coverage: Avoid creating malformed macro name spans

This method is trying to detect macro invocations, so that it can split a span
into two parts just after the `!` of the invocation.

Under some circumstances (probably involving nested macros), it gets confused
and produces a span that is larger than the original span, and possibly extends
outside its enclosing function and even into an adjacent file.

In extreme cases, that can result in malformed coverage mappings that cause
`llvm-cov` to fail. For now, we at least want to detect these egregious cases
and avoid them, so that coverage reports can still be produced.

compiler/rustc_mir_transform/src/coverage/spans.rs

@@ -427,6 +427,12 @@ impl<'a, 'tcx> CoverageSpans<'a, 'tcx> {
                 let merged_prefix_len = self.curr_original_span.lo() - self.curr().span.lo();
                 let after_macro_bang =
                     merged_prefix_len + BytePos(visible_macro.as_str().len() as u32 + 1);
+                if self.curr().span.lo() + after_macro_bang > self.curr().span.hi() {
+                    // Something is wrong with the macro name span;
+                    // return now to avoid emitting malformed mappings.
+                    // FIXME(#117788): Track down why this happens.
+                    return;
+                }
                 let mut macro_name_cov = self.curr().clone();
                 self.curr_mut().span =
                     self.curr().span.with_lo(self.curr().span.lo() + after_macro_bang);