Fixes apple: #12020687. This was a problem in the demangler with template

substitution forward references.  That is, sometimes a mangled name refers to
a substitution that hasn't yet been defined.  The demangler was derferencing a
null pointer in this case because it wasn't properly guarded against a
forward reference.  Test case added to catch this problem.

llvm-svn: 161267