@Test
	public void testGuestEmptyTaintClears() throws Throwable {
		try (ToyDBTraceBuilder tb = new ToyDBTraceBuilder("Test", "DATA:BE:64:default")) {
			TraceMemoryManager mm = tb.trace.getMemoryManager();
			AddressSpace ram = tb.language.getAddressFactory().getDefaultAddressSpace();
			TraceThread thread;
			TraceGuestPlatform x64;
			try (Transaction tx = tb.startTransaction()) {
				SchemaContext ctx = XmlSchemaContext.deserialize(DBTraceObjectManagerTest.XML_CTX);
				DBTraceObjectManager objects = tb.trace.getObjectManager();
				objects.createRootObject(ctx.getSchema(new SchemaName("Session")));
				thread = tb.getOrAddThread("Targets[0].Threads[0]", 0);

				x64 = tb.trace.getPlatformManager()
						.addGuestPlatform(getSLEIGH_X86_64_LANGUAGE().getDefaultCompilerSpec());
				x64.addMappedRegisterRange();
				x64.addMappedRange(tb.addr(0x00000000), tb.addr(x64, 0x00400000), 0x10000);
				x64.addMappedRange(tb.addr(0x20000000), tb.addr(x64, 0x00600000), 0x10000);
				objects.createObject(KeyPath.parse("Targets[0].Threads[0].Registers"))
						.insert(Lifespan.nowOn(0), ConflictResolution.DENY);
				// TODO: Make Sleigh work in the guest platform
				TraceMemorySpace regs = mm.getMemoryRegisterSpace(thread, 0, true);
				regs.setValue(x64, 0,
					new RegisterValue(tb.reg(x64, "RIP"), BigInteger.valueOf(0x00400000)));

				Assembler asm = Assemblers.getAssembler(x64.getLanguage());
				AssemblyBuffer buf = new AssemblyBuffer(asm, tb.addr(x64, 0x00400000));
				buf.assemble("MOV qword ptr [0x00600000], RAX");
				buf.assemble("MOV qword ptr [0x00600000], RBX");
				mm.putBytes(0, tb.addr(0x00000000), ByteBuffer.wrap(buf.getBytes()));
			}

			TaintTracePcodeEmulator emu = new TaintTracePcodeEmulator(x64, 0);
			PcodeThread<Pair<byte[], TaintVec>> emuThread = emu.newThread(thread.getPath());
			emuThread.getState()
					.setVar(tb.reg(x64, "RAX"), Pair.of(
						tb.arr(0, 0, 0, 0, 0, 0, 0, 0),
						TaintVec.copies(TaintSet.parse("test_0"), 8)));

			emuThread.stepInstruction();
			try (Transaction tx = tb.startTransaction()) {
				emu.writeDown(x64, 1, 0);
			}
			emuThread.stepInstruction();
			try (Transaction tx = tb.startTransaction()) {
				emu.writeDown(x64, 2, 0);
			}

			TracePropertyMap<String> taintMap =
				tb.trace.getAddressPropertyManager().getPropertyMap("Taint", String.class);

			assertEquals(makeTaintEntries(tb.trace, Lifespan.at(1), ram, Set.of(
				0x20000000L, 0x20000001L, 0x20000002L, 0x20000003L,
				0x20000004L, 0x20000005L, 0x20000006L, 0x20000007L),
				"test_0"),
				Set.copyOf(taintMap.getEntries(
					Lifespan.at(1), tb.range(0x20000000, 0x20000007))));
		}
	}
Test that state is properly read from trace memory

<p>
We isolate exactly a read by executing sleigh.
Ghidra/Debug/TaintAnalysis/src/test/java/ghidra/pcode/emu/taint/trace/TaintTracePcodeEmulatorTest.java