gen_update_cc_op must be called before control flow splits. Doing it in gen_jmp_rel{,_csize} may hide bugs, instead assert that cc_op is clean---even if that means a few more calls to gen_update_cc_op().
With this new invariant, setting cc_op to CC_OP_DYNAMIC is unnecessary since the caller should have done it. Signed-off-by: Paolo Bonzini <pbonz...@redhat.com> --- target/i386/tcg/translate.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c index 6b766f5dd3f..17bf85da0ce 100644 --- a/target/i386/tcg/translate.c +++ b/target/i386/tcg/translate.c @@ -2852,6 +2852,8 @@ static void gen_jmp_rel(DisasContext *s, MemOp ot, int diff, int tb_num) target_ulong new_pc = s->pc + diff; target_ulong new_eip = new_pc - s->cs_base; + assert(!s->cc_op_dirty); + /* In 64-bit mode, operand size is fixed at 64 bits. */ if (!CODE64(s)) { if (ot == MO_16) { @@ -2865,9 +2867,6 @@ static void gen_jmp_rel(DisasContext *s, MemOp ot, int diff, int tb_num) } new_eip &= mask; - gen_update_cc_op(s); - set_cc_op(s, CC_OP_DYNAMIC); - if (tb_cflags(s->base.tb) & CF_PCREL) { tcg_gen_addi_tl(cpu_eip, cpu_eip, new_pc - s->pc_save); /* @@ -5145,6 +5144,7 @@ static bool disas_insn(DisasContext *s, CPUState *cpu) : (int16_t)insn_get(env, s, MO_16)); gen_push_v(s, eip_next_tl(s)); gen_bnd_jmp(s); + gen_update_cc_op(s); gen_jmp_rel(s, dflag, diff, 0); } break; @@ -5168,6 +5168,7 @@ static bool disas_insn(DisasContext *s, CPUState *cpu) ? (int32_t)insn_get(env, s, MO_32) : (int16_t)insn_get(env, s, MO_16)); gen_bnd_jmp(s); + gen_update_cc_op(s); gen_jmp_rel(s, dflag, diff, 0); } break; @@ -5188,6 +5189,7 @@ static bool disas_insn(DisasContext *s, CPUState *cpu) case 0xeb: /* jmp Jb */ { int diff = (int8_t)insn_get(env, s, MO_8); + gen_update_cc_op(s); gen_jmp_rel(s, dflag, diff, 0); } break; -- 2.45.0