From 4ceed51bfb3ed9c45e352342d550db3c0624f9b5 Mon Sep 17 00:00:00 2001
From: Frank Zingsheim <f.zingsheim@gmx.de>
Date: Fri, 1 May 2015 17:13:02 +0200
Subject: [PATCH] Fixed #6607 (Crash triggered by
 TemplateSimplifier::useDefaultArgumentValues)

---
 lib/templatesimplifier.cpp |  8 +++++++-
 test/testgarbage.cpp       | 10 ++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/lib/templatesimplifier.cpp b/lib/templatesimplifier.cpp
index beac3b3ea..a0c91242f 100644
--- a/lib/templatesimplifier.cpp
+++ b/lib/templatesimplifier.cpp
@@ -557,6 +557,8 @@ void TemplateSimplifier::useDefaultArgumentValues(const std::list<Token *> &temp
         for (Token *tok = *iter1; tok; tok = tok->next()) {
             if (Token::simpleMatch(tok, "template < >")) { // Ticket #5762: Skip specialization tokens
                 tok = tok->tokAt(2);
+                if (0 == templateParmDepth)
+                    break;
                 continue;
             }
 
@@ -638,7 +640,11 @@ void TemplateSimplifier::useDefaultArgumentValues(const std::list<Token *> &temp
             Token *tok2;
             int indentlevel = 0;
             for (tok2 = eqtok->next(); tok2; tok2 = tok2->next()) {
-                if (tok2->str() == "(")
+                if (Token::Match(tok2, ";|)|}|]")) { // bail out #6607
+                    tok2 = nullptr;
+                    break;
+                }
+                if (Token::Match(tok2, "(|{|["))
                     tok2 = tok2->link();
                 else if (Token::Match(tok2, "%type% <") && templateParameters(tok2->next())) {
                     std::list<Token*>::iterator ti = std::find(templateInstantiations->begin(),
diff --git a/test/testgarbage.cpp b/test/testgarbage.cpp
index 824672779..4fa6cdf0c 100644
--- a/test/testgarbage.cpp
+++ b/test/testgarbage.cpp
@@ -74,6 +74,7 @@ private:
         TEST_CASE(garbageCode33); // #6613
         TEST_CASE(garbageCode34); // #6626
         TEST_CASE(garbageCode35); // #2599, #2604
+        TEST_CASE(garbageCode36); // #6334
 
         TEST_CASE(garbageValueFlow);
         TEST_CASE(garbageSymbolDatabase);
@@ -543,6 +544,15 @@ private:
             "}\n"
         );
     }
+
+    void garbageCode36() { // #6334
+        checkCode("{ } < class template < > , { = } ; class... >\n"
+                  "struct Y { }\n"
+                  "class Types { }\n"
+                  "( X < int > \"uses template\" ) ( < ( ) \"uses ; \n"
+                  "( int int ::primary \"uses template\" ) int double \"uses )\n"
+                  "::primary , \"uses template\" ;\n");
+    }
 };
 
 REGISTER_TEST(TestGarbage)