C++: Fix crash on static template instantiation

template<typename T>
struct QList
{
   struct iterator
   {
      T *operator->() { return &t; }
      T t;
   };
   static iterator begin() { return iterator(); }
};

struct Foo { int bar; };

void fun() {
   auto a = QList<Foo>::begin();
   a. // crash
}

Change-Id: I373c493b2eefc9566ec13165285c33d474a3b440
Reviewed-by: Nikolai Kosjar <nikolai.kosjar@theqtcompany.com>

src/libs/3rdparty/cplusplus/Templates.cpp

@@ -100,7 +100,7 @@ void CloneType::visit(NamedType *type)
     const Name *name = _clone->name(type->name(), _subst);
     FullySpecifiedType ty;
     if (_subst)
-        ty = _subst->apply(name);
+        ty = _clone->type(_subst->apply(name), 0);
     if (! ty.isValid())
         ty = _control->namedType(name);
     _type.setType(ty.type());

src/plugins/cpptools/cppcompletion_test.cpp

@@ -2595,6 +2595,27 @@ void CppToolsPlugin::test_completion_data()
     ) << _("a->") << (QStringList()
         << QLatin1String("Foo")
         << QLatin1String("bar"));
+
+    QTest::newRow("direct_nested_template_type_access") << _(
+            "template<typename T>\n"
+            "struct QList\n"
+            "{\n"
+            "   struct iterator\n"
+            "   {\n"
+            "      T *operator->() { return &t; }\n"
+            "      T t;\n"
+            "   };\n"
+            "   iterator begin() { return iterator(); }\n"
+            "};\n"
+            "struct Foo { int bar; };\n"
+            "void fun() {\n"
+            "   auto a = QList<Foo>::begin();\n"
+            "   @\n"
+            "}\n"
+    ) << _("a.") << (QStringList()
+        << QLatin1String("operator ->")
+        << QLatin1String("t")
+        << QLatin1String("iterator"));
 }
 
 void CppToolsPlugin::test_completion_member_access_operator()