Bug 185705

Summary: DFG backend for CheckTypeInfoFlags won't work if we ever pass in a bitset with more than one bit set and we want to test that all bits are set
Product: WebKit Reporter: Saam Barati <saam>
Component: JavaScriptCoreAssignee: Saam Barati <saam>
Status: NEW ---    
Severity: Normal CC: benjamin, fpizlo, ggaren, gskachkov, jfbastien, keith_miller, mark.lam, msaboff, rmorisset, ticaiolima, ysuzuki
Priority: P2    
Version: Safari Technology Preview   
Hardware: Unspecified   
OS: Unspecified   

Description Saam Barati 2018-05-16 17:03:02 PDT 
speculationCheck(BadTypeInfoFlags, JSValueRegs(), 0, m_jit.branchTest8(MacroAssembler::Zero, MacroAssembler::Address(baseGPR, JSCell::typeInfoFlagsOffset()), MacroAssembler::TrustedImm32(node->typeInfoOperand())));
Comment 1 Saam Barati 2018-05-16 17:10:14 PDT 
It's not super important now since we just use this node for ImplementsDefaultHasIntance. But if we add new uses of the node, this implementation may become wrong.