GNU3 demangler: fix sr substitutions, CI2 constructors, M prefix, Z guard disambiguation

  - sr unresolved-qualifier-level: remove incorrect PushType calls (expressions
    don't generate substitution candidates per the Itanium ABI); fix the trailing
    E to be conditional rather than unconditional to handle GCC's occasional omission
    when the last qualifier had template-args whose closing E served double duty

  - Add CI1/CI2 inheriting constructor support in DemangleUnqualifiedName; save
    and restore m_lastName around DemangleType() to prevent the inherited class
    type from clobbering the enclosing class name

  - Handle 'M' data-member-prefix in DemangleNestedName (closure/lambda inside
    a data member initializer; the M is consumed and the outer name is retained)

  - Improve guard variable vs Vector ABI disambiguation for z/Z suffixes by
    scanning all vparam chars ({v,l,u,R,L,s,digits}) and requiring a trailing
    underscore, preventing false positive vector matches on guard variables

Author: plafosse

demangler/gnu3/demangle_gnu3.cpp

@@ -1267,6 +1267,19 @@ DemangledTypeNode DemangleGNU3::DemangleUnqualifiedName()
 		outType = CreateUnknownType(m_lastName);
 		outType.SetNameType(ConstructorNameType);
 		break;
+	case hash('C','I'): // Inheriting constructor: CI1 <type> or CI2 <type>
+	{
+		char kind = m_reader.Read(); // '1' or '2'
+		if (kind != '1' && kind != '2')
+			throw DemangleException();
+		// Save m_lastName: parsing the inherited-class type will overwrite it
+		string savedLastName = m_lastName;
+		DemangleType();
+		m_lastName = savedLastName;
+		outType = CreateUnknownType(m_lastName);
+		outType.SetNameType(ConstructorNameType);
+		break;
+	}
 	case hash('D','0'): //Destructor
 	case hash('D','1'):
 	case hash('D','2'):
@@ -1804,33 +1817,25 @@ string DemangleGNU3::DemangleExpression()
 			//   - the template instantiation (name + args) as another candidate
 			// This mirrors how the compiler builds the substitution table during encoding.
 			bool hadTemplateArgs = false;
-			string accumulated; // full path built so far (for sub table entries)
 			do
 			{
 				hadTemplateArgs = false;
 				const string segName = DemangleSourceName();
-				accumulated += (accumulated.empty() ? segName : "::" + segName);
-				// Push the bare name as a substitution candidate (e.g. "QMetaTypeId2")
-				PushType(CreateUnknownType(accumulated));
 				out += segName;
 				if (m_reader.Peek() == 'I')
 				{
 					vector<string> args;
 					m_reader.Consume();
 					DemangleTemplateArgs(args); // consumes the trailing 'E'
-					const string tmplStr = GetTemplateString(args);
-					accumulated += tmplStr;
-					// Push the template instantiation (e.g. "QMetaTypeId2<T>") as a
-					// substitution candidate so that later SX_ refs resolve correctly.
-					PushType(CreateUnknownType(accumulated));
-					out += tmplStr;
+					out += GetTemplateString(args);
 					hadTemplateArgs = true;
 				}
 				out += "::";
 			}while (!hadTemplateArgs && m_reader.Peek() != 'E');
-			// Consume the qualifier-list 'E' only if it wasn't already consumed
-			// as the template-args terminator.
-			if (!hadTemplateArgs)
+			// Consume qualifier-list 'E' if present. GCC sometimes omits it when
+			// the last qualifier had template-args whose 'E' served double duty,
+			// so check rather than unconditionally consuming.
+			if (m_reader.Peek() == 'E')
 				m_reader.Consume();
 			out += DemangleBaseUnresolvedName().GetString();
 			return out;
@@ -1980,6 +1985,10 @@ DemangledTypeNode DemangleGNU3::DemangleNestedName(bool* allTypeTemplateArgs)
 		size_t startSize = m_templateSubstitute.size();
 		switch (m_reader.Read())
 		{
+		case 'M': // <data-member-prefix>: closure/lambda inside a data member initializer
+			// 'M' follows the member name and marks that subsequent components are
+			// scoped inside that data member. Just consume it; the name is already captured.
+			continue;
 		case 'S': //<substitution>
 			newType = DemangleSubstitution();
 			substitute = false;
@@ -2297,20 +2306,37 @@ DemangledTypeNode DemangleGNU3::DemangleSymbol(QualifiedName& varName)
 			                    peekChar == 'x' || peekChar == 'y' || peekChar == 'Y');
 			// 'z'/'Z' are ambiguous: also used as Z-local-name prefix in guard variables
 			// (e.g. _ZGVZN1A1BEvE1A = guard variable for A::B()::A).
-			// Disambiguate by verifying the Vector ABI pattern: <isa><mask(M|N)><vlen(digits)><vparam or _>.
+			// Disambiguate by verifying the full Vector ABI parameter pattern:
+			// <isa><mask(M|N)><vlen(digits)><vparams><'_'>  where vparams are only
+			// from {v, l, u, R, L, s, 0-9} and are immediately followed by '_'.
+			// A guard variable's inner symbol would have source-name chars (e.g. 'm', 'a', etc.)
+			// that don't appear in valid vparameter sequences.
 			if (!isVectorABI && (peekChar == 'z' || peekChar == 'Z'))
 			{
-				_STD_STRING ahead = m_reader.PeekString(8);
+				_STD_STRING ahead = m_reader.PeekString(32);
 				if (ahead.size() >= 3 && (ahead[1] == 'M' || ahead[1] == 'N'))
 				{
 					size_t pos = 2;
 					while (pos < ahead.size() && isdigit((unsigned char)ahead[pos]))
 						pos++;
-					if (pos > 2)
+					if (pos > 2) // had at least one vlen digit
 					{
-						char after = (pos < ahead.size()) ? ahead[pos] : '\0';
-						isVectorABI = (after == '_' || after == 'v' || after == 'l' ||
-						              after == 'u' || after == 'R' || after == 'L');
+						// Scan through vparameter chars; valid ones are v/l/u/R/L and
+						// optional stride digits/'s'. Anything else means guard variable.
+						bool allVparam = true;
+						while (pos < ahead.size() && ahead[pos] != '_')
+						{
+							char c = ahead[pos];
+							if (c == 'v' || c == 'l' || c == 'u' || c == 'R' ||
+							    c == 'L' || c == 's' || isdigit((unsigned char)c))
+								pos++;
+							else
+							{
+								allVparam = false;
+								break;
+							}
+						}
+						isVectorABI = allVparam && pos < ahead.size() && ahead[pos] == '_';
 					}
 				}
 			}