[demangler] Reorder parseNestedName loop

[urnathan]

Summary

parseNestedName's main loop allowed parsing a grammar that was more flexible than the actual grammar. This refactors that to rule out some more incorrect manglings.

1. The 'L' extension only applies to unqualified-name components, so check it just there.

2. The 'M' suffix is, AFAICT, removed from the grammar. Rather than eliminate it, let's parse it after we've parsed a component.

Added some additional bad mangling tests, which are now rejected.

I don't break the 'T' and 'D[tT]' cases out of the loop, even though they can only appear at first position, as it seems simpler to just check there is nothing SoFar.

[ChuanqiXu]

Given the background knowledge in the summary is correct, I've checked the implementation is consistent with the description in the summary.

libcxxabi/src/demangle/ItaniumDemangle.h

AbstractManglingParser<Derived, Alloc>::parseNestedName(NameState *State) {
   } else if (consumeIf('R')) {
     if (State) State->ReferenceQualifier = FrefQualLValue;
   } else {
     if (State) State->ReferenceQualifier = FrefQualNone;
   }
 
   Node *SoFar = nullptr;
   while (!consumeIf('E')) {
-    consumeIf('L'); // extension
-
-    if (consumeIf('M')) {
-      // <data-member-prefix> := <member source-name> [<template-args>] M
-      if (SoFar == nullptr)
-        return nullptr;
-      continue;
-    }
-
     if (State)
       // Only set end-with-template on the case that does that.
       State->EndsWithTemplateArgs = false;
 
     if (look() == 'T') {
       //          ::= <template-param>
       if (SoFar != nullptr)
         return nullptr; // Cannot have a prefix.
if (look() == 'T') {
         SoFar = make<NameType>("std");
       } else {
         SoFar = getDerived().parseSubstitution();
       }
       if (SoFar == nullptr)
         return nullptr;
       continue; // Do not push a new substitution.
     } else {
+      consumeIf('L'); // extension
       //          ::= [<prefix>] <unqualified-name>
       SoFar = getDerived().parseUnqualifiedName(State, SoFar);
     }
     if (SoFar == nullptr)
       return nullptr;
     Subs.push_back(SoFar);
+
+    // No longer used.
+    // <data-member-prefix> := <member source-name> [<template-args>] M
+    consumeIf('M');
   }
 
   if (SoFar == nullptr || Subs.empty())
     return nullptr;
 
   Subs.pop_back();
   return SoFar;
 }

libcxxabi/test/test_demangle.pass.cpp

// The following test cases were found by libFuzzer+ASAN
     "FSiIJEENT_IoE ",
     "ZTVSiIZTVSiIZTVSiIZTVSiINIJEET_T_T_T_T_ ",
     "Ana_T_E_T_IJEffffffffffffffersfffffrsrsffffffbgE",
 
     "_ZN3TPLS_E",
     "_ZN3CLSIiEIiEE",
     "_ZN3CLSDtLi0EEE",
     "_ZN3CLSIiEEvNS_T_Ev",
+
+    "_ZN1fIiEEvNTUt_E",
+    "_ZNDTUt_Ev",
 };
 
 const unsigned NI = sizeof(invalid_cases) / sizeof(invalid_cases[0]);
 
 void test()
 {
     std::size_t len = 0;
     char* buf = nullptr;

llvm/include/llvm/Demangle/ItaniumDemangle.h

AbstractManglingParser<Derived, Alloc>::parseNestedName(NameState *State) {
   } else if (consumeIf('R')) {
     if (State) State->ReferenceQualifier = FrefQualLValue;
   } else {
     if (State) State->ReferenceQualifier = FrefQualNone;
   }
 
   Node *SoFar = nullptr;
   while (!consumeIf('E')) {
-    consumeIf('L'); // extension
-
-    if (consumeIf('M')) {
-      // <data-member-prefix> := <member source-name> [<template-args>] M
-      if (SoFar == nullptr)
-        return nullptr;
-      continue;
-    }
-
     if (State)
       // Only set end-with-template on the case that does that.
       State->EndsWithTemplateArgs = false;
 
     if (look() == 'T') {
       //          ::= <template-param>
       if (SoFar != nullptr)
         return nullptr; // Cannot have a prefix.
if (look() == 'T') {
         SoFar = make<NameType>("std");
       } else {
         SoFar = getDerived().parseSubstitution();
       }
       if (SoFar == nullptr)
         return nullptr;
       continue; // Do not push a new substitution.
     } else {
+      consumeIf('L'); // extension
       //          ::= [<prefix>] <unqualified-name>
       SoFar = getDerived().parseUnqualifiedName(State, SoFar);
     }
     if (SoFar == nullptr)
       return nullptr;
     Subs.push_back(SoFar);
+
+    // No longer used.
+    // <data-member-prefix> := <member source-name> [<template-args>] M
+    consumeIf('M');
   }
 
   if (SoFar == nullptr || Subs.empty())
     return nullptr;
 
   Subs.pop_back();
   return SoFar;
 }