I created a random mangled name generator and have thrown about 200 million random strings at the demangler. I succeeded in crashing it twice more and those crashers have been fixed and the test suite updated with the crash cases.

llvm-svn: 184562

2 files changed, 4 insertions, 4 deletions

diff --git a/libcxxabi/src/cxa_demangle.cpp b/libcxxabi/src/cxa_demangle.cpp
index f10f6a3a233..429b3c710c0 100644
--- a/libcxxabi/src/cxa_demangle.cpp
+++ b/libcxxabi/src/cxa_demangle.cpp
@@ -1022,8 +1022,6 @@ parse_base_unresolved_name(const char* first, const char* last, C& db)
                         db.names.back().first += std::move(args);
                     }
                 }
-                else
-                    first = t;
             }
             else
             {
@@ -2071,7 +2069,7 @@ parse_type(const char* first, const char* last, C& db)
                                 size_t k0 = db.names.size();
                                 t = parse_type(first+2, last, db);
                                 size_t k1 = db.names.size();
-                                if (t != first+1)
+                                if (t != first+2)
                                 {
                                     db.subs.emplace_back(db.names.get_allocator());
                                     for (size_t k = k0; k < k1; ++k)
@@ -3841,7 +3839,7 @@ parse_nested_name(const char* first, const char* last, C& db)
         }
         first = t0 + 1;
         db.cv = cv;
-        if (pop_subs)
+        if (pop_subs && !db.subs.empty())
             db.subs.pop_back();
     }
     return first;
diff --git a/libcxxabi/test/test_demangle.cpp b/libcxxabi/test/test_demangle.cpp
index 2ec53c64d8c..e32647f048e 100644
--- a/libcxxabi/test/test_demangle.cpp
+++ b/libcxxabi/test/test_demangle.cpp
@@ -29591,6 +29591,8 @@ const char* invalid_cases[] =
 {
     "_ZIPPreEncode",
     "Agentt",
+    "NSoERj5E=Y1[uM:ga",
+    "Aon_PmKVPDk7?fg4XP5smMUL6;<WsI_mgbf23cCgsHbT<l8EE\0uVRkNOoXDrgdA4[8IU>Vl<>IL8ayHpiVDDDXTY;^o9;i",
 };
 
 const unsigned NI = sizeof(invalid_cases) / sizeof(invalid_cases[0]);