PyType_IsSubtype(): test tp_flags for HAVE_CLASS bit before accessing a->tp_mro. If a doesn't have class, it's considered a subclass only of itself or of 'object'.
This one fix is enough to prevent the ExtensionClass test suite from dumping core, but that doesn't say much (it's a rather small test suite). Also note that for ExtensionClass-defined types, a different subclass test may be needed. But I haven't checked whether PyType_IsSubtype() is actually used in situations where this matters -- probably it doesn't, since we also don't check for classic classes.