By the time validate_vex() runs, e->s2 is not used anymore and
decode->op[2].ot has already been filled in by decode_size().
So it's the latter that has to be adjusted, just like before
commit b7d4ec4832d ("target/i386/tcg: move VEX validation early",
2026-08-26).
Fixes: b7d4ec4832d ("target/i386/tcg: move VEX validation early", 2026-08-26)
Reported-by: Zhao Liu <[email protected]>
Reviewed-by: Zhao Liu <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
---
target/i386/tcg/decode-new.c.inc | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc
index 8d1e581cfde..26f6d6277be 100644
--- a/target/i386/tcg/decode-new.c.inc
+++ b/target/i386/tcg/decode-new.c.inc
@@ -2671,7 +2671,7 @@ static bool validate_vex(DisasContext *s, X86DecodedInsn
*decode)
}
assert(e->op2 == X86_TYPE_W && e->s2 == X86_SIZE_x);
if ((s->modrm >> 6) != 3) {
- e->s2 = s->prefix & PREFIX_REPNZ ? X86_SIZE_sd : X86_SIZE_ss;
+ decode->op[2].ot = s->prefix & PREFIX_REPNZ ? MO_64 : MO_32;
}
}
break;
--
2.55.0
