Bug 185705 - DFG backend for CheckTypeInfoFlags won't work if we ever pass in a bitset with more than one bit set and we want to test that all bits are set
Summary: DFG backend for CheckTypeInfoFlags won't work if we ever pass in a bitset wit...
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: Safari Technology Preview
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Saam Barati
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-05-16 17:03 PDT by Saam Barati
Modified: 2018-05-16 17:10 PDT (History)
11 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Saam Barati 2018-05-16 17:03:02 PDT 
speculationCheck(BadTypeInfoFlags, JSValueRegs(), 0, m_jit.branchTest8(MacroAssembler::Zero, MacroAssembler::Address(baseGPR, JSCell::typeInfoFlagsOffset()), MacroAssembler::TrustedImm32(node->typeInfoOperand())));
Comment 1 Saam Barati 2018-05-16 17:10:14 PDT 
It's not super important now since we just use this node for ImplementsDefaultHasIntance. But if we add new uses of the node, this implementation may become wrong.