd64
• GPU: Intel(R) Iris(TM) Plus Graphics 655 (integrated)

---

Part of the fix registry: gogpu/ui#170

[AnyCPU]

Follow-up: the same defect class also affects depth/stencil textures

While reviewing it more carefully afterward, I noticed textureStorageMode only looks at sampleCount, not texture format — which leaves the same underlying problem open for a different kind of texture.

The residual gap

hal/metal/device.go, (*Device).CreateTexture creates depth/stencil render targets (format Depth24PlusStencil8 or Stencil8) at sampleCount = 1 whenever multisampling is unavailable or disabled. With the fix as posted, a single-sample depth/stencil texture still resolves to Shared on any unified-memory device:

func textureStorageMode(hasUnifiedMemory bool, sampleCount uint32) (MTLStorageMode, bool) {
	if hasUnifiedMemory && sampleCount <= 1 {
		return MTLStorageModeShared, true
	}
	return MTLStorageModePrivate, false
}

That's the same shape of problem this issue reports for multisample textures — just gated on format instead of sample count. I haven't reproduced an actual crash from this (on my own hardware, MSAA is available, so depth/stencil textures happen to get sampleCount > 1 too and are already Private), so I'd call this latent rather than confirmed. But it seems worth closing defensively rather than waiting for a report: the fix here is a widening of the same safe path, not a new mechanism.

I'd also gently push back on my own original phrasing — I said this reproduces on "Intel/AMD Macs" generically. That's broader than the actual mechanism: discrete AMD GPUs report hasUnifiedMemory == false and are already unconditionally Private today, fix or not. The actual affected set is unified-memory devices that are not Apple-GPU-family — in practice, integrated Intel GPUs.

Suggested extension

Add a format parameter and skip the Shared path for depth/stencil formats too:

func textureStorageMode(hasUnifiedMemory bool, sampleCount uint32, format gputypes.TextureFormat) (MTLStorageMode, bool) {
	if hasUnifiedMemory && sampleCount <= 1 && !format.IsDepthStencil() {
		return MTLStorageModeShared, true
	}
	return MTLStorageModePrivate, false
}

This costs nothing: depth/stencil textures in my use case are render-attachment-only and never CPU-accessed, so they never used the replaceRegion: fast path, and setPurgeableState(empty) was already a no-op on Private.

Updated patch (extends the one above; diff against v0.30.20)

diff --git a/hal/metal/conv.go b/hal/metal/conv.go
index 8977d9f..fb469d5 100644
--- a/hal/metal/conv.go
+++ b/hal/metal/conv.go
@@ -120,6 +120,39 @@ func textureUsageToMTL(usage gputypes.TextureUsage) MTLTextureUsage {
 	return mtlUsage
 }
 
+// textureStorageMode selects the Metal storage mode for a texture.
+//
+// Unified-memory GPUs (hasUnifiedMemory == YES — both Apple Silicon and
+// integrated Intel, which also shares system RAM) use Shared storage for
+// single-sample, non-depth/stencil textures: physical memory is identical to
+// Private, but Shared permits direct CPU writes (replaceRegion:) and honours
+// setPurgeableState(empty) for prompt reclaim.
+//
+// Multisample textures (sampleCount > 1) are always Private, regardless of
+// hasUnifiedMemory. This is NOT "Metal forbids Shared MSAA everywhere" —
+// Apple-GPU-family devices (Apple Silicon) do allow it, which is why this bug
+// was invisible there. Non-Apple-family Metal devices (Intel/AMD Macs,
+// including integrated Intel iGPUs that still report hasUnifiedMemory==YES)
+// reject Shared/Managed storage for multisample textures outright
+// ("[MTLTextureDescriptor validateWithDevice:] ... cannot be allocated with
+// MTLStorageModeShared or MTLStorageModeManaged on this device"). Private is
+// valid on every device family, so it is used unconditionally for MSAA.
+//
+// Depth/stencil textures (format.IsDepthStencil()) are likewise always
+// Private, regardless of sample count. This costs nothing: depth/stencil
+// textures are RenderAttachment-only and never CPU-accessed, so they never
+// used the replaceRegion: fast path, and setPurgeableState(empty) is already
+// a harmless no-op on Private — matching what discrete-GPU Macs have always
+// done for every texture. This closes the same defect class as the multisample
+// case above (a UMA device may reject Shared for depth/stencil just as it
+// rejects Shared for multisample), before any device is known to hit it.
+func textureStorageMode(hasUnifiedMemory bool, sampleCount uint32, format gputypes.TextureFormat) (MTLStorageMode, bool) {
+	if hasUnifiedMemory && sampleCount <= 1 && !format.IsDepthStencil() {
+		return MTLStorageModeShared, true
+	}
+	return MTLStorageModePrivate, false
+}
+
 // textureTypeFromDimension converts WebGPU texture dimension to Metal texture type.
 func textureTypeFromDimension(dimension gputypes.TextureDimension, sampleCount, depth uint32) MTLTextureType {
 	switch dimension {
diff --git a/hal/metal/device.go b/hal/metal/device.go
index 66cabfa..bf05645 100644
--- a/hal/metal/device.go
+++ b/hal/metal/device.go
@@ -33,10 +33,15 @@ type Device struct {
 	adapter       *Adapter
 	eventListener ID     // id<MTLSharedEventListener> — created lazily, reused
 	queue         *Queue // back-reference for WaitIdle semaphore draining
-	// hasUnifiedMemory is true on Apple Silicon (UMA). On UMA, MTLStorageModeShared
-	// textures are physically identical to Private but allow setPurgeableState(empty)
-	// and direct CPU writes without a staging blit, which eliminates the main source
-	// of resize-induced memory growth.
+	// hasUnifiedMemory is true on any unified-memory-architecture GPU — both Apple
+	// Silicon and integrated Intel iGPUs report YES, since both share system RAM. It
+	// is NOT synonymous with "Apple Silicon" or "Apple-GPU-family": some non-Apple-
+	// family UMA devices reject MTLStorageModeShared for multisample and depth/stencil
+	// textures outright. On UMA, MTLStorageModeShared textures are
+	// physically identical to Private but allow setPurgeableState(empty) and direct
+	// CPU writes without a staging blit, which eliminates the main source of
+	// resize-induced memory growth — see textureStorageMode (conv.go) for the actual
+	// per-texture selection, which this field alone does not determine.
 	hasUnifiedMemory bool
 }
 
@@ -51,9 +56,12 @@ func newDevice(adapter *Adapter) (*Device, error) {
 		return nil, fmt.Errorf("metal: failed to create command queue")
 	}
 
-	// Detect Apple Silicon (UMA): hasUnifiedMemory returns YES on M-series chips.
-	// On UMA, MTLStorageModeShared == Private physically, so we use Shared for all
-	// user textures to enable setPurgeableState(empty) and direct CPU writes.
+	// Detect UMA: hasUnifiedMemory returns YES on M-series chips AND on integrated
+	// Intel iGPUs (both share system RAM) — it is not an Apple-Silicon-only signal.
+	// On UMA, MTLStorageModeShared == Private physically, so Shared is used for most
+	// user textures to enable setPurgeableState(empty) and direct CPU writes — except
+	// multisample and depth/stencil textures, which some non-Apple-family UMA devices
+	// reject as Shared outright; see textureStorageMode (conv.go).
 	hasUMA := MsgSend(adapter.raw, Sel("hasUnifiedMemory")) != 0
 
 	hal.Logger().Info("metal: device created",
@@ -211,18 +219,7 @@ func (d *Device) CreateTexture(desc *hal.TextureDescriptor) (hal.Texture, error)
 	usage := textureUsageToMTL(desc.Usage)
 	_ = MsgSend(texDesc, Sel("setUsage:"), uintptr(usage))
 
-	// On Apple Silicon (UMA), use Shared storage instead of Private.
-	// Physical memory is identical on UMA — the only differences are:
-	//   (a) Shared supports direct CPU writes via replaceRegion: (no staging copy)
-	//   (b) Shared honours setPurgeableState(empty) which immediately returns
-	//       physical pages to the OS; Private silently ignores this call.
-	// On discrete-GPU Macs, keep Private (VRAM-resident, no CPU penalty per frame).
-	storageMode := MTLStorageModePrivate
-	isShared := false
-	if d.hasUnifiedMemory {
-		storageMode = MTLStorageModeShared
-		isShared = true
-	}
+	storageMode, isShared := textureStorageMode(d.hasUnifiedMemory, sampleCount, desc.Format)
 	_ = MsgSend(texDesc, Sel("setStorageMode:"), uintptr(storageMode))
 
 	raw := MsgSend(d.raw, Sel("newTextureWithDescriptor:"), uintptr(texDesc))
diff --git a/hal/metal/msaa_storage_test.go b/hal/metal/msaa_storage_test.go
new file mode 100644
index 0000000..c32982f
--- /dev/null
+++ b/hal/metal/msaa_storage_test.go
@@ -0,0 +1,60 @@
+// Copyright 2025 The GoGPU Authors
+// SPDX-License-Identifier: MIT
+
+//go:build darwin && !(js && wasm)
+
+package metal
+
+import (
+	"testing"
+
+	"github.com/gogpu/gputypes"
+)
+
+// TestTextureStorageMode pins the storage-mode decision fixing the bug where
+// multisample textures must always be Private on Metal — Shared/Managed is
+// rejected on non-Apple-family devices (integrated Intel included, since it
+// also reports hasUnifiedMemory == YES), even though Apple Silicon tolerates
+// Shared MSAA storage. Single-sample color textures keep the pre-existing
+// UMA-vs-discrete behavior unchanged.
+//
+// It also pins a follow-up hardening: single-sample depth/stencil textures
+// are likewise always Private, regardless of hasUnifiedMemory. The original
+// fix only consulted sampleCount, leaving a same-shape latent gap for
+// depth/stencil textures (which are also RenderAttachment-only and never
+// CPU-accessed, so forcing Private costs nothing) — closed here before any
+// device is known to hit it.
+func TestTextureStorageMode(t *testing.T) {
+	tests := []struct {
+		name             string
+		hasUnifiedMemory bool
+		sampleCount      uint32
+		format           gputypes.TextureFormat
+		wantMode         MTLStorageMode
+		wantIsShared     bool
+	}{
+		{"UMA single-sample color", true, 1, gputypes.TextureFormatBGRA8Unorm, MTLStorageModeShared, true},
+		{"UMA multisample color (regression guard)", true, 4, gputypes.TextureFormatBGRA8Unorm, MTLStorageModePrivate, false},
+		{"discrete single-sample color", false, 1, gputypes.TextureFormatBGRA8Unorm, MTLStorageModePrivate, false},
+		{"discrete multisample color", false, 4, gputypes.TextureFormatBGRA8Unorm, MTLStorageModePrivate, false},
+		{"UMA zero-sample color treated as single-sample", true, 0, gputypes.TextureFormatBGRA8Unorm, MTLStorageModeShared, true},
+		{"UMA single-sample depth/stencil (regression guard)", true, 1, gputypes.TextureFormatDepth24PlusStencil8, MTLStorageModePrivate, false},
+		{"UMA single-sample stencil-only (regression guard)", true, 1, gputypes.TextureFormatStencil8, MTLStorageModePrivate, false},
+		{"UMA multisample depth/stencil", true, 4, gputypes.TextureFormatDepth24PlusStencil8, MTLStorageModePrivate, false},
+		{"discrete single-sample depth/stencil", false, 1, gputypes.TextureFormatDepth24PlusStencil8, MTLStorageModePrivate, false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			mode, isShared := textureStorageMode(tt.hasUnifiedMemory, tt.sampleCount, tt.format)
+			if mode != tt.wantMode {
+				t.Errorf("textureStorageMode(%v, %d, %v) mode = %v, want %v",
+					tt.hasUnifiedMemory, tt.sampleCount, tt.format, mode, tt.wantMode)
+			}
+			if isShared != tt.wantIsShared {
+				t.Errorf("textureStorageMode(%v, %d, %v) isShared = %v, want %v",
+					tt.hasUnifiedMemory, tt.sampleCount, tt.format, isShared, tt.wantIsShared)
+			}
+		})
+	}
+}

git apply --check succeeds against a clean v0.30.20 checkout (verified against the actual tagged module content, not just my own fork).

Verification

Extended the table test from the original patch with a format column and two new regression cases (Depth24PlusStencil8 and Stencil8 at sampleCount=1 on a unified-memory device, both expecting Private) — all 9 cases pass. Re-ran the example app that originally crashed; it's still stable on the same Iris Plus 655 machine.

[AnyCPU]

@kolkov check an update ^^

[kolkov]

Thank you for the follow-up — this is exactly the kind of thorough analysis we appreciate. You correctly identified a real gap in depth/stencil handling.

However, the merged fix (v0.30.22, PR #272) took a different approach from your original patch, which changes the analysis. Let me walk through the difference.

What your patch does vs. what we merged

Your original patch used hasUnifiedMemory as the predicate:

// Your patch (v0.30.20 base):
func textureStorageMode(hasUnifiedMemory bool, sampleCount uint32) (MTLStorageMode, bool) {
    if hasUnifiedMemory && sampleCount <= 1 {
        return MTLStorageModeShared, true
    }
    return MTLStorageModePrivate, false
}

Under this predicate, your follow-up concern is valid: an Intel iGPU (hasUnifiedMemory=true) with a single-sample depth/stencil texture would still get Shared — the same class of defect as the MSAA case.

Our merged fix replaces the predicate entirely — isAppleGPU instead of hasUnifiedMemory, detected via MTLGPUFamilyApple1:

// Merged (v0.30.22):
func textureStorageMode(isAppleGPU bool, sampleCount uint32) (MTLStorageMode, bool) {
    if isAppleGPU && sampleCount <= 1 {
        return MTLStorageModeShared, true
    }
    return MTLStorageModePrivate, false
}

Why the depth/stencil gap does not exist with isAppleGPU

The scenario you describe — Intel iGPU, sampleCount=1, depth/stencil format:

Predicate	Intel iGPU value	Result
hasUnifiedMemory (your patch)	true	Shared — gap exists
isAppleGPU (our merge)	false	Private — safe

Intel integrated GPUs report hasUnifiedMemory=true (they share system RAM) but do NOT belong to Apple GPU family. With our predicate, every non-Apple GPU gets Private for every texture — color, depth, stencil, MSAA, single-sample — unconditionally.

On Apple Silicon (isAppleGPU=true), Shared for single-sample depth/stencil is valid per Metal spec. The restriction in the validation message ("cannot be allocated with MTLStorageModeShared on this device") is gated on GPU family, not on pixel format. Apple-family devices accept Shared for all single-sample texture types.

Rust wgpu reference

For context, Rust wgpu-hal uses Private for ALL textures unconditionally (device.rs:455-461). No format check, no sample count check, no GPU family check. The only exception is Memoryless for transient textures on Apple2+. Our Shared optimization on Apple Silicon is an intentional divergence that provides zero-copy CPU writes and setPurgeableState(empty) reclaim — the rationale is in PR #272.

Why we chose not to add a format parameter

Adding format to textureStorageMode() would produce zero behavioral change on any real hardware:

• Non-Apple GPUs → already Private for everything (via isAppleGPU=false)
• Apple GPUs → Shared is valid for single-sample depth/stencil (Metal spec allows it)

It would also conflate two orthogonal properties: the Metal storage mode restriction is about GPU family capabilities, not about pixel format. Adding format-based filtering would muddy this architectural distinction without improving safety.

Your self-correction on affected hardware

Also appreciate this:

I'd also gently push back on my own original phrasing — I said this reproduces on "Intel/AMD Macs" generically. That's broader than the actual mechanism: discrete AMD GPUs report hasUnifiedMemory == false and are already unconditionally Private today, fix or not.

Exactly right. The affected set is specifically unified-memory devices that are not Apple-GPU-family — in practice, integrated Intel iGPUs only.

---

If you see a scenario where isAppleGPU-based logic still leaves a gap, we'd be glad to hear it. The full rationale is in PR #272.