[BUG] seemingly-rare segfault in merge-tree

I was looking through alerts this morning and found this one that happened in GitHub's infrastructure a few days ago. Usually these are memory corruption issues (and get dealt with via a separate process), but this was a legitimate SEGV in the merge-tree builtin.

The backtrace is as follows:

  (gdb) bt
  #0  oid_to_hex (oid=0x4) at hex.c:164
  #1  0x000056234188aba3 in real_merge (prefix=0x0, branch2=<optimized out>, branch1=<optimized out>, o=0x7ffd3fc4cd60) at builtin/merge-tree.c:528
  #2  cmd_merge_tree (argc=<optimized out>, argv=0x7ffd3fc4d7c0, prefix=0x0) at builtin/merge-tree.c:658
  #3  0x000056234181ffe9 in run_builtin (argv=0x7ffd3fc4d7c0, argc=8, p=0x562341d5c788 <commands+1896>) at git.c:465
  #4  handle_builtin (argc=8, argv=0x7ffd3fc4d7c0) at git.c:724
  #5  0x000056234182117f in run_argv (argv=0x7ffd3fc4d4f0, argcp=0x7ffd3fc4d4fc) at git.c:792
  #6  cmd_main (argc=<optimized out>, argv=<optimized out>) at git.c:923
  #7  0x000056234181fb80 in main (argc=11, argv=0x7ffd3fc4d7a8) at common-main.c:59

and it looks like the result's tree object is left NULL, which we then produce a SEGV on when trying to pass `&NULL->object.oid` to `oid_to_hex()`:

  (gdb) up
  #1  0x000056234188aba3 in real_merge (prefix=0x0, branch2=<optimized out>,
      branch1=<optimized out>, o=0x7ffd3fc4cd60) at builtin/merge-tree.c:528
  528	builtin/merge-tree.c: No such file or directory.
  (gdb) p result->tree
  $1 = (struct tree *) 0x0

I haven't looked too hard at these paths (nor do I have a useful reproduction, since the top-level `argv` array is optimized out). But I figured I'd share it here in case this was obvious to either one of you.

Thanks in advance for taking a look, and let me know if there's any information you need from me in order to debug it further.

Thanks, Taylor