A self-XOR can leave cc_op_dirty set when UCOMI keeps the CC_OP_EFLAGS
selector, causing a redundant store to cpu_cc_op. The UCOMI helper
already writes CC_OP_EFLAGS, so clear the dirty flag after assume_cc_op()
to avoid emitting that store.

Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
 target/i386/tcg/emit.c.inc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/i386/tcg/emit.c.inc b/target/i386/tcg/emit.c.inc
index 531398d..918122b 100644
--- a/target/i386/tcg/emit.c.inc
+++ b/target/i386/tcg/emit.c.inc
@@ -4914,6 +4914,7 @@ static void gen_VUCOMI(DisasContext *s, X86DecodedInsn *decode)
     fn = s->prefix & PREFIX_DATA ? gen_helper_ucomisd : gen_helper_ucomiss;
     fn(tcg_env, OP_PTR1, OP_PTR2);
     assume_cc_op(s, CC_OP_EFLAGS);
+    s->cc_op_dirty = false;
 }
 
 static void gen_VZEROALL(DisasContext *s, X86DecodedInsn *decode)
-- 
2.43.0

On 10/10/26 21:25, Hungyu Lin wrote:
> A self-XOR can leave cc_op_dirty set when UCOMI keeps the CC_OP_EFLAGS
> selector, causing a redundant store to cpu_cc_op. The UCOMI helper
> already writes CC_OP_EFLAGS, so clear the dirty flag after assume_cc_op()
> to avoid emitting that store.
> 
> Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
> ---
>   target/i386/tcg/emit.c.inc | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/target/i386/tcg/emit.c.inc b/target/i386/tcg/emit.c.inc
> index 531398d..918122b 100644
> --- a/target/i386/tcg/emit.c.inc
> +++ b/target/i386/tcg/emit.c.inc
> @@ -4914,6 +4914,7 @@ static void gen_VUCOMI(DisasContext *s, X86DecodedInsn *decode)
>       fn = s->prefix & PREFIX_DATA ? gen_helper_ucomisd : gen_helper_ucomiss;
>       fn(tcg_env, OP_PTR1, OP_PTR2);
>       assume_cc_op(s, CC_OP_EFLAGS);
> +    s->cc_op_dirty = false;
>   }
>   
>   static void gen_VZEROALL(DisasContext *s, X86DecodedInsn *decode)

This is definitely wrong.

If there's something you're trying to fix, explain that.


r~

> If there's something you're trying to fix, explain that.

For XOR -> UCOMISD -> JMP, I see CC_OP_EFLAGS stored twice: once by
the helper and again at the jump because cc_op_dirty is still set.

Could you point out which state-tracking invariant clearing it here
would violate?

Thanks,
Hungyu