From ec1eebf585c6ba32aa6bf931a79fc76b8acb32f8 Mon Sep 17 00:00:00 2001
From: Simon Martin <simartin@users.sourceforge.net>
Date: Sat, 21 Mar 2015 16:30:00 +0100
Subject: [PATCH] Ticket #6587: Never consider a template parameter's default
 value as an instantiation.

---
 lib/token.cpp                 |  2 +-
 test/testsimplifytemplate.cpp | 14 ++++++++++++--
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/lib/token.cpp b/lib/token.cpp
index a7e96c90e..be0d20cf6 100644
--- a/lib/token.cpp
+++ b/lib/token.cpp
@@ -812,7 +812,7 @@ const Token * Token::findClosingBracket() const
         for (closing = this; closing != nullptr; closing = closing->next()) {
             if (Token::Match(closing, "{|[|("))
                 closing = closing->link();
-            else if (Token::Match(closing, "}|]|)|;|="))
+            else if (Token::Match(closing, "}|]|)|;"))
                 break;
             else if (closing->str() == "<")
                 ++depth;
diff --git a/test/testsimplifytemplate.cpp b/test/testsimplifytemplate.cpp
index 1a9aa731d..41c5a04af 100644
--- a/test/testsimplifytemplate.cpp
+++ b/test/testsimplifytemplate.cpp
@@ -84,6 +84,7 @@ private:
         TEST_CASE(template51);  // #6172 - crash upon valid code
         TEST_CASE(template52);  // #6437 - crash upon valid code
         TEST_CASE(template53);  // #4335 - bail out for valid code
+        TEST_CASE(template54);  // #6587 - memory corruption upon valid code
         TEST_CASE(template_unhandled);
         TEST_CASE(template_default_parameter);
         TEST_CASE(template_default_type);
@@ -951,6 +952,15 @@ private:
         ASSERT_EQUALS("", errout.str());
     }
 
+    void template54() { // #6587
+        tok("template<typename _Tp> _Tp* fn(); "
+            "template <class T> struct A { "
+            "  template <class U, class S = decltype(fn<T>())> "
+            "  struct B { }; "
+            "}; "
+            "A<int> a;");
+    }
+
     void template_default_parameter() {
         {
             const char code[] = "template <class T, int n=3>\n"
@@ -1036,8 +1046,8 @@ private:
                                 "template<class T1 = A, typename T2 = B<A>> class D { };";
             ASSERT_EQUALS("class A { } ; "
                           "template < class T > class B { } ; "
-                          "template < class T1 , class T2 > class C { } ; "
-                          "template < class T1 , typename T2 > class D { } ;", tok(code));
+                          "template < class T1 , class T2 = B < T1 > > class C { } ; "
+                          "template < class T1 = A , typename T2 = B < A > > class D { } ;", tok(code));
         }
     }