[coverage] fix greedy nullish coalescing

The SourceRangeScope helper was consuming too many characters, instead
explicitly create SourceRange, based on scanner position.

Bug: v8:11231
Change-Id: I852d211227abacf867e8f1ab3e3ab06dbdba2a9b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2576006Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71765}

src/parsing/parser-base.h

@@ -2980,12 +2980,15 @@ ParserBase<Impl>::ParseCoalesceExpression(ExpressionT expression) {
   bool first_nullish = true;
   while (peek() == Token::NULLISH) {
     SourceRange right_range;
-    SourceRangeScope right_range_scope(scanner(), &right_range);
-    Consume(Token::NULLISH);
-    int pos = peek_position();
-
-    // Parse BitwiseOR or higher.
-    ExpressionT y = ParseBinaryExpression(6);
+    int pos;
+    ExpressionT y;
+    {
+      SourceRangeScope right_range_scope(scanner(), &right_range);
+      Consume(Token::NULLISH);
+      pos = peek_position();
+      // Parse BitwiseOR or higher.
+      y = ParseBinaryExpression(6);
+    }
     if (first_nullish) {
       expression =
           factory()->NewBinaryOperation(Token::NULLISH, expression, y, pos);

test/mjsunit/code-coverage-block.js

@@ -1177,4 +1177,22 @@ a(true);                                  // 0500
  {"start":0,"end":401,"count":2},
  {"start":154,"end":254,"count":0}]);
 
+ TestCoverage(
+"https://crbug.com/v8/11231 - nullish coalescing",
+`
+const a = true                            // 0000
+const b = false                           // 0050
+const c = undefined                       // 0100
+const d = a ?? 99                         // 0150
+const e = 33                              // 0200
+const f = b ?? (c ?? 99)                  // 0250
+const g = 33                              // 0300
+const h = c ?? (c ?? 'hello')             // 0350
+const i = c ?? b ?? 'hello'               // 0400
+`,
+[{"start":0,"end":449,"count":1},
+ {"start":162,"end":167,"count":0},
+ {"start":262,"end":274,"count":0},
+ {"start":417,"end":427,"count":0}]);
+
 %DebugToggleBlockCoverage(false);