[BUG] Segfault with rev-list --bisect

Hi,

I've found a case where git rev-list --bisect segfaults reproducibly (git version is 2.3.1). This is the commit topology (A2 is the first parent of M):

I - A1 - A2
  \        \
    - B1 -- M  (HEAD)

And this is an example of a command that segfaults:

git rev-list --bisect --first-parent --parents HEAD --not HEAD~1

I tried a couple of variations quickly: It does not segfault if a non-merge commit is made on top of M (so HEAD is no longer pointing directly to M). It also does not segfault if 'HEAD~1' is changed to 'HEAD~2'.

Thanks, Troy