[PATCH] tcg/optimize: computes incorrect smask for some shifts

Jacob Young <[email protected]> Tue, 04 Aug 2026 02:27:22 -0400
Newsgroups gmane.comp.emulators.qemu
Message-ID <[email protected]>
We were getting test failures in the Zig project test suite that only
occurred when running the test binary under qemu-i386 without passing
-one-insn-per-tb, suggesting a tcg bug.  I reduced the behavioral
difference down to:

        .globl  _start
    _start:
        movw    $0x4000, %ax
        addw    %ax, %ax
        cwtl
        shrl    %eax
        xorl    %ebx, %ebx
        cmpw    $-0x3fff, %ax
        setnl   %bl
        movl    $1, %eax
        int     $0x80

which reproduces the bug and is fixed by this patch:

    $ as --32 repro.s -o repro.o; ld -m elf_i386 repro.o -o repro
    $ ./repro; echo $?
    0
    $ qemu-i386 -one-insn-per-tb ./repro; echo $?
    0
    $ qemu-i386 ./repro; echo $?
    1
    $ ../qemu/build/qemu-i386 ./repro; echo $?
    0

Signed-off-by: Jacob Young <[email protected]>
---
Jacob Young (1):
      tcg/optimize: Fix s_mask computation for shifts

 tcg/optimize.c | 8 ++++++++
 1 file changed, 8 insertions(+)
---
base-commit: b428fe036233cbd15d37e3c027ab6ca4d3661a80
change-id: 20260803-fix-shift-smask-81e36be921e2

Best regards,
--  
Jacob Young <[email protected]>