Sema: filter out invalid base-specifiers before attaching

clang/lib/Sema/SemaDeclCXX.cpp

@@ -3031,8 +3031,23 @@ void Sema::ActOnBaseSpecifiers(Decl *ClassDecl,
   if (!ClassDecl || Bases.empty())
     return;
 
+  // --- drop any bases already diagnosed invalid ---
+  SmallVector<CXXBaseSpecifier *, 4> ValidBases;
+  ValidBases.reserve(Bases.size());
+  for (auto *BS : Bases)
+       if (BS)
+          ValidBases.push_back(BS);
+  if (ValidBases.empty())
+       return;
+
+  if (ValidBases.empty())
+    return; // nothing valid to attach
+
   AdjustDeclIfTemplate(ClassDecl);
-  AttachBaseSpecifiers(cast<CXXRecordDecl>(ClassDecl), Bases);
+  // Attach only the valid bases so downstream never ICEs
+  AttachBaseSpecifiers(cast<CXXRecordDecl>(ClassDecl),
+                       llvm::MutableArrayRef<CXXBaseSpecifier *>(
+                       ValidBases.data(), ValidBases.size()));
 }
 
 bool Sema::IsDerivedFrom(SourceLocation Loc, CXXRecordDecl *Derived,

clang/test/SemaCXX/invalid-base-inheritance.cpp

@@ -0,0 +1,13 @@
+// Tests that invalid base-specifiers no longer crash the compiler.
+// RUN: %clang_cc1 -std=c++20 -fsyntax-only -verify %s
+
+class X; // expected-note {{forward declaration of 'X'}} expected-note {{forward declaration of 'X'}}
+
+class A : X { // expected-error {{base class has incomplete type}}
+};
+
+class Y : int { // expected-error {{expected class name}}
+};
+
+class Z : X*, virtual int { // expected-error {{base class has incomplete type}} expected-error {{expected class name}}
+};