Input validation check when decoding with frame threads

https://0x0.st/s3Sg.ivf

$ ./dav1d --framethreads 4 -i s3Sg.ivf --muxer yuv -o NUL
Dav1d 0.0.1 - by Two Orioles
Decoded 1/24 frames (4.2%)
Input validation check 'dst->data[0] == ((void *)0)' failed in dav1d_picture_ref!

$ gcc --version
gcc.exe (Rev1, Built by MSYS2 project) 8.2.0

Happens with both pthreads (I think msys2 ships libwinpthread) and with the win32 threads wrappers in the tree. Have not tested on other OS. Most of the time the above command works and decoding finishes, but every now and then this or a hard lock happens.