heap-use-after-free in od_ec_dec_refill() src/msac.c

Found with commit 6ac49461

Steps to reproduce:

1. build dav1d with AddressSanitizer
2. replay testcase with dav1d fuzzer

testcase.ivf

==14202==ERROR: AddressSanitizer: heap-use-after-free on address 0x61e0000000f9 at pc 0x000000593531 bp 0x7ffe15609390 sp 0x7ffe15609388
READ of size 1 at 0x61e0000000f9 thread T0
    #0 0x593530 in od_ec_dec_refill src/msac.c:128:26
    #1 0x593530 in od_ec_dec_normalize src/msac.c:157
    #2 0x571f62 in msac_decode_bool_adapt src/msac.h:48:26
    #3 0x571f62 in read_mv_component_diff src/decode.c:85
    #4 0x570014 in read_mv_residual src/decode.c:116:22
    #5 0x560b30 in decode_b src/decode.c:1619:17
    #6 0x532261 in decode_sb src/decode.c
    #7 0x52fd37 in dav1d_decode_tile_sbrow src/decode.c:2319:13
    #8 0x53d52d in dav1d_decode_frame src/decode.c:2662:29
    #9 0x545ada in dav1d_submit_frame src/decode.c:3032:20
    #10 0x51c48e in dav1d_parse_obus src/obu.c:1079:20
    #11 0x517554 in dav1d_decode src/lib.c:193:20
    #12 0x51297d in LLVMFuzzerTestOneInput tests/libfuzzer/dav1d_fuzzer.c:75:19

0x61e0000000f9 is located 121 bytes inside of 2483-byte region [0x61e000000080,0x61e000000a33)
freed by thread T0 here:
    #0 0x4d9ea0 in __interceptor_free.localalias.0 (dav1d_fuzzer+0x4d9ea0)
    #1 0x51574f in dav1d_ref_dec src/ref.c:78:9
    #2 0x514f01 in dav1d_data_unref src/data.c:72:9
    #3 0x517635 in dav1d_decode src/lib.c:199:22
    #4 0x51297d in LLVMFuzzerTestOneInput tests/libfuzzer/dav1d_fuzzer.c:75:19

previously allocated by thread T0 here:
    #0 0x4daca8 in __interceptor_posix_memalign (dav1d_fuzzer+0x4daca8)
    #1 0x515133 in dav1d_alloc_aligned include/common/mem.h:46:9
    #2 0x515133 in dav1d_ref_create src/ref.c:40
    #3 0x5149cc in dav1d_data_create src/data.c:43:16
    #4 0x5128c6 in LLVMFuzzerTestOneInput tests/libfuzzer/dav1d_fuzzer.c:68:15