diff --git a/gcc/cp/ChangeLog b/gcc/cp/ChangeLog
index 998303417d25..0c118f16aa17 100644
--- a/gcc/cp/ChangeLog
+++ b/gcc/cp/ChangeLog
@@ -1,3 +1,9 @@
+2011-12-01  Paolo Carlini  <paolo.carlini@oracle.com>
+
+	PR c++/51326
+	* call.c (build_user_type_conversion_1): Early return NULL if
+	expr is NULL_TREE.
+
 2011-12-01  Paolo Carlini  <paolo.carlini@oracle.com>
 
 	PR c++/51367
diff --git a/gcc/cp/call.c b/gcc/cp/call.c
index ab0654273a3e..e7bbf0a1d8bf 100644
--- a/gcc/cp/call.c
+++ b/gcc/cp/call.c
@@ -3373,7 +3373,7 @@ static struct z_candidate *
 build_user_type_conversion_1 (tree totype, tree expr, int flags)
 {
   struct z_candidate *candidates, *cand;
-  tree fromtype = TREE_TYPE (expr);
+  tree fromtype;
   tree ctors = NULL_TREE;
   tree conv_fns = NULL_TREE;
   conversion *conv = NULL;
@@ -3382,6 +3382,11 @@ build_user_type_conversion_1 (tree totype, tree expr, int flags)
   bool any_viable_p;
   int convflags;
 
+  if (!expr)
+    return NULL;
+
+  fromtype = TREE_TYPE (expr);
+
   /* We represent conversion within a hierarchy using RVALUE_CONV and
      BASE_CONV, as specified by [over.best.ics]; these become plain
      constructor calls, as specified in [dcl.init].  */
diff --git a/gcc/testsuite/ChangeLog b/gcc/testsuite/ChangeLog
index d0548caa2ee8..084ef4433200 100644
--- a/gcc/testsuite/ChangeLog
+++ b/gcc/testsuite/ChangeLog
@@ -1,3 +1,8 @@
+2011-12-01  Paolo Carlini  <paolo.carlini@oracle.com>
+
+	PR c++/51326
+	* g++.dg/inherit/crash3.C: New.
+
 2011-12-01  Nathan Sidwell  <nathan@acm.org>
 
 	PR gcov-profile/51113
diff --git a/gcc/testsuite/g++.dg/inherit/crash3.C b/gcc/testsuite/g++.dg/inherit/crash3.C
new file mode 100644
index 000000000000..e6094b04a64d
--- /dev/null
+++ b/gcc/testsuite/g++.dg/inherit/crash3.C
@@ -0,0 +1,11 @@
+// PR c++/51326
+
+struct A
+{
+  virtual int& foo(); // { dg-error "overriding" }
+};
+
+struct B : A
+{
+  B& foo();           // { dg-error "conflicting return type" }
+};