fix(callgrind-utils): parse sparse and instr-line cost lines

The cost-line parser required exactly `num_positions + num_events` tokens, but
real Callgrind output uses `positions: instr line` (two position columns) and
omits trailing zero event counts, so cost lines are variable-length. Every real
cost line was therefore rejected, leaving all self costs at zero and the
flamegraph empty for actual profiles (rust/cpp/node samples all folded to 0).

Read the first event (Ir) at token index `num_positions`, accepting 1..=num_events
trailing counts, and validate the leading tokens as Callgrind position tokens
(`*`, `0x..`, absolute, or `+N`/`-N`) to keep rejecting colon headers.

Author: not-matthias

callgrind-utils/src/parser.rs

@@ -265,18 +265,34 @@ fn header_token_count(trimmed: &str, key: &str) -> usize {
 
 /// First event value of a cost line, or `None` if `trimmed` is not one.
 ///
-/// A cost line has exactly `num_positions + num_events` whitespace-separated
-/// tokens; the position tokens (line/instr, possibly `+N`/`-N`/`*`/`0x..`) are
-/// ignored and the first event column (token index `num_positions`) is parsed
-/// as a decimal count. The strict token-count + decimal-parse check rejects
-/// colon headers and bare tokens that also lack an `=`.
+/// A cost line is `num_positions` position tokens followed by 1..=`num_events`
+/// event counts; Callgrind omits trailing zero counts, so the value list is
+/// variable-length. The first event column (`Ir`, token index `num_positions`)
+/// is returned. Requiring the leading tokens to be position-like (line/instr,
+/// possibly `+N`/`-N`/`*`/`0x..`) plus a decimal first value rejects colon
+/// headers and bare tokens that also lack an `=`.
 fn parse_cost_value(trimmed: &str, num_positions: usize, num_events: usize) -> Option<u64> {
-    let mut tokens = trimmed.split_whitespace();
-    let count = trimmed.split_whitespace().count();
-    if count != num_positions + num_events {
+    let tokens: Vec<&str> = trimmed.split_whitespace().collect();
+    if tokens.len() <= num_positions || tokens.len() > num_positions + num_events {
         return None;
     }
-    tokens.nth(num_positions)?.parse::<u64>().ok()
+    if !tokens[..num_positions].iter().all(|t| is_position_token(t)) {
+        return None;
+    }
+    tokens[num_positions].parse::<u64>().ok()
+}
+
+/// Whether `tok` is a Callgrind position/subposition token: `*` (repeat), an
+/// absolute decimal or `0x` address, or a `+N`/`-N` relative offset.
+fn is_position_token(tok: &str) -> bool {
+    if tok == "*" {
+        return true;
+    }
+    if let Some(hex) = tok.strip_prefix("0x").or_else(|| tok.strip_prefix("0X")) {
+        return !hex.is_empty() && hex.bytes().all(|b| b.is_ascii_hexdigit());
+    }
+    let digits = tok.strip_prefix(['+', '-']).unwrap_or(tok);
+    !digits.is_empty() && digits.bytes().all(|b| b.is_ascii_digit())
 }
 
 /// The leading token of `line`: everything up to the first `=`, `:`, or

callgrind-utils/tests/flamegraph.rs

@@ -145,6 +145,33 @@ fn heavy_frame_behind_zero_cost_edge_survives() {
     assert_eq!(total, 105, "entry(5) + hot(100)");
 }
 
+/// Real Callgrind uses `positions: instr line` (two position columns) and omits
+/// trailing zero event counts, so cost lines are variable-length. The parser
+/// must read the first event (`Ir`) at token index `num_positions` regardless
+/// of how many trailing counts are present, for both self and inclusive costs.
+const SPARSE: &str = "\
+positions: instr line
+events: Ir Dr Dw
+fn=main
+0x1000 10 7
++4 11 3 0
+cfn=leaf
+calls=1 0 0
+0x2000 12 20
+fn=leaf
+0x3000 20 20 0 0
+";
+
+#[test]
+fn parses_sparse_instr_line_cost_lines() {
+    let g = parse(SPARSE);
+    assert_eq!(
+        folded_sorted(&g),
+        vec!["main 10".to_string(), "main;leaf 20".to_string()],
+        "self=7+3 for main, inclusive/self=20 for leaf"
+    );
+}
+
 #[test]
 fn no_cost_data_is_an_error() {
     // Topology only, no cost columns beyond position -> every cost is zero.