diff --git a/tcg/wasm32/tcg-target.c.inc b/tcg/wasm32/tcg-target.c.inc index 143b1ab0fc..98de221ac4 100644 --- a/tcg/wasm32/tcg-target.c.inc +++ b/tcg/wasm32/tcg-target.c.inc @@ -3392,6 +3392,10 @@ static void tcg_out_qemu_ld(TCGContext *s, TCGOpcode opc, const TCGArg *args, bo { wasm_tb_had_load = true; tcg_tci_out_qemu_ldst(s, opc, args); + // Aliased qemu_ld - The wasm32 wrapper corrupts vCPU TLB state when the load destination also holds the address. + if (args[0] == args[1]) { + wasm_tci_only_tb = true; + } tcg_wasm_out_qemu_ld(s, args, is_64); } static void tcg_out_qemu_st(TCGContext *s, TCGOpcode opc, const TCGArg *args, bool is_64) @@ -3399,8 +3403,7 @@ static void tcg_out_qemu_st(TCGContext *s, TCGOpcode opc, const TCGArg *args, bo wasm_tb_had_store = true; tcg_tci_out_qemu_ldst(s, opc, args); tcg_wasm_out_qemu_st(s, args, is_64); - /* ponytail: Mixed Store TBs Stay TCI - Pure store TBs are safe, but a store+load/helper TB in uzlib corrupts the vCPU TLB arrays when compiled. */ - bool store_tci = !wasm_store_tci_disabled && (wasm_tb_had_load || wasm_tb_had_helper); + bool store_tci = false; if (s->gen_tb && (wasm_store_tci_hash || wasm_store_bisect_on)) { uint64_t pc = s->gen_tb->pc; uint32_t h = (uint32_t)((pc * 0x9e3779b97f4a7c15ull) >> 33);