Thanks to the branch detection I found several places where op.o contained branch returns somewhere not at the end of the function. This did not happen on other platforms for me, but I may be wrong.
This patch adds FORCE_RET at the end of those functions, to force gcc to use a jump to the end and not return from it. The idea and most of the debugging for this comes from Michael Matz.
Index: qemu-snapshot-2008-01-15_05/target-i386/op.c =================================================================== --- qemu-snapshot-2008-01-15_05.orig/target-i386/op.c +++ qemu-snapshot-2008-01-15_05/target-i386/op.c @@ -291,6 +291,7 @@ void OPPROTO op_imull_EAX_T0(void) EDX = (uint32_t)(res >> 32); CC_DST = res; CC_SRC = (res != (int32_t)res); + FORCE_RET(); } void OPPROTO op_imulw_T0_T1(void) @@ -300,6 +301,7 @@ void OPPROTO op_imulw_T0_T1(void) T0 = res; CC_DST = res; CC_SRC = (res != (int16_t)res); + FORCE_RET(); } void OPPROTO op_imull_T0_T1(void) @@ -309,6 +311,7 @@ void OPPROTO op_imull_T0_T1(void) T0 = res; CC_DST = res; CC_SRC = (res != (int32_t)res); + FORCE_RET(); } #ifdef TARGET_X86_64 Index: qemu-snapshot-2008-01-15_05/target-i386/ops_template.h =================================================================== --- qemu-snapshot-2008-01-15_05.orig/target-i386/ops_template.h +++ qemu-snapshot-2008-01-15_05/target-i386/ops_template.h @@ -467,6 +467,7 @@ void OPPROTO glue(glue(op_bt, SUFFIX), _ int count; count = T1 & SHIFT_MASK; CC_SRC = T0 >> count; + FORCE_RET(); } void OPPROTO glue(glue(op_bts, SUFFIX), _T0_T1_cc)(void)