deps: v8, cherry-pick 9365d09, aac2f8c, 47d34a3

    Original commit message 9365d09:

        [coverage] Rework continuation counter handling

        This changes a few bits about how continuation counters are handled.

        It introduces a new mechanism that allows removal of a continuation
        range after it has been created. If coverage is enabled, we run a first
        post-processing pass on the AST immediately after parsing, which
        removes problematic continuation ranges in two situations:

        1. nested continuation counters - only the outermost stays alive.
        2. trailing continuation counters within a block-like structure are
           removed if the containing structure itself has a continuation.

        R=bmeurer@chromium.org, jgruber@chromium.org, yangguo@chromium.org

        Bug: v8:8381, v8:8539
        Change-Id: I6bcaea5060d8c481d7bae099f6db9f993cc30ee3
        Reviewed-on: https://chromium-review.googlesource.com/c/1339119
        Reviewed-by: Yang Guo <yangguo@chromium.org>
        Reviewed-by: Leszek Swirski <leszeks@chromium.org>
        Reviewed-by: Georg Neis <neis@chromium.org>
        Commit-Queue: Jakob Gruber <jgruber@chromium.org>
        Cr-Commit-Position: refs/heads/master@{#58443}

    Refs: v8/v8@9365d09

    Original commit message aac2f8c:

        [coverage] Filter out singleton ranges that alias full ranges

        Block coverage is based on a system of ranges that can either have
        both a start and end position, or only a start position (so-called
        singleton ranges). When formatting coverage information, singletons
        are expanded until the end of the immediate full parent range. E.g.
        in:

        {0, 10}  // Full range.
        {5, -1}  // Singleton range.

        the singleton range is expanded to {5, 10}.

        Singletons are produced mostly for continuation counters that track
        whether we execute past a specific language construct.

        Unfortunately, continuation counters can turn up in spots that confuse
        our post-processing. For example:

        if (true) { ... block1 ... } else { ... block2 ... }

        If block1 produces a continuation counter, it could end up with the
        same start position as the else-branch counter. Since we merge
        identical blocks, the else-branch could incorrectly end up with an
        execution count of one.

        We need to avoid merging such cases. A full range should always take
        precedence over a singleton range; a singleton range should never
        expand to completely fill a full range. An additional post-processing
        pass ensures this.

        Bug: v8:8237
        Change-Id: Idb3ec7b2feddc0585313810b9c8be1e9f4ec64bf
        Reviewed-on: https://chromium-review.googlesource.com/c/1273095
        Reviewed-by: Georg Neis <neis@chromium.org>
        Reviewed-by: Yang Guo <yangguo@chromium.org>
        Commit-Queue: Jakob Gruber <jgruber@chromium.org>
        Cr-Commit-Position: refs/heads/master@{#56531}

    Refs: v8/v8@aac2f8c

    deps: V8: backport 47d34a3

    Original commit message:

        Revert "[coverage] change block range to avoid ambiguity."

        This reverts commit 471fef0469d04d7c487f3a08e81f3d77566a2f50.

        Reason for revert: A more general fix incoming at https://crrev.com/c/1273095.

        Original change's description:
        > [coverage] change block range to avoid ambiguity.
        >
        > By moving the block range end to left of closing bracket,
        > we can avoid ambiguity where an open-ended singleton range
        > could be both interpreted as inside the parent range, or
        > next to it.
        >
        > R=<U+200B>verwaest@chromium.org
        >
        > Bug: v8:8237
        > Change-Id: Ibc9412b31efe900b6d8bff0d8fa8c52ddfbf460a
        > Reviewed-on: https://chromium-review.googlesource.com/1254127
        > Reviewed-by: Georg Neis <neis@chromium.org>
        > Commit-Queue: Yang Guo <yangguo@chromium.org>
        > Cr-Commit-Position: refs/heads/master@{#56347}

        TBR=yangguo@chromium.org,neis@chromium.org,verwaest@chromium.org

        # Not skipping CQ checks because original CL landed > 1 day ago.

        Bug: v8:8237
        Change-Id: I39310cf3c2f06a0d98ff314740aaeefbfffc0834
        Reviewed-on: https://chromium-review.googlesource.com/c/1273096
        Reviewed-by: Jakob Gruber <jgruber@chromium.org>
        Reviewed-by: Toon Verwaest <verwaest@chromium.org>
        Reviewed-by: Yang Guo <yangguo@chromium.org>
        Commit-Queue: Jakob Gruber <jgruber@chromium.org>
        Cr-Commit-Position: refs/heads/master@{#56513}

    Refs: https://github.com/v8/v8/commit/47d34a317e47bad86b68326607cd2e6de3901f3e

PR-URL: https://github.com/nodejs/node/pull/25429
Reviewed-By: Yang Guo <yangguo@chromium.org>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

1 files changed, 38 insertions, 26 deletions

diff --git a/deps/v8/src/debug/debug-coverage.cc b/deps/v8/src/debug/debug-coverage.cc
index 57c5f31079..9e0791babc 100644
--- a/deps/v8/src/debug/debug-coverage.cc
+++ b/deps/v8/src/debug/debug-coverage.cc
@@ -81,11 +81,6 @@ std::vector<CoverageBlock> GetSortedBlockData(SharedFunctionInfo* shared) {
   std::vector<CoverageBlock> result;
   if (coverage_info->SlotCount() == 0) return result;
 
-  if (FLAG_trace_block_coverage) {
-    PrintF("Collecting coverage data\n");
-    coverage_info->Print(shared->DebugName()->ToCString());
-  }
-
   for (int i = 0; i < coverage_info->SlotCount(); i++) {
     const int start_pos = coverage_info->StartSourcePosition(i);
     const int until_pos = coverage_info->EndSourcePosition(i);
@@ -176,6 +171,12 @@ class CoverageBlockIterator final {
     return function_->blocks[read_index_ + 1];
   }
 
+  CoverageBlock& GetPreviousBlock() {
+    DCHECK(IsActive());
+    DCHECK_GT(read_index_, 0);
+    return function_->blocks[read_index_ - 1];
+  }
+
   CoverageBlock& GetParent() {
     DCHECK(IsActive());
     return nesting_stack_.back();
@@ -232,25 +233,6 @@ bool HaveSameSourceRange(const CoverageBlock& lhs, const CoverageBlock& rhs) {
   return lhs.start == rhs.start && lhs.end == rhs.end;
 }
 
-void MergeDuplicateSingletons(CoverageFunction* function) {
-  CoverageBlockIterator iter(function);
-
-  while (iter.Next() && iter.HasNext()) {
-    CoverageBlock& block = iter.GetBlock();
-    CoverageBlock& next_block = iter.GetNextBlock();
-
-    // Identical ranges should only occur through singleton ranges. Consider the
-    // ranges for `for (.) break;`: continuation ranges for both the `break` and
-    // `for` statements begin after the trailing semicolon.
-    // Such ranges are merged and keep the maximal execution count.
-    if (!HaveSameSourceRange(block, next_block)) continue;
-
-    DCHECK_EQ(kNoSourcePosition, block.end);  // Singleton range.
-    next_block.count = std::max(block.count, next_block.count);
-    iter.DeleteBlock();
-  }
-}
-
 void MergeDuplicateRanges(CoverageFunction* function) {
   CoverageBlockIterator iter(function);
 
@@ -330,6 +312,30 @@ void MergeNestedRanges(CoverageFunction* function) {
   }
 }
 
+void FilterAliasedSingletons(CoverageFunction* function) {
+  CoverageBlockIterator iter(function);
+
+  iter.Next();  // Advance once since we reference the previous block later.
+
+  while (iter.Next()) {
+    CoverageBlock& previous_block = iter.GetPreviousBlock();
+    CoverageBlock& block = iter.GetBlock();
+
+    bool is_singleton = block.end == kNoSourcePosition;
+    bool aliases_start = block.start == previous_block.start;
+
+    if (is_singleton && aliases_start) {
+      // The previous block must have a full range since duplicate singletons
+      // have already been merged.
+      DCHECK_NE(previous_block.end, kNoSourcePosition);
+      // Likewise, the next block must have another start position since
+      // singletons are sorted to the end.
+      DCHECK_IMPLIES(iter.HasNext(), iter.GetNextBlock().start != block.start);
+      iter.DeleteBlock();
+    }
+  }
+}
+
 void FilterUncoveredRanges(CoverageFunction* function) {
   CoverageBlockIterator iter(function);
 
@@ -399,8 +405,14 @@ void CollectBlockCoverage(CoverageFunction* function, SharedFunctionInfo* info,
   // If in binary mode, only report counts of 0/1.
   if (mode == debug::Coverage::kBlockBinary) ClampToBinary(function);
 
-  // Remove duplicate singleton ranges, keeping the max count.
-  MergeDuplicateSingletons(function);
+  // Remove singleton ranges with the same start position as a full range and
+  // throw away their counts.
+  // Singleton ranges are only intended to split existing full ranges and should
+  // never expand into a full range. Consider 'if (cond) { ... } else { ... }'
+  // as a problematic example; if the then-block produces a continuation
+  // singleton, it would incorrectly expand into the else range.
+  // For more context, see https://crbug.com/v8/8237.
+  FilterAliasedSingletons(function);
 
   // Rewrite all singletons (created e.g. by continuations and unconditional
   // control flow) to ranges.