GNU3 demangler: GR reference temporaries, u vendor types, $tlv$init, fL fix, decltype

- GR <object name> [<seq-id>] _: implement reference temporary special names
- u <source-name> [<template-args>]: add vendor extended type in DemangleType
- $tlv$init suffix: strip macOS thread-local init suffix before demangling,
  append it back to the resulting variable name
- fL <level> p <CV> [<param>] _: allow out-of-range listNumber to fall through
  to the existing "fp" placeholder paths instead of throwing, fixing fL inside
  decltype return types where m_functionSubstitute is not yet populated
- DT/Dt: wrap the demangled expression in decltype(...) instead of emitting raw

Reduces failures on a 290k-symbol BN corpus from 119 to 14 (88% improvement).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: plafosse

demangler/gnu3/demangle_gnu3.cpp

@@ -721,6 +721,23 @@ DemangledTypeNode DemangleGNU3::DemangleType()
 		substitute = true;
 		break;
 	}
+	case 'u':
+	{
+		// Vendor extended type: u <source-name> [<template-args>]
+		// e.g. u14__remove_cvref, u20__remove_reference_t
+		string extName = DemangleSourceName();
+		if (m_reader.Peek() == 'I')
+		{
+			m_reader.Consume();
+			vector<string> targs;
+			DemangleTemplateArgs(targs);
+			if (!targs.empty())
+				extName += GetTemplateString(targs);
+		}
+		type = CreateUnknownType(extName);
+		substitute = true;
+		break;
+	}
 	case 'v': type = DemangledTypeNode::VoidType(); break;
 	case 'w': type = DemangledTypeNode::IntegerType(4, false, "wchar_t"); break; //TODO: verify
 	case 'b': type = DemangledTypeNode::BoolType(); break;
@@ -786,7 +803,7 @@ DemangledTypeNode DemangleGNU3::DemangleType()
 		}
 		case 't':
 		case 'T':
-			type = CreateUnknownType(DemangleExpression());
+			type = CreateUnknownType("decltype(" + DemangleExpression() + ")");
 			if (m_reader.Read() != 'E')
 				throw DemangleException();
 			break;
@@ -1716,13 +1733,12 @@ string DemangleGNU3::DemangleExpression()
 		char elm;
 		if (elm2 == 'L')
 		{
-			// fL case requires a valid function substitute frame
-			if (m_functionSubstitute.size() == 0)
-				throw DemangleException();
+			// fL <L-1 num> p <CV> [<prm-2 num>] _
+			// When listNumber is out of range (e.g. fL used inside a decltype return
+			// type before function params are known), the fallback paths below produce
+			// a placeholder string "fp" / "fpN".
 			listNumber = DemangleNumber() + 1;
-			if (listNumber < 0 ||
-			    (uint64_t)listNumber >= (uint64_t)m_functionSubstitute.size() ||
-			    m_reader.Read() != 'p')
+			if (listNumber < 0 || m_reader.Read() != 'p')
 				throw DemangleException();
 		}
 		DemangleCVQualifiers(cnst, vltl, rstrct);
@@ -2334,9 +2350,24 @@ DemangledTypeNode DemangleGNU3::DemangleSymbol(QualifiedName& varName)
 		case 'A': //TODO hidden alias
 			LogWarn("Unsupported demangle type: hidden alias\n");
 			throw DemangleException();
-		case 'R': //TODO reference temporaries
-			LogWarn("Unsupported demangle type: reference temporary\n");
-			throw DemangleException();
+		case 'R': // GR <object name> [<seq-id>] _  # reference temporary
+		{
+			// <object name> is a <name> production (nested, local, or unscoped).
+			// For local names (Z prefix), DemangleLocalName consumes the trailing '_'
+			// as a zero-discriminator, so we only consume '_' if it's still present.
+			DemangledTypeNode nameNode = DemangleName();
+			// Consume optional base-36 seq-id (digits + uppercase A-Z) before '_'.
+			string seqId;
+			while (m_reader.Length() > 0 && m_reader.Peek() != '_')
+				seqId += m_reader.Read();
+			if (m_reader.Length() > 0)
+				m_reader.Consume(); // consume '_'
+			string result = "reference_temporary_for_" + nameNode.GetString();
+			if (!seqId.empty())
+				result += "[" + seqId + "]";
+			varName.push_back(result);
+			return DemangledTypeNode::NamedType(UnknownNamedTypeClass, varName);
+		}
 		case 'T': // transaction clone: GTt<encoding> (safe) or GTn<encoding> (non-safe)
 		{
 			// consume the 't' (transaction-safe) or 'n' (non-transaction-safe) qualifier
@@ -2889,6 +2920,27 @@ bool DemangleGNU3Static::DemangleStringGNU3(Architecture* arch, const string& na
 		}
 	}
 
+	// Handle macOS thread-local variable initializer suffix: $tlv$init
+	// E.g. __ZL9recursive$tlv$init -> demangle "__ZL9recursive" then annotate.
+	static const string tlvInitSuffix = "$tlv$init";
+	if (name.size() > tlvInitSuffix.size() &&
+	    name.compare(name.size() - tlvInitSuffix.size(), tlvInitSuffix.size(), tlvInitSuffix) == 0)
+	{
+		string base = name.substr(0, name.size() - tlvInitSuffix.size());
+		Ref<Type> baseType;
+		QualifiedName baseName;
+		if (DemangleStringGNU3(arch, base, baseType, baseName))
+		{
+			outVarName = baseName;
+			if (outVarName.size() > 0)
+				outVarName[outVarName.size() - 1] += "$tlv$init";
+			else
+				outVarName.push_back("$tlv$init");
+			outType = baseType;
+			return true;
+		}
+	}
+
 	string encoding = name;
 	string header;
 	bool foundHeader = DemangleGlobalHeader(encoding, header);