While fuzzing the RPC interface I stumbled upon a null pointer dereference in CBlockIndexWorkComparator::operator() which is reachable via the invalidateblock RPC call:
$ ./autogen.sh
$ CC=clang CXX=clang++ ./configure --with-sanitizers=address,undefined
$ make
$ src/bitcoind -regtest &
$ src/bitcoin-cli -regtest generatetodescriptor 1 'addr(bcrt1qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq3xueyj)#juyq9d97'
2021-01-12T14:27:41Z CreateNewBlock(): block weight: 932 txs: 0 fees: 0 sigops 400
2021-01-12T14:27:41Z Pre-allocating up to position 0x100000 in rev00000.dat
2021-01-12T14:27:41Z Leaving InitialBlockDownload (latching to false)
2021-01-12T14:27:41Z UpdateTip: new best=60c56626f298548305381979897bc2ac4ced1c1f6b3b7b6ba7dfaa83c428eb92 height=1 version=0x20000000 log2_work=2.000000 tx=2 date='2021-01-12T14:27:41Z' progress=1.000000 cache=0.0MiB(1txo)
[
"60c56626f298548305381979897bc2ac4ced1c1f6b3b7b6ba7dfaa83c428eb92"
]
$ src/bitcoin-cli -regtest invalidateblock 0f9188f13cb7b2c71f2a335e3a4fc328bf5beb436012afca590b1a11466e2206
2021-01-12T14:28:01Z UpdateTip: new best=0f9188f13cb7b2c71f2a335e3a4fc328bf5beb436012afca590b1a11466e2206 height=0 version=0x00000001 log2_work=1.000000 tx=1 date='2011-02-02T23:16:42Z' progress=1.000000 cache=0.0MiB(1txo)
2021-01-12T14:28:01Z ERROR: UndoReadFromDisk: no undo data available
2021-01-12T14:28:01Z ERROR: DisconnectBlock(): failure reading undo data
2021-01-12T14:28:01Z ERROR: DisconnectTip(): DisconnectBlock 0f9188f13cb7b2c71f2a335e3a4fc328bf5beb436012afca590b1a11466e2206 failed
$ src/bitcoin-cli -regtest invalidateblock 0f9188f13cb7b2c71f2a335e3a4fc328bf5beb436012afca590b1a11466e2206
validation.cpp:87:30: runtime error: member access within null pointer of type 'const CBlockIndex'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior validation.cpp:87:30 in
AddressSanitizer:DEADLYSIGNAL
=================================================================
==7489==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000044 (pc 0x559ffc210c43 bp 0x60d0000e7301 sp 0x7f83af6b6890 T16)
==7489==The signal is caused by a READ memory access.
==7489==Hint: address points to the zero page.
[#0](/bitcoin-bitcoin/0/) 0x559ffc210c42 in base_uint<256u>::CompareTo(base_uint<256u> const&) const src/arith_uint256.cpp
[#1](/bitcoin-bitcoin/1/) 0x559ffbc96c55 in operator>(base_uint<256u> const&, base_uint<256u> const&) src/./arith_uint256.h:219:85
[#2](/bitcoin-bitcoin/2/) 0x559ffbc96c55 in CBlockIndexWorkComparator::operator()(CBlockIndex const*, CBlockIndex const*) const src/validation.cpp:87:24
[#3](/bitcoin-bitcoin/3/) 0x559ffbcc3363 in CChainState::InvalidateBlock(BlockValidationState&, CChainParams const&, CBlockIndex*) src/validation.cpp:2954:22
[#4](/bitcoin-bitcoin/4/) 0x559ffbcc50d3 in InvalidateBlock(BlockValidationState&, CChainParams const&, CBlockIndex*) src/validation.cpp:3061:33
[#5](/bitcoin-bitcoin/5/) 0x559ffb9a6eb7 in invalidateblock()::$_22::operator()(RPCHelpMan const&, JSONRPCRequest const&) const src/rpc/blockchain.cpp:1603:5
…
[1]+ Exit 1 src/bitcoind -regtest
Nothing high priority of course, but still worth fixing :)