fix(callgrind): seed shadow call stack from native stack at START

When CALLGRIND_START_INSTRUMENTATION fires mid-stack (typical for
pytest-codspeed: Python reaches the macro several libpython frames
deep), callgrind's csp is 0 but the real stack is non-empty. Every
subsequent client `ret` peels a frame callgrind never saw the matching
`call` for, trips handleUnderflow, and leaks the returned-into fn as a
top-level fn= block — polluting the flamegraph with phantom roots like
_PyEval_EvalFrameDefault, PyObject_Vectorcall, etc.

Reconstruct the shadow stack from VG_(get_StackTrace) on the OFF->ON
transition. For each native frame: push a (jcc=0, skip-style)
call_entry with the captured SP and ret_addr=caller_ip+1. For
non-skipped caller frames, synthesize a zero-instruction BBCC tagged
with that frame's cxt so obj-skip's `nonskipped` mechanism has a
target to fold skipped-subtree costs into.

Anonymous IPs (Python JIT regions, CRT glue) resolve via the existing
`???` obj path in get_obj_node, so no special trimming is needed.

Un-static new_recursion and insert_bbcc_into_hash (renamed to
CLG_-prefixed) so callstack.c can reuse them.

Author: not-matthias

callgrind/bbcc.c

@@ -85,7 +85,7 @@ void CLG_(zero_bbcc)(BBCC* bbcc)
 
   CLG_ASSERT(bbcc->cxt != 0);
   CLG_DEBUG(1, "  zero_bbcc: BB %#lx, Cxt %u "
-	   "(fn '%s', rec %u)\n", 
+	   "(fn '%s', rec %u)\n",
 	   bb_addr(bbcc->bb),
 	   bbcc->cxt->base_number + bbcc->rec_index,
 	   bbcc->cxt->fn[0]->name,
@@ -113,7 +113,7 @@ void CLG_(forall_bbccs)(void (*func)(BBCC*))
 {
   BBCC *bbcc, *bbcc2;
   int i, j;
-	
+
   for (i = 0; i < current_bbccs.size; i++) {
     if ((bbcc=current_bbccs.table[i]) == NULL) continue;
     while (bbcc) {
@@ -149,10 +149,10 @@ UInt bbcc_hash_idx(BB* bb, Context* cxt, UInt size)
 
    return ((Addr)bb + (Addr)cxt) % size;
 }
- 
+
 
 /* Lookup for a BBCC in hash.
- */ 
+ */
 static
 BBCC* lookup_bbcc(BB* bb, Context* cxt)
 {
@@ -177,9 +177,9 @@ BBCC* lookup_bbcc(BB* bb, Context* cxt)
 	   cxt     != bbcc->cxt)) {
        bbcc = bbcc->next;
    }
-   
+
    CLG_DEBUG(2,"  lookup_bbcc(BB %#lx, Cxt %u, fn '%s'): %p (tid %u)\n",
-	    bb_addr(bb), cxt->base_number, cxt->fn[0]->name, 
+	    bb_addr(bb), cxt->base_number, cxt->fn[0]->name,
 	    bbcc, bbcc ? bbcc->tid : 0);
 
    CLG_DEBUGIF(2)
@@ -200,13 +200,13 @@ static void resize_bbcc_hash(void)
     new_size = 2*current_bbccs.size+3;
     new_table = (BBCC**) CLG_MALLOC("cl.bbcc.rbh.1",
                                     new_size * sizeof(BBCC*));
- 
+
     for (i = 0; i < new_size; i++)
       new_table[i] = NULL;
- 
+
     for (i = 0; i < current_bbccs.size; i++) {
 	if (current_bbccs.table[i] == NULL) continue;
- 
+
 	curr_BBCC = current_bbccs.table[i];
 	while (NULL != curr_BBCC) {
 	    next_BBCC = curr_BBCC->next;
@@ -254,15 +254,15 @@ BBCC** new_recursion(int size)
 
     return bbccs;
 }
-  
+
 
 /*
  * Allocate a new BBCC
  *
  * Uninitialized:
  * cxt, rec_index, rec_array, next_bbcc, next1, next2
  */
-static __inline__ 
+static __inline__
 BBCC* new_bbcc(BB* bb)
 {
    BBCC* bbcc;
@@ -292,7 +292,7 @@ BBCC* new_bbcc(BB* bb)
    bbcc->lru_next_bbcc = 0;
    bbcc->lru_from_jcc  = 0;
    bbcc->lru_to_jcc  = 0;
-   
+
    CLG_(stat).distinct_bbccs++;
 
    CLG_DEBUG(3, "  new_bbcc(BB %#lx): %p (now %d)\n",
@@ -317,7 +317,7 @@ static
 void insert_bbcc_into_hash(BBCC* bbcc)
 {
     UInt idx;
-    
+
     CLG_ASSERT(bbcc->cxt != 0);
 
     CLG_DEBUG(3,"+ insert_bbcc_into_hash(BB %#lx, fn '%s')\n",
@@ -389,10 +389,10 @@ static BBCC* clone_bbcc(BBCC* orig, Context* cxt, Int rec_index)
 
       bbcc->rec_index = 0;
       bbcc->cxt = cxt;
-      bbcc->rec_array = new_recursion(cxt->fn[0]->separate_recursions);
+      bbcc->rec_array = CLG_(new_recursion)(cxt->fn[0]->separate_recursions);
       bbcc->rec_array[0] = bbcc;
 
-      insert_bbcc_into_hash(bbcc);
+      CLG_(insert_bbcc_into_hash)(bbcc);
     }
     else {
       if (CLG_(clo).separate_threads)
@@ -430,7 +430,7 @@ static BBCC* clone_bbcc(BBCC* orig, Context* cxt, Int rec_index)
     CLG_FREE(mangled_bbcc);
 
     CLG_(stat).bbcc_clones++;
- 
+
     return bbcc;
 };
 
@@ -440,7 +440,7 @@ static BBCC* clone_bbcc(BBCC* orig, Context* cxt, Int rec_index)
  * address. If created, the BBCC is inserted into the BBCC hash.
  * Also sets BB_seen_before by reference.
  *
- */ 
+ */
 BBCC* CLG_(get_bbcc)(BB* bb)
 {
    BBCC* bbcc;
@@ -508,7 +508,7 @@ static void handleUnderflow(BB* bb)
   }
   else if (CLG_(current_state).collect)
     source_bbcc->ecounter_sum++;
-  
+
   /* Force a new top context, will be set active by push_cxt() */
   CLG_(current_fn_stack).top--;
   CLG_(current_state).cxt = 0;
@@ -522,12 +522,12 @@ static void handleUnderflow(BB* bb)
 
   if (!seen_before) {
     /* set rec array for source BBCC: this is at rec level 1 */
-    source_bbcc->rec_array = new_recursion(caller->separate_recursions);
+    source_bbcc->rec_array = CLG_(new_recursion)(caller->separate_recursions);
     source_bbcc->rec_array[0] = source_bbcc;
 
     CLG_ASSERT(source_bbcc->cxt == 0);
     source_bbcc->cxt = CLG_(current_state).cxt;
-    insert_bbcc_into_hash(source_bbcc);
+    CLG_(insert_bbcc_into_hash)(source_bbcc);
   }
   CLG_ASSERT(CLG_(current_state).bbcc);
 
@@ -545,7 +545,7 @@ static void handleUnderflow(BB* bb)
   CLG_(push_cxt)( CLG_(current_state).bbcc->cxt->fn[0] );
   CLG_(push_call_stack)(source_bbcc, 0, CLG_(current_state).bbcc,
 		       (Addr)-1, False);
-  call_entry_up = 
+  call_entry_up =
     &(CLG_(current_call_stack).entry[CLG_(current_call_stack).sp -1]);
   /* assume this call is lasting since last dump or
    * for a signal handler since it's call */
@@ -611,7 +611,7 @@ void CLG_(setup_bbcc)(BB* bb)
 	  last_bbcc->ecounter_sum++;
 	  last_bbcc->jmp[passed].ecounter++;
 	  if (!CLG_(clo).simulate_cache) {
-	      /* update Ir cost */              
+	      /* update Ir cost */
               UInt instr_count = last_bb->jmp[passed].instr+1;
               CLG_(current_state).cost[ fullOffset(EG_IR) ] += instr_count;
 	  }
@@ -645,7 +645,7 @@ void CLG_(setup_bbcc)(BB* bb)
 
   /* A return not matching the top call in our callstack is a jump */
   if ( (jmpkind == jk_Return) && (csp >0)) {
-      Int csp_up = csp-1;      
+      Int csp_up = csp-1;
       call_entry* top_ce = &(CLG_(current_call_stack).entry[csp_up]);
 
       /* We have a real return if
@@ -666,7 +666,7 @@ void CLG_(setup_bbcc)(BB* bb)
 		  top_ce = &(CLG_(current_call_stack).entry[csp_up]);
 		  if (top_ce->sp == sp) {
 		      popcount_on_return++;
-		      continue; 
+		      continue;
 		  }
 	      }
 	      popcount_on_return = 0;
@@ -709,7 +709,7 @@ void CLG_(setup_bbcc)(BB* bb)
 	if (CLG_(get_fn_node)(last_bb)->pop_on_jump && (csp>0)) {
 
 	    call_entry* top_ce = &(CLG_(current_call_stack).entry[csp-1]);
-	    
+
 	    if (top_ce->jcc) {
 
 		CLG_DEBUG(1,"     Pop on Jump!\n");
@@ -784,16 +784,16 @@ void CLG_(setup_bbcc)(BB* bb)
   }
 
   /* Handle CALL/RET and update context to get correct BBCC */
-  
+
   if (jmpkind == jk_Return) {
-    
-    if ((csp == 0) || 
+
+    if ((csp == 0) ||
 	((CLG_(current_fn_stack).top > CLG_(current_fn_stack).bottom) &&
 	 ( *(CLG_(current_fn_stack).top-1)==0)) ) {
 
       /* On an empty call stack or at a signal separation marker,
        * a RETURN generates an call stack underflow.
-       */	
+       */
       handleUnderflow(bb);
       CLG_(pop_call_stack)();
     }
@@ -808,17 +808,17 @@ void CLG_(setup_bbcc)(BB* bb)
       /* if unwinding was done, this actually is a return */
       jmpkind = jk_Return;
     }
-    
+
     if (jmpkind == jk_Call) {
       delayed_push = True;
 
       csp = CLG_(current_call_stack).sp;
       if (call_emulation && csp>0)
-	sp = CLG_(current_call_stack).entry[csp-1].sp;	
+	sp = CLG_(current_call_stack).entry[csp-1].sp;
 
     }
   }
-  
+
   /* Change new context if needed, taking delayed_push into account.
    *
    * The `cxt == 0` clause used to fire regardless of skip, which meant
@@ -841,24 +841,24 @@ void CLG_(setup_bbcc)(BB* bb)
     CLG_(push_cxt)(push_fn);
   }
   CLG_ASSERT(CLG_(current_fn_stack).top > CLG_(current_fn_stack).bottom);
-  
+
   /* If there is a fresh instrumented BBCC, assign current context */
   bbcc = CLG_(get_bbcc)(bb);
   if (bbcc->cxt == 0) {
     CLG_ASSERT(bbcc->rec_array == 0);
-      
+
     bbcc->cxt = CLG_(current_state).cxt;
-    bbcc->rec_array = 
-      new_recursion((*CLG_(current_fn_stack).top)->separate_recursions);
+    bbcc->rec_array =
+      CLG_(new_recursion)((*CLG_(current_fn_stack).top)->separate_recursions);
     bbcc->rec_array[0] = bbcc;
-      
-    insert_bbcc_into_hash(bbcc);
+
+    CLG_(insert_bbcc_into_hash)(bbcc);
   }
   else {
     /* get BBCC with current context */
-    
+
     /* first check LRU of last bbcc executed */
-    
+
     if (last_bbcc) {
       bbcc = last_bbcc->lru_next_bbcc;
       if (bbcc &&
@@ -873,7 +873,7 @@ void CLG_(setup_bbcc)(BB* bb)
       bbcc = lookup_bbcc(bb, CLG_(current_state).cxt);
     if (!bbcc)
       bbcc = clone_bbcc(bb->bbcc_list, CLG_(current_state).cxt, 0);
-    
+
     bb->last_bbcc = bbcc;
   }
 
@@ -891,7 +891,7 @@ void CLG_(setup_bbcc)(BB* bb)
       if (CLG_(clo).skip_direct_recursion) {
         /* a call was detected, which means that the source BB != 0 */
 	CLG_ASSERT(CLG_(current_state).bbcc != 0);
-	/* only increment rec. level if called from different function */ 
+	/* only increment rec. level if called from different function */
 	if (CLG_(current_state).bbcc->cxt->fn[0] != bbcc->cxt->fn[0])
 	  level++;
       }
@@ -927,10 +927,10 @@ void CLG_(setup_bbcc)(BB* bb)
   }
 
   if (CLG_(clo).collect_jumps && (jmpkind == jk_Jump)) {
-    
+
     /* Handle conditional jumps followed, i.e. trace arcs
      * This uses JCC structures, too */
-    
+
     jCC* jcc = CLG_(get_jcc)(last_bbcc, passed, bbcc);
     CLG_ASSERT(jcc != 0);
     // Change from default, and check if already changed
@@ -940,14 +940,14 @@ void CLG_(setup_bbcc)(BB* bb)
 	// FIXME: Why can this fail?
 	// CLG_ASSERT(jcc->jmpkind == jmpkind);
     }
-    
+
     jcc->call_counter++;
     if (isConditionalJump)
       CLG_(stat).jcnd_counter++;
     else
       CLG_(stat).jump_counter++;
   }
-  
+
   CLG_(current_state).bbcc = bbcc;
   /* Even though this will be set in instrumented code directly before
    * side exits, it needs to be set to 0 here in case an exception
@@ -956,19 +956,19 @@ void CLG_(setup_bbcc)(BB* bb)
   // needed for log_* handlers called in this BB
   CLG_(bb_base)   = bb->obj->offset + bb->offset;
   CLG_(cost_base) = bbcc->cost;
-  
+
   CLG_DEBUGIF(1) {
     VG_(printf)("     ");
     CLG_(print_bbcc_fn)(bbcc);
     VG_(printf)("\n");
   }
-  
+
   CLG_DEBUG(3,"- setup_bbcc (BB %#lx): Cost %p (Len %u), Instrs %u (Len %u)\n",
-	   bb_addr(bb), bbcc->cost, bb->cost_count, 
+	   bb_addr(bb), bbcc->cost, bb->cost_count,
 	   bb->instr_count, bb->instr_len);
   CLG_DEBUGIF(3)
     CLG_(print_cxt)(-8, CLG_(current_state).cxt, bbcc->rec_index);
   CLG_DEBUG(3,"\n");
-  
+
   CLG_(stat).bb_executions++;
 }