[coverage] Handle deleted coverage infos

It can happen that coverage infos for a function containing
IncBlockCounter bytecodes can be deleted (e.g. by switching to
best-effort coverage). Handle this case correctly in the IncBlockCounter
runtime function.

BUG=v8:6000

Change-Id: I49b9f52822661150d55410d6b173b3929adf4af2
Reviewed-on: https://chromium-review.googlesource.com/558039
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46351}

src/debug/debug-coverage.cc

@@ -324,6 +324,10 @@ Coverage* Coverage::Collect(Isolate* isolate,
 void Coverage::SelectMode(Isolate* isolate, debug::Coverage::Mode mode) {
   switch (mode) {
     case debug::Coverage::kBestEffort:
+      // Note that DevTools switches back to best-effort coverage once the
+      // recording is stopped. Since we delete coverage infos at that point, any
+      // following coverage recording (without reloads) will be at function
+      // granularity.
       if (FLAG_block_coverage) isolate->debug()->RemoveAllCoverageInfos();
       isolate->SetCodeCoverageList(isolate->heap()->undefined_value());
       break;

src/objects.cc

@@ -13144,6 +13144,11 @@ bool SharedFunctionInfo::HasCoverageInfo() const {
   return has_coverage_info;
 }
 
+CoverageInfo* SharedFunctionInfo::GetCoverageInfo() const {
+  DCHECK(HasCoverageInfo());
+  return CoverageInfo::cast(GetDebugInfo()->coverage_info());
+}
+
 DebugInfo* SharedFunctionInfo::GetDebugInfo() const {
   DCHECK(HasDebugInfo());
   return DebugInfo::cast(debug_info());

src/objects/shared-function-info.h

@@ -14,6 +14,9 @@
 namespace v8 {
 namespace internal {
 
+class CoverageInfo;
+class DebugInfo;
+
 class PreParsedScopeData : public Struct {
  public:
   DECL_ACCESSORS(scope_data, PodArray<uint32_t>)
@@ -198,6 +201,7 @@ class SharedFunctionInfo : public HeapObject {
   // Coverage infos are contained in DebugInfo, this is a convenience method
   // to simplify access.
   bool HasCoverageInfo() const;
+  CoverageInfo* GetCoverageInfo() const;
 
   // A function has debug code if the compiled code has debug break slots.
   inline bool HasDebugCode() const;

src/runtime/runtime-debug.cc

@@ -1992,9 +1992,16 @@ RUNTIME_FUNCTION(Runtime_IncBlockCounter) {
 
   DCHECK(FLAG_block_coverage);
 
-  DebugInfo* debug_info = function->shared()->GetDebugInfo();
-  CoverageInfo* coverage_info = CoverageInfo::cast(debug_info->coverage_info());
-  coverage_info->IncrementBlockCount(coverage_array_slot_index);
+  // It's quite possible that a function contains IncBlockCounter bytecodes, but
+  // no coverage info exists. This happens e.g. by selecting the best-effort
+  // coverage collection mode, which triggers deletion of all coverage infos in
+  // order to avoid memory leaks.
+
+  SharedFunctionInfo* shared = function->shared();
+  if (shared->HasCoverageInfo()) {
+    CoverageInfo* coverage_info = shared->GetCoverageInfo();
+    coverage_info->IncrementBlockCount(coverage_array_slot_index);
+  }
 
   return isolate->heap()->undefined_value();
 }