@Test
	public void testEmptyTaintClears() throws Throwable {
		try (ToyDBTraceBuilder tb = new ToyDBTraceBuilder("Test", "x86:LE:64:default")) {
			AddressSpace ram = tb.language.getAddressFactory().getDefaultAddressSpace();
			TraceThread thread = initTrace(tb, """
					RIP = 0x00400000;
					""",
				List.of(
					"MOV qword ptr [0x00600000], RAX",
					"MOV qword ptr [0x00600000], RBX"));

			TaintTracePcodeEmulator emu = new TaintTracePcodeEmulator(tb.host, 0);
			PcodeThread<Pair<byte[], TaintVec>> emuThread = emu.newThread(thread.getPath());
			emuThread.getState()
					.setVar(tb.reg("RAX"), Pair.of(
						tb.arr(0, 0, 0, 0, 0, 0, 0, 0),
						TaintVec.copies(TaintSet.parse("test_0"), 8)));

			emuThread.stepInstruction();
			try (Transaction tx = tb.startTransaction()) {
				emu.writeDown(tb.host, 1, 0);
			}
			emuThread.stepInstruction();
			try (Transaction tx = tb.startTransaction()) {
				emu.writeDown(tb.host, 2, 0);
			}

			TracePropertyMap<String> taintMap =
				tb.trace.getAddressPropertyManager().getPropertyMap("Taint", String.class);

			assertEquals(makeTaintEntries(tb.trace, Lifespan.at(1), ram, Set.of(
				0x00600000L, 0x00600001L, 0x00600002L, 0x00600003L,
				0x00600004L, 0x00600005L, 0x00600006L, 0x00600007L),
				"test_0"),
				Set.copyOf(taintMap.getEntries(
					Lifespan.at(1), tb.range(0x00600000, 0x00600007))));
		}
	}
Test that state is properly read from trace memory

<p>
We isolate exactly a read by executing sleigh.
Ghidra/Debug/TaintAnalysis/src/test/java/ghidra/pcode/emu/taint/trace/TaintTracePcodeEmulatorTest.java