[BUG] v2.16.0-rc0 seg faults when git bisect skip

[Yasushi SHOJI <yasushi.shoji@gmail.com>]

Hi,

git version 2.16.0.rc0 seg faults on my machine when I

git bisect skip

Here is a back trace:

$ /opt/mygit/bin/git --version
git version 2.16.0.rc0

$ /opt/mygit/bin/git bisect skip
Segmentation fault (core dumped)

$ gdb /opt/mygit/bin/git core
GNU gdb (Debian 7.12-6+b1) 7.12.0.20161007-git
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /opt/mygit/bin/git...done.
[New LWP 5211]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `git bisect--helper --next-all'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000055a73107f900 in best_bisection_sorted (list=0x0, nr=0) at bisect.c:232
232 free_commit_list(p->next);
(gdb) bt
#0  0x000055a73107f900 in best_bisection_sorted (list=0x0, nr=0) at bisect.c:232
#1  0x000055a73107fc0f in do_find_bisection (list=0x0, nr=0,
weights=0x55a731b6ffd0, find_all=1) at bisect.c:361
#2  0x000055a73107fcf4 in find_bisection (commit_list=0x7ffe8750d4d0,
reaches=0x7ffe8750d4c4, all=0x7ffe8750d4c0, find_all=1) at
bisect.c:400
#3  0x000055a73108128d in bisect_next_all (prefix=0x0, no_checkout=0)
at bisect.c:969
#4  0x000055a730fd5238 in cmd_bisect__helper (argc=0,
argv=0x7ffe8750e230, prefix=0x0) at builtin/bisect--helper.c:140
#5  0x000055a730fcbc76 in run_builtin (p=0x55a73145c778
<commands+120>, argc=2, argv=0x7ffe8750e230) at git.c:346
#6  0x000055a730fcbf40 in handle_builtin (argc=2, argv=0x7ffe8750e230)
at git.c:554
#7  0x000055a730fcc0e8 in run_argv (argcp=0x7ffe8750e0ec,
argv=0x7ffe8750e0e0) at git.c:606
#8  0x000055a730fcc29b in cmd_main (argc=2, argv=0x7ffe8750e230) at git.c:683
#9  0x000055a731068d9e in main (argc=3, argv=0x7ffe8750e228) at common-main.c:43
(gdb) p p
$1 = (struct commit_list *) 0x0

As you can see, the code dereferences to the 'next' while 'p' is NULL.

I'm sure I did 'git bisect good' after git _found_ bad commit.  Then I
typed 'git bisect skip' on the commit 726804874 of guile repository.
If that matters at all.

I haven't touched guile repo to preserve the current state.

Let me know if you need any other info.
-- 
          yashi