diff --git a/clang/docs/ReleaseNotes.rst b/clang/docs/ReleaseNotes.rst
index 8bd6e92..5430c11 100644
--- a/clang/docs/ReleaseNotes.rst
+++ b/clang/docs/ReleaseNotes.rst
@@ -273,6 +273,8 @@
   be completed).
 - Fixed a failed assertion with an invalid parameter to the ``#embed``
   directive. Fixes #GH126940.
+- Fixed a crash when a declaration of a ``constexpr`` variable with an invalid
+  type. Fixes #GH140887
 
 C11 Feature Support
 ^^^^^^^^^^^^^^^^^^^
diff --git a/clang/lib/Sema/SemaDecl.cpp b/clang/lib/Sema/SemaDecl.cpp
index cb81ac8..814f81c 100644
--- a/clang/lib/Sema/SemaDecl.cpp
+++ b/clang/lib/Sema/SemaDecl.cpp
@@ -8681,7 +8681,8 @@
 
   if (CanonT->isRecordType()) {
     const RecordDecl *RD = CanonT->getAsRecordDecl();
-    if (llvm::any_of(RD->fields(), [&SemaRef, VarLoc](const FieldDecl *F) {
+    if (!RD->isInvalidDecl() &&
+        llvm::any_of(RD->fields(), [&SemaRef, VarLoc](const FieldDecl *F) {
           return CheckC23ConstexprVarType(SemaRef, VarLoc, F->getType());
         }))
       return true;
diff --git a/clang/lib/Sema/SemaInit.cpp b/clang/lib/Sema/SemaInit.cpp
index 3c3f796..935c4da8 100644
--- a/clang/lib/Sema/SemaInit.cpp
+++ b/clang/lib/Sema/SemaInit.cpp
@@ -6618,7 +6618,7 @@
       // initializer present. However, we only do this for structure types, not
       // union types, because an unitialized field in a union is generally
       // reasonable, especially in C where unions can be used for type punning.
-      if (!Initializer && !Rec->isUnion()) {
+      if (!Initializer && !Rec->isUnion() && !Rec->isInvalidDecl()) {
         if (const FieldDecl *FD = getConstField(Rec)) {
           unsigned DiagID = diag::warn_default_init_const_field_unsafe;
           if (Var->getStorageDuration() == SD_Static ||
diff --git a/clang/test/Sema/c2y-invalid-constexpr.c b/clang/test/Sema/c2y-invalid-constexpr.c
new file mode 100644
index 0000000..166827d
--- /dev/null
+++ b/clang/test/Sema/c2y-invalid-constexpr.c
@@ -0,0 +1,12 @@
+// RUN: %clang_cc1 -fsyntax-only -verify -std=c23 %s
+
+// This was previously causing a stack overflow when checking the valid
+// declaration of an invalid type. Ensure we issue reasonable diagnostics
+// instead of crashing.
+struct GH140887 { // expected-note {{definition of 'struct GH140887' is not complete until the closing '}'}}
+  GH140887();     // expected-error {{must use 'struct' tag to refer to type 'GH140887'}} \
+                     expected-error {{expected member name or ';' after declaration specifiers}} \
+                     expected-error {{field has incomplete type 'struct GH140887'}}
+};
+constexpr struct GH140887 a; // expected-error {{constexpr variable 'a' must be initialized by a constant expression}}
+
diff --git a/clang/test/Sema/warn-default-const-init-crash.c b/clang/test/Sema/warn-default-const-init-crash.c
new file mode 100644
index 0000000..4a2c858
--- /dev/null
+++ b/clang/test/Sema/warn-default-const-init-crash.c
@@ -0,0 +1,11 @@
+// RUN: %clang_cc1 -fsyntax-only -verify %s
+
+// This invalid code was causing a stack overflow, check that we issue
+// reasonable diagnostics and not crash.
+struct GH140887 {    // expected-note {{definition of 'struct GH140887' is not complete until the closing '}'}}
+  struct GH140887 s; // expected-error {{field has incomplete type 'struct GH140887'}}
+};
+
+void gh140887() {
+  struct GH140887 s;
+}