Fixed #2549 (segmentation fault of cppcheck)

lib/tokenize.cpp

@@ -2780,8 +2780,21 @@ void Tokenizer::simplifyTemplates()
                 {
                     tok->insertToken(",");
                     tok = tok->next();
-                    tok->insertToken((*it)->strAt(1));
+                    const Token *from = (*it)->next();
+                    std::stack<Token *> links;
+                    while (from && (!links.empty() || (from->str() != "," && from->str() != ">")))
+                    {
+                        tok->insertToken(from->str());
                         tok = tok->next();
+                        if (Token::Match(tok, "(|["))
+                            links.push(tok);
+                        else if (!links.empty() && Token::Match(tok, ")|]"))
+                        {
+                            Token::createMutualLinks(links.top(), tok);
+                            links.pop();
+                        }
+                        from = from->next();
+                    }
                     ++it;
                 }
             }

test/testtokenize.cpp

@@ -264,6 +264,7 @@ private:
         TEST_CASE(removeattribute);
         TEST_CASE(cpp0xtemplate1);
         TEST_CASE(cpp0xtemplate2);
+        TEST_CASE(cpp0xtemplate3);
         TEST_CASE(cpp0xdefault);
 
         TEST_CASE(arraySize);
@@ -4634,6 +4635,18 @@ private:
                            "list < list < int >> ints ;", tokenizeAndStringify(code));
     }
 
+    void cpp0xtemplate3()
+    {
+        // #2549
+        const char *code = "template<class T, T t = (T)0>\n"
+                           "struct S\n"
+                           "{};\n"
+                           "S<int> s;\n";
+        TODO_ASSERT_EQUALS(";\n\n\nS < int , ( int ) 0 > s ;",   // wanted result
+                           ";\n\n\nS < int , ( T ) 0 > s ;",     // current result
+                           tokenizeAndStringify(code));
+    }
+
     void cpp0xdefault()
     {
         {