Crash with push descriptors under MoltenVK

[jcm93]

Occurs very soon after loading a game. Here's the trace:

* thread #32, stop reason = EXC_BAD_ACCESS (code=1, address=0x60)
  * frame #0: 0x00000001178efd6c libMoltenVK.dylib`MVKBuffer::getMTLBuffer(this=0x0000000000000000) at MVKBuffer.mm:180:6
    frame #1: 0x000000011793ea2c libMoltenVK.dylib`MVKDescriptorSetLayoutBinding::push(this=0x000000015a1ef0e0, cmdEncoder=0x0000000000000000, pipelineBindPoint=VK_PIPELINE_BIND_POINT_COMPUTE, dstArrayElement=0x000000017db8e580, descriptorCount=0x000000017db8e57c, descriptorsPushed=0x000000017db8e56c, descriptorType=VK_DESCRIPTOR_TYPE_STORAGE_BUFFER, stride=48, pData=0x0000000159fa8510, dslMTLRezIdxOffsets=0x000000012f760be0) at MVKDescriptor.mm:273:40
    frame #2: 0x000000011780ad5c libMoltenVK.dylib`MVKDescriptorSetLayout::pushDescriptorSet(this=0x0000600002fb6400, cmdEncoder=0x0000000000000000, descUpdateTemplate=0x0000600003ea37e0, pData=0x0000000159fa8300, dslMTLRezIdxOffsets=0x000000012f760be0) at MVKDescriptorSet.mm:227:32
    frame #3: 0x0000000117948340 libMoltenVK.dylib`MVKPipelineLayout::pushDescriptorSet(this=0x000000012f7607b0, cmdEncoder=0x0000000000000000, descUpdateTemplate=0x0000600003ea37e0, set=1, pData=0x0000000159fa8300) at MVKPipeline.mm:87:7
    frame #4: 0x0000000117a31ee0 libMoltenVK.dylib`MVKCmdPushDescriptorSetWithTemplate::encode(this=0x0000600001523c30, cmdEncoder=0x0000000000000000) at MVKCmdPipeline.mm:531:19
    frame #5: 0x0000000117a31e94 libMoltenVK.dylib`MVKCmdPushDescriptorSetWithTemplate::setContent(this=0x0000600001523c30, cmdBuff=0x0000000159eee4d0, descUpdateTemplate=0x0000600003ea37e0, layout=0x000000012f7607b0, set=1, pData=0x00000001307b0a78) at MVKCmdPipeline.mm:526:2
    frame #6: 0x0000000117864dec libMoltenVK.dylib`vkCmdPushDescriptorSetWithTemplateKHR(commandBuffer=0x0000000159eee4e8, descriptorUpdateTemplate=0x0000600003ea37e0, layout=0x000000012f7607b0, set=1, pData=0x00000001307b0a78) at vulkan.mm:3130:5
    frame #7: 0x00000001009b3824 ares`Vulkan::CommandBuffer::push_descriptor_set(this=0x00000001307b03a0, set=1) at command_buffer.cpp:2621:2
    frame #8: 0x00000001009b1b44 ares`Vulkan::CommandBuffer::flush_descriptor_sets(this=0x00000001307b03a0) at command_buffer.cpp:2684:3
    frame #9: 0x00000001009b19ac ares`Vulkan::CommandBuffer::flush_compute_state(this=0x00000001307b03a0, synchronous=true) at command_buffer.cpp:1736:2
    frame #10: 0x00000001009b3d3c ares`Vulkan::CommandBuffer::dispatch(this=0x00000001307b03a0, groups_x=40, groups_y=30, groups_z=1) at command_buffer.cpp:2943:6
    frame #11: 0x000000010097b030 ares`RDP::Renderer::submit_depth_blend(this=0x00000001306c8040, cmd=0x00000001307b03a0, tmem=0x000000014aae9a30, upscaled=false, force_write_mask=false) at rdp_renderer.cpp:2207:6
    frame #12: 0x000000010097b590 ares`RDP::Renderer::submit_render_pass(this=0x00000001306c8040, cmd=0x00000001307b03a0) at rdp_renderer.cpp:2259:3
    frame #13: 0x000000010097378c ares`RDP::Renderer::flush_queues(this=0x00000001306c8040) at rdp_renderer.cpp:2955:3
    frame #14: 0x0000000100973e20 ares`RDP::Renderer::set_color_framebuffer(this=0x00000001306c8040, addr=3887104, width=320, fmt=RGBA5551) at rdp_renderer.cpp:677:3
    frame #15: 0x00000001009617b4 ares`RDP::CommandProcessor::op_set_color_image(this=0x00000001306c8000, words=0x00006000026e9000) at rdp_device.cpp:452:11
    frame #16: 0x0000000100963948 ares`RDP::CommandProcessor::enqueue_command_direct(this=0x00000001306c8000, (null)=2, words=0x00006000026e9000) at rdp_device.cpp:956:4
    frame #17: 0x000000010095bc04 ares`RDP::CommandRing::thread_loop(this=0x000000013071f788) at command_ring.cpp:126:14
    frame #18: 0x000000010095e448 ares`decltype(*std::declval<RDP::CommandRing*>().*std::declval<void (RDP::CommandRing::*)()>()()) std::__1::__invoke[abi:de180100]<void (RDP::CommandRing::*)(), RDP::CommandRing*, void>(__f=0x0000600009dfa588, __a0=0x0000600009dfa598) at invoke.h:312:25
    frame #19: 0x000000010095e3b8 ares`void std::__1::__thread_execute[abi:de180100]<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct>>, void (RDP::CommandRing::*)(), RDP::CommandRing*, 2ul>(__t=size=3, (null)=__tuple_indices<2UL> @ 0x000000017db8ef7f) at thread.h:199:3
    frame #20: 0x000000010095e064 ares`void* std::__1::__thread_proxy[abi:de180100]<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct>>, void (RDP::CommandRing::*)(), RDP::CommandRing*>>(__vp=0x0000600009dfa580) at thread.h:208:3
    frame #21: 0x000000011556e9ac libsystem_pthread.dylib`_pthread_start + 136

Seems to happen on MoltenVK's validation pass which is performed on a null command encoder:

Then it eventually dies in void MVKDescriptorSetLayoutBinding::push since the bind point in the above frame seems to point at something that is not a buffer.

Let me know if I can provide any more information.