qemu-x86_64: qemu/tcg/ppc/tcg-target.c.inc:1777:tcg_out_test: code should not be reached

Host environment

• Operating system: Adélie Linux
• OS/kernel version: Linux gwyn.foxkit.us 5.15.98-mc4-easy #1 SMP Sun Apr 2 00:16:18 CDT 2023 ppc64 GNU/Linux
• Architecture: ppc64
• QEMU flavor: qemu-x86_64
• QEMU version: qemu-x86_64 version 9.0.50 (v9.0.0-521-g15957eb9ef-dirty)
• QEMU command line: qemu-x86_64 ./test

Emulated/Virtualized environment

• Operating system: n/a
• OS/kernel version: n/a
• Architecture: x86_64

Description of problem

Using this basic test file:

int
main (void)
{
    return 0;
}

compiled into a static executable using an x86_64 toolchain (glibc or musl both tested),

gwyn ~/qemu-bug # file test1
test1: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, with debug_info, not stripped

gwyn ~/qemu-bug # file test2
test2: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=276dc49ee7cbd3b760e24761bf9fb9e1cc4b4349, for GNU/Linux 3.2.0, not stripped

Using QEMU from 15957eb9 or newer:

gwyn ~/qemu-bug # ../emus-ppc64/bin/qemu-x86_64 --version
qemu-x86_64 version 9.0.50 (v9.0.0-521-g15957eb9ef-dirty)
Copyright (c) 2003-2024 Fabrice Bellard and the QEMU Project developers

QEMU crashes:

gwyn ~/qemu-bug # ../emus-ppc64/bin/qemu-x86_64 ./test2
**
ERROR:/root/qemu/tcg/ppc/tcg-target.c.inc:1777:tcg_out_test: code should not be reached
Bail out! ERROR:/root/qemu/tcg/ppc/tcg-target.c.inc:1777:tcg_out_test: code should not be reached
Aborted

Steps to reproduce

1. Build QEMU user for ppc64 (may affect other hosts) using commit 15957eb9 or newer.
2. Run any simple x86_64 executable.
3. Observe the crash.

Additional information

Bisected to here:

commit 15957eb9efe2da67c796612cead95cba28ba9bda
Author: Paolo Bonzini <pbonzini@redhat.com>
Date:   Fri Oct 27 05:57:31 2023 +0200

    target/i386: use TSTEQ/TSTNE to test low bits
    
    When testing the sign bit or equality to zero of a partial register, it
    is useful to use a single TSTEQ or TSTNE operation.  It can also be used
    to test the parity flag, using bit 0 of the population count.
    
    Do not do this for target_ulong-sized values however; the optimizer would
    produce a comparison against zero anyway, and it avoids shifts by 64
    which are undefined behavior.
    
    Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

 target/i386/tcg/emit.c.inc  |  5 ++---
 target/i386/tcg/translate.c | 28 ++++++++++++++++++++--------
 2 files changed, 22 insertions(+), 11 deletions(-)