src0 := image.NewRGBA(image.Rect(0, 0, 100, 100))
	mask0 := image.NewRGBA(image.Rect(0, 0, 100, 100))
	for _, c := range clipTests {
		dst := dst0.SubImage(c.dr).(*image.RGBA)
		src := src0.SubImage(c.sr).(*image.RGBA)
		r, sp, mp := c.r, c.sp, c.mp
		if c.nilMask {
			clip(dst, &r, src, &sp, nil, nil)
		} else {
			clip(dst, &r, src, &sp, mask0.SubImage(c.mr), &mp)
		}

// cidr('::1/128').ip().family() // returns '6'
// cidr('192.168.0.0/24').masked() // returns cidr('192.168.0.0/24')
// cidr('192.168.0.1/24').masked() // returns cidr('192.168.0.0/24')
// cidr('192.168.0.0/24') == cidr('192.168.0.0/24').masked() // returns true, CIDR was already in canonical format
// cidr('192.168.0.1/24') == cidr('192.168.0.1/24').masked() // returns false, CIDR was not in canonical format

	if prefix.Addr().Is6() {
		n = t.rootV6
	}
	bitPosition := 0
	// mask the address for sanity
	address := prefix.Masked().Addr()
	// we can't check longer than the request mask
	mask := prefix.Bits()
	// walk the network bits of the prefix
	for bitPosition < mask {
		// Look for a child checking the bit position after the mask
		n = n.child[getBitFromAddr(address, bitPosition+1)]
		if n == nil {

}

// check 32-bit shift masking
func mask32(x uint32) uint32 {
	return (x << 29) >> 29 // arm64:"AND\t[$]7, R[0-9]+",-"LSR",-"LSL"
}

// check 16-bit shift masking
func mask16(x uint16) uint16 {
	return (x << 14) >> 14 // arm64:"AND\t[$]3, R[0-9]+",-"LSR",-"LSL"
}

// check 8-bit shift masking
func mask8(x uint8) uint8 {
	return (x << 7) >> 7 // arm64:"AND\t[$]1, R[0-9]+",-"LSR",-"LSL"
}

					return
				}
			} else if mask0, ok := mask.(*image.Alpha); ok {
				switch src0 := src.(type) {
				case *image.Uniform:
					drawGlyphOver(dst0, r, src0, mask0, mp)
					return
				case *image.RGBA:
					drawRGBAMaskOver(dst0, r, src0, sp, mask0, mp)
					return
				case *image.Gray:
					drawGrayMaskOver(dst0, r, src0, sp, mask0, mp)
					return

		if i >= 56 {
			// we might have to write the length here if all fit in one block
			d.x[i] |= mask1b & length[i-56]
		}
	}

	// compress, and only keep the digest if all fit in one block
	block(d, d.x[:])

	var digest [Size]byte
	for i, s := range d.h {
		digest[i*4] = mask1b & byte(s>>24)
		digest[i*4+1] = mask1b & byte(s>>16)
		digest[i*4+2] = mask1b & byte(s>>8)

			expectResult: apiservercel.IP{Addr: ipv4Addr},
		},
		{
			name:         "masks masked ipv4",
			expr:         `cidr("192.168.0.0/24").masked()`,
			expectResult: apiservercel.CIDR{Prefix: netip.PrefixFrom(ipv4Addr, 24)},
		},
		{
			name:         "masks unmasked ipv4",
			expr:         `cidr("192.168.0.1/24").masked()`,
			expectResult: apiservercel.CIDR{Prefix: netip.PrefixFrom(ipv4Addr, 24)},
		},
		{

		{
			name:   "Mask 01 OR mask 10",
			masks:  [][]int{{0}, {1}},
			orMask: "11",
		},
		{
			name:   "Mask 11 OR mask 11",
			masks:  [][]int{{0, 1}, {0, 1}},
			orMask: "11",
		},
		{
			name:   "Mask 01 OR mask 10 OR mask 11",
			masks:  [][]int{{0}, {1}, {0, 1}},
			orMask: "11",
		},
		{
			name:   "Mask 1000 OR mask 0100 OR mask 0010 OR mask 0001",
			masks:  [][]int{{3}, {2}, {1}, {0}},

  internal const val B0_FLAG_RSV3 = 16

  /** Byte 0 mask for the frame opcode. */
  internal const val B0_MASK_OPCODE = 15

  /** Flag in the opcode which indicates a control frame. */
  internal const val OPCODE_FLAG_CONTROL = 8

  /**
   * Byte 1 flag for whether the payload data is masked.
   *
   * If this flag is set, the next four

		r |= Less
	}
	return r
}

func (c CCMask) String() string {
	switch c {
	// 0-bit mask
	case Never:
		return "Never"

	// 1-bit masks
	case Equal:
		return "Equal"
	case Less:
		return "Less"
	case Greater:
		return "Greater"
	case Unordered:
		return "Unordered"

	// 2-bit masks
	case EqualOrUnordered:
		return "EqualOrUnordered"
	case LessOrEqual:
		return "LessOrEqual"