It currently asserts that shift_amount and dest cannot be the same. That's a good assertion for when shift_amount is not in cx. But if it's in cx already then it's OK for them to be the same. Air will sometimes do shift(cx, cx) if you do "x << x" and the coalescing got particularly clever.
Created attachment 271078 [details] the patch
r=me
Attachment 271078 [details] did not pass style-queue: ERROR: Source/JavaScriptCore/b3/testb3.cpp:10081: Place brace on its own line for function definitions. [whitespace/braces] [4] ERROR: Source/JavaScriptCore/b3/testb3.cpp:10104: Place brace on its own line for function definitions. [whitespace/braces] [4] ERROR: Source/JavaScriptCore/b3/testb3.cpp:10127: Place brace on its own line for function definitions. [whitespace/braces] [4] ERROR: Source/JavaScriptCore/b3/testb3.cpp:10149: Place brace on its own line for function definitions. [whitespace/braces] [4] ERROR: Source/JavaScriptCore/b3/testb3.cpp:10173: Place brace on its own line for function definitions. [whitespace/braces] [4] ERROR: Source/JavaScriptCore/b3/testb3.cpp:10197: Place brace on its own line for function definitions. [whitespace/braces] [4] Total errors found: 6 in 4 files If any of these errors are false positives, please file a bug against check-webkit-style.
Landed in http://trac.webkit.org/changeset/196433