Crash near null in dav1d_submit_frame() src/decode.c

Found with commit acd90b71

Steps to reproduce:

build dav1d with AddressSanitizer
run attached testcase with dav1d executable ./dav1d -i testcase.ivf -o out.ivf

==5778==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 (pc 0x0000004f403a bp 0x62a000003280 sp 0x7ffe088472e0 T0)
    #0 0x4f4039 in dav1d_ref_inc dav1d/src/ref.c:73:5
    #1 0x51c14c in dav1d_submit_frame dav1d/src/decode.c:2875:17
    #2 0x504298 in dav1d_parse_obus dav1d/src/obu.c:1075:20
    #3 0x4f5f87 in dav1d_decode dav1d/src/lib.c:193:20
    #4 0x4eaa77 in main dav1d/tools/dav1d.c:108:20
    #5 0x7fac9965882f in __libc_start_main ibc-Cl5G7W/glibc-2.23/csu/libc-start.c:291
    #6 0x418d38 in _start (/dav1d+0x418d38)

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information