test: cover each printer from its own unit tests and fix what that found - #22903

Follows #22872 (tokenizer) and #22889 (parser): each printer's unit test now covers its printer code, and every bug that turned up is fixed with a test that fails without the fix.

Coverage of the printer code, from its own printer test

The CSS totals include #22906's replace/remove visitor edits, which the printer's own tests now read as well (a replaced node holding a replaced one included). The JavaScript printer started from 95.95% / 93.37% / 97.72%; its totals grew with the minifier work rebased in from main (#22892, #22897, #22909, #22914), whose new passes this PR does not set out to cover. The remaining points were reached by no test, by fuzzing ~5,000 node_modules files under 8 option sets and the test file's 2,500 sources under 66 random option sets, nor by a hand-built input; most are bounds guards and terser-ported defensive branches. They are left uncovered rather than hidden with istanbul ignore hints.

Tokenizer and parser coverage is unchanged (HTML parser now 2604/2604 — #22889's measure missed the insertion modes in modes.*, which this PR covers and fixes).

Bugs fixed

HTML (19): plaintext end tags; double-escaped script; <?pi> read like a comment; body content before head elements, noscript and whitespace; <html> in foreign content; template tbody/colgroup; caption before script; nested forms; fostered text merge; _printCloseIfOpened crash; skipChildren while printing; streamed walk after </form>; fragment printing; <a> adoption removing the wrong a below a marker; head noscript whitespace.

CSS (16): background-position with an empty layer; url() holding two strings; @supports parentheses; unreadable box longhands; escapeIdentifier control characters and a lone -; normalizeUrl code points; skipChildren crash; nesting lowered in a streamed block; color-mix with an empty argument and block-contents crashes; streamed layer gathers left unordered/duplicated selector lists; an empty @layer x{} stopped later joins; a value-less grid longhand merged into invalid grid-template; /* inside an unquoted url() read as a comment; inset:inherit no longer lowered for old targets (a regression from the box-longhand fix); a quoted url( "…") read as unquoted; a walk that prints nothing threw on the next comment after a visitor's stop() (a guard this PR had folded as dead).

JavaScript (13): nested IIFE run-in-place crash; RegExp("[") under unsafe crashed; folding built-ins that were patched through an alias, this or globalThis; global_defs on an exported binding crashed; RegExp.$1 under unsafe threw; ESTree { __proto__ } printed as a prototype set; spidermonkey directive values written raw; [,].join() crash; hoist_vars produced a duplicate let; a computed __proto__ key misread under unsafe; new RegExp(/a/g) lost its flags; a nested index source map whose next section starts past the outer one's stop lost its first source (terser's reader does the same); and, from #22897 on main, [1]['concat']([2]) printing [2] (the call guard compared the rewritten read with the one its parent calls).

Several of these are shared with terser; the fixes for those are under corrections.

Dead code

Branches proven unreachable were folded (scope loops, adoption agency and detach in HTML; join/gather/grid/box guards in CSS; ESTree token paths and impossible checks in JavaScript). CSS cross-run state was checked with a differential of ~45k runs and a new "one processor after another" test: nothing leaks between runs.

Notes

• Patched built-ins probe: it reads the global object as handed on only where it may be — a binding nothing reads, a literal's method and a module's functions leak none — which keeps swc's corpus as small as on main. One swc fixture (fixture/issues/8284) stays 10 bytes bigger: the global object goes through a function that returns it, so a value stays bound rather than move past a read of console; it is listed in swcSmaller.js.
• HTML fragments: only fragments whose context no body reads alike (foreign, select, raw text) have their print read back; checking every fragment doubled the cost of one in a tr (CodSpeed html-printer-unit). 80,000 fuzzed prints in 21 ordinary contexts never read back differently.
• Bun: JavaScriptCore rejects for(let;i;), which V8 reads, mis-evaluates new.target in a class's static code inside an arrow, words its errors differently, and its test workers have too small a stack for acorn's 2000-deep program, so the printer tests compare runtime output only where the engine agrees and leave that program out there.
• Not fixed here, same on main: under unsafe, var g = globalThis; g.Math.max = … and a write through a sloppy function's this.Math still let Math.max(1, 2) fold to 2.

🤖 Generated with Claude Code

https://claude.ai/code/session_017TkBWTk3wcyUcJYDp5ZhaP