Assertion `!isNull() && "Cannot retrieve a NULL type pointer"' with expansion statement

https://godbolt.org/z/7cbdPa6eq

```c++
void f(int g(const int&)) {
template for (auto x : {g(1), g(2), g(3)})
g(0);
}
```

```
clang++: /root/llvm-project/llvm/tools/clang/include/clang/AST/TypeBase.h:954: const clang::ExtQualsTypeCommonBase* clang::QualType::getCommonPtr() const: Assertion `!isNull() && "Cannot retrieve a NULL type pointer"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace and dumped files.
Stack dump:
0. Program arguments: /opt/compiler-explorer/clang-assertions-trunk/bin/clang++ -g -o /app/output.s -mllvm --x86-asm-syntax=intel -fno-verbose-asm -S --gcc-toolchain=/opt/compiler-explorer/gcc-snapshot -fcolor-diagnostics -fno-crash-diagnostics -std=c++26
1. :3:9: current parser token 'g'
2. :1:27: parsing function body 'f'
3. :1:27: in compound statement ('{}')
#0 0x0000000004420a78 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4420a78)
#1 0x000000000441d924 llvm::sys::RunSignalHandlers() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x441d924)
#2 0x000000000441df5c llvm::sys::CleanupOnSignal(unsigned long) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x441df5c)
#3 0x000000000435cf38 CrashRecoverySignalHandler(int) CrashRecoveryContext.cpp:0:0
#4 0x0000775f2d045330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
#5 0x0000775f2d09eb2c pthread_kill (/lib/x86_64-linux-gnu/libc.so.6+0x9eb2c)
#6 0x0000775f2d04527e raise (/lib/x86_64-linux-gnu/libc.so.6+0x4527e)
#7 0x0000775f2d0288ff abort (/lib/x86_64-linux-gnu/libc.so.6+0x288ff)
#8 0x0000775f2d02881b (/lib/x86_64-linux-gnu/libc.so.6+0x2881b)
#9 0x0000775f2d03b517 (/lib/x86_64-linux-gnu/libc.so.6+0x3b517)
#10 0x000000000724c484 clang::Sema::ActOnCXXExpansionStmtPattern(clang::CXXExpansionStmtDecl*, clang::Stmt*, clang::Stmt*, clang::Expr*, clang::SourceLocation, clang::SourceLocation, clang::SourceLocation, llvm::ArrayRef) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x724c484)
#11 0x0000000006e4d912 clang::Parser::ParseForStatement(clang::SourceLocation*, clang::LabelDecl*, clang::CXXExpansionStmtDecl*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6e4d912)
#12 0x0000000006e4ee05 clang::Parser::ParseExpansionStatement(clang::SourceLocation*, clang::LabelDecl*, clang::SourceLocation) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6e4ee05)
#13 0x0000000006e4b36a clang::Parser::ParseStatementOrDeclarationAfterAttributes(llvm::SmallVector&, clang::Parser::ParsedStmtContext, clang::SourceLocation*, clang::ParsedAttributes&, clang::ParsedAttributes&, clang::LabelDecl*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6e4b36a)
#14 0x0000000006e4bdf9 clang::Parser::ParseStatementOrDeclaration(llvm::SmallVector&, clang::Parser::ParsedStmtContext, clang::SourceLocation*, clang::LabelDecl*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6e4bdf9)
#15 0x0000000006e542f5 clang::Parser::ParseCompoundStatementBody(bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6e542f5)
#16 0x0000000006e54b3a clang::Parser::ParseFunctionStatementBody(clang::Decl*, clang::Parser::ParseScope&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6e54b3a)
#17 0x0000000006d52ecd clang::Parser::ParseFunctionDefinition(clang::ParsingDeclarator&, clang::Parser::ParsedTemplateInfo const&, clang::LateParsedAttrList*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d52ecd)
#18 0x0000000006d9c6f6 clang::Parser::ParseDeclGroup(clang::ParsingDeclSpec&, clang::DeclaratorContext, clang::ParsedAttributes&, clang::Parser::ParsedTemplateInfo&, clang::SourceLocation*, clang::Parser::ForRangeInit*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d9c6f6)
#19 0x0000000006d4730b clang::Parser::ParseDeclOrFunctionDefInternal(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec&, clang::AccessSpecifier) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d4730b)
#20 0x0000000006d47aff clang::Parser::ParseDeclarationOrFunctionDefinition(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*, clang::AccessSpecifier) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d47aff)
#21 0x0000000006d542a8 clang::Parser::ParseExternalDeclaration(clang::ParsedAttributes&, clang::ParsedAttributes&, clang::ParsingDeclSpec*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d542a8)
#22 0x0000000006d55205 clang::Parser::ParseTopLevelDecl(clang::OpaquePtr&, clang::Sema::ModuleImportState&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d55205)
#23 0x0000000006d555f0 clang::Parser::ParseFirstTopLevelDecl(clang::OpaquePtr&, clang::Sema::ModuleImportState&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d555f0)
#24 0x0000000006d3213c clang::ParseAST(clang::Sema&, bool, bool) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x6d3213c)
#25 0x0000000004f2e918 clang::CodeGenAction::ExecuteAction() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4f2e918)
#26 0x000000000525ba98 clang::FrontendAction::Execute() (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x525ba98)
#27 0x00000000051e865d clang::CompilerInstance::ExecuteAction(clang::FrontendAction&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x51e865d)
#28 0x00000000053301dd clang::ExecuteCompilerInvocation(clang::CompilerInstance*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x53301dd)
#29 0x0000000000dacf5c cc1_main(llvm::ArrayRef, char const*, void*) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xdacf5c)
#30 0x0000000000da3b6a ExecuteCC1Tool(llvm::SmallVectorImpl&, llvm::ToolContext const&, llvm::IntrusiveRefCntPtr) driver.cpp:0:0
#31 0x0000000000da3ced int llvm::function_ref&)>::callback_fn&)>(long, llvm::SmallVectorImpl&) driver.cpp:0:0
#32 0x0000000004fa5e19 void llvm::function_ref::callback_fn>, std::__cxx11::basic_string, std::allocator>*, bool*) const::'lambda'()>(long) Job.cpp:0:0
#33 0x000000000435d374 llvm::CrashRecoveryContext::RunSafely(llvm::function_ref) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x435d374)
#34 0x0000000004fa6985 clang::driver::CC1Command::Execute(llvm::ArrayRef>, std::__cxx11::basic_string, std::allocator>*, bool*) const (.part.0) Job.cpp:0:0
#35 0x0000000004f5f162 clang::driver::Compilation::ExecuteCommand(clang::driver::Command const&, clang::driver::Command const*&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4f5f162)
#36 0x0000000004f63997 clang::driver::Compilation::ExecuteJobs(clang::driver::JobList const&, llvm::SmallVectorImpl>&, bool) const (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4f63997)
#37 0x0000000004f6def5 clang::driver::Driver::ExecuteCompilation(clang::driver::Compilation&, llvm::SmallVectorImpl>&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0x4f6def5)
#38 0x0000000000da944a clang_main(int, char**, llvm::ToolContext const&) (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xda944a)
#39 0x0000000000cc525a main (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xcc525a)
#40 0x0000775f2d02a1ca (/lib/x86_64-linux-gnu/libc.so.6+0x2a1ca)
#41 0x0000775f2d02a28b __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28b)
#42 0x0000000000da3515 _start (/opt/compiler-explorer/clang-assertions-trunk/bin/clang+++0xda3515)
clang++: error: clang frontend command failed due to signal (use -v to see invocation)
Compiler returned: 134
```

CC @Sirraide

Reproduce the C++26 example from the issue with an assertions-enabled clang++, then inspect clang::Sema::ActOnCXXExpansionStmtPattern and the assertion in llvm/tools/clang/include/clang/AST/TypeBase.h. Trace how the expansion statement's initializer expressions are handled; done means this reproducer no longer triggers the NULL QualType assertion.

Written by the indexing model from the issue text.