guard empty block member list in getBlockSize
diff --git a/Test/baseResults/spv.bufferReferenceForwardDecl.comp.out b/Test/baseResults/spv.bufferReferenceForwardDecl.comp.out
new file mode 100644
index 0000000..86a7820
--- /dev/null
+++ b/Test/baseResults/spv.bufferReferenceForwardDecl.comp.out
@@ -0,0 +1,44 @@
+spv.bufferReferenceForwardDecl.comp
+// Module Version 10000
+// Generated by (magic number): 8000b
+// Id's are bound by 20
+
+                              Capability Shader
+                              Capability Int64
+                              Capability PhysicalStorageBufferAddressesEXT
+                              Extension  "SPV_KHR_physical_storage_buffer"
+               1:             ExtInstImport  "GLSL.std.450"
+                              MemoryModel PhysicalStorageBuffer64EXT GLSL450
+                              EntryPoint GLCompute 4  "main"
+                              ExecutionMode 4 LocalSize 1 1 1
+                              Source GLSL 450
+                              SourceExtension  "GL_EXT_buffer_reference"
+                              SourceExtension  "GL_EXT_buffer_reference2"
+                              Name 4  "main"
+                              Name 7  "B"
+                              Name 9  "b"
+                              Decorate 7(B) Block
+                              Decorate 9(b) DecorationAliasedPointerEXT
+                              Decorate 19 BuiltIn WorkgroupSize
+               2:             TypeVoid
+               3:             TypeFunction 2
+                              TypeForwardPointer 6 PhysicalStorageBufferEXT
+            7(B):             TypeStruct
+               6:             TypePointer PhysicalStorageBufferEXT 7(B)
+               8:             TypePointer Function 6(ptr)
+              11:             TypeInt 64 0
+              13: 11(int64_t) Constant 0 0
+              16:             TypeInt 32 0
+              17:             TypeVector 16(int) 3
+              18:     16(int) Constant 1
+              19:   17(ivec3) ConstantComposite 18 18 18
+         4(main):           2 Function None 3
+               5:             Label
+            9(b):      8(ptr) Variable Function
+              10:      6(ptr) Load 9(b)
+              12: 11(int64_t) ConvertPtrToU 10
+              14: 11(int64_t) IAdd 12 13
+              15:      6(ptr) ConvertUToPtr 14
+                              Store 9(b) 15
+                              Return
+                              FunctionEnd
diff --git a/Test/spv.bufferReferenceForwardDecl.comp b/Test/spv.bufferReferenceForwardDecl.comp
new file mode 100644
index 0000000..146bf49
--- /dev/null
+++ b/Test/spv.bufferReferenceForwardDecl.comp
@@ -0,0 +1,14 @@
+#version 450
+#extension GL_EXT_buffer_reference2 : require
+
+// Forward-declared buffer_reference block whose body is never defined, then used
+// in pointer arithmetic. The referent stays an empty member list, so the block
+// size is 0.
+layout(buffer_reference) buffer B;
+
+layout(local_size_x = 1) in;
+void main()
+{
+    B b;
+    b = b + 1;
+}
diff --git a/glslang/MachineIndependent/linkValidate.cpp b/glslang/MachineIndependent/linkValidate.cpp
index 13e3798..b4cfe4d 100644
--- a/glslang/MachineIndependent/linkValidate.cpp
+++ b/glslang/MachineIndependent/linkValidate.cpp
@@ -2754,6 +2754,8 @@
 {
     const TTypeList& memberList = *blockType.getStruct();
     int lastIndex = (int)memberList.size() - 1;
+    if (lastIndex < 0)
+        return 0;
     int lastOffset = getOffset(blockType, lastIndex);
 
     int lastMemberSize;
diff --git a/gtests/Spv.FromFile.cpp b/gtests/Spv.FromFile.cpp
index 7095668..d668ffd 100644
--- a/gtests/Spv.FromFile.cpp
+++ b/gtests/Spv.FromFile.cpp
@@ -413,6 +413,7 @@
         "spv.bufferhandleUvec2.frag",
         "spv.bufferhandleSwizzle.frag",
         "spv.bufferhandle_Error.frag",
+        "spv.bufferReferenceForwardDecl.comp",
         "spv.bufferReferenceNestedStruct.comp",
         "spv.builtInXFB.vert",
         "spv.conditionalDemote.frag",