deps: V8: cherry-pick dfcdf7837e23

Original commit message:

    [coverage] fix greedy nullish coalescing

    The SourceRangeScope helper was consuming too many characters, instead
    explicitly create SourceRange, based on scanner position.

    Bug: v8:11231
    Change-Id: I852d211227abacf867e8f1ab3e3ab06dbdba2a9b
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2576006
    Reviewed-by: Toon Verwaest <verwaest@chromium.org>
    Commit-Queue: Toon Verwaest <verwaest@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#71765}

Refs: https://github.com/v8/v8/commit/dfcdf7837e23cc0da31f9b2d4211f856413d13af

PR-URL: https://github.com/nodejs/node/pull/36573
Fixes: https://github.com/nodejs/node/issues/36619
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>

common.gypi

@@ -36,7 +36,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.21',
+    'v8_embedder_string': '-node.22',
 
     ##### V8 defaults for Node.js #####
 

deps/v8/src/parsing/parser-base.h

@@ -2989,12 +2989,15 @@ ParserBase<Impl>::ParseCoalesceExpression(ExpressionT expression) {
   bool first_nullish = true;
   while (peek() == Token::NULLISH) {
     SourceRange right_range;
-    SourceRangeScope right_range_scope(scanner(), &right_range);
-    Consume(Token::NULLISH);
-    int pos = peek_position();
-
-    // Parse BitwiseOR or higher.
-    ExpressionT y = ParseBinaryExpression(6);
+    int pos;
+    ExpressionT y;
+    {
+      SourceRangeScope right_range_scope(scanner(), &right_range);
+      Consume(Token::NULLISH);
+      pos = peek_position();
+      // Parse BitwiseOR or higher.
+      y = ParseBinaryExpression(6);
+    }
     if (first_nullish) {
       expression =
           factory()->NewBinaryOperation(Token::NULLISH, expression, y, pos);

deps/v8/test/mjsunit/code-coverage-block.js

@@ -1177,4 +1177,22 @@ a(true);                                  // 0500
  {"start":0,"end":401,"count":2},
  {"start":154,"end":254,"count":0}]);
 
+ TestCoverage(
+"https://crbug.com/v8/11231 - nullish coalescing",
+`
+const a = true                            // 0000
+const b = false                           // 0050
+const c = undefined                       // 0100
+const d = a ?? 99                         // 0150
+const e = 33                              // 0200
+const f = b ?? (c ?? 99)                  // 0250
+const g = 33                              // 0300
+const h = c ?? (c ?? 'hello')             // 0350
+const i = c ?? b ?? 'hello'               // 0400
+`,
+[{"start":0,"end":449,"count":1},
+ {"start":162,"end":167,"count":0},
+ {"start":262,"end":274,"count":0},
+ {"start":417,"end":427,"count":0}]);
+
 %DebugToggleBlockCoverage(false);