1404784 - Duplicate LCOV data emitted when compiling then executing script with environment chain

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Philip Chimento [:ptomato]]

Attachment: Minimal demonstration of problem

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Steps to reproduce:

When I compile and execute a JS script using JS::Compile followed by JS_ExecuteScript with an extra object on the environment chain, then the LCOV info emitted by js::GetCodeCoverageSummary() is incorrect. The name of the source file is emitted twice, and the totals of functions, branches, and lines, are twice the number they should be. The hit count is listed twice for each function, branch, and line, once with the real hit count and once with zero.

See the attachment for a minimal C++ program that demonstrates the problem.


Actual results:

The operative lines are:

    JS::AutoObjectVector env_chain(cx);
    JS::RootedObject eval_obj(cx, JS_NewPlainObject(cx));
    (void) env_chain.append(eval_obj);

    JS::RootedScript compiled_script(cx);
    (void) JS::Compile(cx, opts, script, len, &compiled_script);
    (void) JS_ExecuteScript(cx, env_chain, compiled_script, rval);

Here's the output that gets printed:

TN:Compartment_5f7fb81095aa00
SF:cov.js
SF:cov.js
FN:1,top-level
FN:1,top-level
FNDA:1,top-level
FNF:2
FNH:1
BRDA:2,0,0,-
BRDA:2,0,1,-
BRDA:2,0,0,1
BRDA:2,0,1,-
BRF:4
BRH:1
DA:2,0
DA:3,0
DA:5,0
DA:2,1
DA:3,0
DA:5,1
LF:6
LH:2
end_of_record


Expected results:

If you comment out the env_chain.append(eval_obj) line, then you get the correct output. Also, if you keep the extra env chain object but switch out the compile/execute for a single JS::Evaluate call, you get the correct output.

This is the correct output:

TN:Compartment_5f7fcb2b009800
SF:cov.js
FN:1,top-level
FNDA:1,top-level
FNF:1
FNH:1
BRDA:2,0,0,1
BRDA:2,0,1,-
BRF:2
BRH:1
DA:2,1
DA:3,0
DA:5,1
LF:3
LH:2
end_of_record

Comment 1

[Nicolas B. Pierron [:nbp]]

Thanks for the test case.
Either me or Marco might be the right person to investigate this issue.

Comment 2

[Philip Chimento [:ptomato]]

This still happens on ESR60, although the `SF:` and `DA:` lines are not duplicated anymore, probably because of the change I made a while ago which changed the line coverage to use a per-source-file hashmap.

Comment 3

[Philip Chimento [:ptomato]]

Attachment: Minimal reproducer (updated for ESR68)

Updated the example for ESR68. The actual and expected output has changed a bit as well.

Actual:

TN:Realm_5fd15590
SF:cov.js
FN:1,top-level
FN:1,top-level
FNDA:1,top-level
FNF:2
FNH:1
BRDA:2,0,0,1
BRDA:2,0,1,0
BRDA:2,0,0,-
BRDA:2,0,1,-
BRF:4
BRH:1
DA:1,1
DA:2,1
DA:3,0
DA:5,1
LF:4
LH:3
end_of_record

Expected:

TN:Realm_5f1cd9590
SF:cov.js
FN:1,top-level
FNDA:1,top-level
FNF:1
FNH:1
BRDA:2,0,0,1
BRDA:2,0,1,0
BRF:2
BRH:1
DA:1,1
DA:2,1
DA:3,0
DA:5,1
LF:4
LH:3
end_of_record

Note that coverage is also output for the debugger and self-hosted compartments (which I've omitted), not only for the debuggee. Not sure if that is an intended change or not.

Comment 4

[Philip Chimento [:ptomato]]

Attachment: Minimal reproducer (updated for ESR78)

Comment 5

[Philip Chimento [:ptomato]]

I can no longer reproduce this bug in ESR91, it seems to have been fixed. Thanks to whoever did it!