Index: lib/Analysis/CFG.cpp
===================================================================
--- lib/Analysis/CFG.cpp
+++ lib/Analysis/CFG.cpp
@@ -3457,6 +3457,8 @@
     // continue statements.
     Block = nullptr;
     Succ = addStmt(S->getInc());
+    if (badCFG)
+      return nullptr;
     ContinueJumpTarget = JumpTarget(Succ, ContinueScopePos);
 
     // The starting block for the loop increment is the block that should
Index: unittests/Analysis/CFGTest.cpp
===================================================================
--- /dev/null
+++ unittests/Analysis/CFGTest.cpp
@@ -0,0 +1,54 @@
+//===- unittests/Analysis/CFGTest.cpp - CFG tests -------------------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+
+#include "clang/ASTMatchers/ASTMatchFinder.h"
+#include "clang/Analysis/CFG.h"
+#include "clang/Tooling/Tooling.h"
+#include "gtest/gtest.h"
+#include <string>
+#include <vector>
+
+namespace clang {
+namespace analysis {
+namespace {
+
+// Constructing a CFG for a range-based for over a dependent type fails (but
+// should not crash).
+TEST(CFG, RangeBasedForOverDependentType) {
+  const char *Code = "class Foo;\n"
+                     "template <typename T>\n"
+                     "void f(const T &Range) {\n"
+                     "  for (const Foo *TheFoo : Range) {\n"
+                     "  }\n"
+                     "}\n";
+
+  class CFGCallback : public ast_matchers::MatchFinder::MatchCallback {
+  public:
+    void run(const ast_matchers::MatchFinder::MatchResult &Result) override {
+      const auto *Func = Result.Nodes.getNodeAs<FunctionDecl>("func");
+      Stmt *Body = Func->getBody();
+      if (!Body)
+        return;
+      std::unique_ptr<CFG> cfg =
+          CFG::buildCFG(nullptr, Body, Result.Context, CFG::BuildOptions());
+      EXPECT_EQ(nullptr, cfg);
+    }
+  } Callback;
+
+  ast_matchers::MatchFinder Finder;
+  Finder.addMatcher(ast_matchers::functionDecl().bind("func"), &Callback);
+  std::unique_ptr<tooling::FrontendActionFactory> Factory(
+      tooling::newFrontendActionFactory(&Finder));
+  std::vector<std::string> Args = {"-std=c++11"};
+  ASSERT_TRUE(tooling::runToolOnCodeWithArgs(Factory->create(), Code, Args));
+}
+
+} // namespace
+} // namespace analysis
+} // namespace clang
Index: unittests/Analysis/CMakeLists.txt
===================================================================
--- /dev/null
+++ unittests/Analysis/CMakeLists.txt
@@ -0,0 +1,13 @@
+set(LLVM_LINK_COMPONENTS
+  Support
+  )
+
+add_clang_unittest(CFGTests
+  CFGTest.cpp
+  )
+
+target_link_libraries(CFGTests
+  clangAnalysis
+  clangASTMatchers
+  clangTooling
+  )
Index: unittests/CMakeLists.txt
===================================================================
--- unittests/CMakeLists.txt
+++ unittests/CMakeLists.txt
@@ -13,6 +13,7 @@
 add_subdirectory(Lex)
 add_subdirectory(Driver)
 if(CLANG_ENABLE_STATIC_ANALYZER)
+  add_subdirectory(Analysis)
   add_subdirectory(StaticAnalyzer)
   add_subdirectory(Frontend)
 endif()