runtime: 0.459 syscall: 0.341 instruction: 0.200 qemu-x86_64: qemu/tcg/ppc/tcg-target.c.inc:1777:tcg_out_test: code should not be reached Description of problem: Using this basic test file: ```c int main (void) { return 0; } ``` compiled into a static executable using an x86_64 toolchain (glibc or musl both tested), ``` gwyn ~/qemu-bug # file test1 test1: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, with debug_info, not stripped gwyn ~/qemu-bug # file test2 test2: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=276dc49ee7cbd3b760e24761bf9fb9e1cc4b4349, for GNU/Linux 3.2.0, not stripped ``` Using QEMU from 15957eb9efe2da67c796612cead95cba28ba9bda or newer: ``` gwyn ~/qemu-bug # ../emus-ppc64/bin/qemu-x86_64 --version qemu-x86_64 version 9.0.50 (v9.0.0-521-g15957eb9ef-dirty) Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers ``` QEMU crashes: ``` gwyn ~/qemu-bug # ../emus-ppc64/bin/qemu-x86_64 ./test2 ** ERROR:/root/qemu/tcg/ppc/tcg-target.c.inc:1777:tcg_out_test: code should not be reached Bail out! ERROR:/root/qemu/tcg/ppc/tcg-target.c.inc:1777:tcg_out_test: code should not be reached Aborted ``` Steps to reproduce: 1. Build QEMU user for ppc64 (may affect other hosts) using commit 15957eb9efe2da67c796612cead95cba28ba9bda or newer. 2. Run any simple x86_64 executable. 3. Observe the crash. Additional information: Bisected to here: ``` commit 15957eb9efe2da67c796612cead95cba28ba9bda Author: Paolo Bonzini Date: Fri Oct 27 05:57:31 2023 +0200 target/i386: use TSTEQ/TSTNE to test low bits When testing the sign bit or equality to zero of a partial register, it is useful to use a single TSTEQ or TSTNE operation. It can also be used to test the parity flag, using bit 0 of the population count. Do not do this for target_ulong-sized values however; the optimizer would produce a comparison against zero anyway, and it avoids shifts by 64 which are undefined behavior. Reviewed-by: Richard Henderson Signed-off-by: Paolo Bonzini target/i386/tcg/emit.c.inc | 5 ++--- target/i386/tcg/translate.c | 28 ++++++++++++++++++++-------- 2 files changed, 22 insertions(+), 11 deletions(-) ```