Force all Pos* to be non-null

This fixes a class of crashes and introduces ptr<T> to make the
code robust against this failure mode going forward.

Thanks regnat for the idea of a ref<T> without overhead!

Closes #4895
Closes #4893
Closes #5127
Closes #5113

src/libutil/ref.hh

@@ -99,4 +99,47 @@ make_ref(Args&&... args)
     return ref<T>(p);
 }
 
+
+/* A non-nullable pointer.
+   This is similar to a C++ "& reference", but mutable.
+   This is similar to ref<T> but backed by a regular pointer instead of a smart pointer.
+ */
+template<typename T>
+class ptr {
+private:
+    T * p;
+
+public:
+    ptr<T>(const ptr<T> & r)
+        : p(r.p)
+    { }
+
+    explicit ptr<T>(T * p)
+        : p(p)
+    {
+        if (!p)
+            throw std::invalid_argument("null pointer cast to ptr");
+    }
+
+    T* operator ->() const
+    {
+        return &*p;
+    }
+
+    T& operator *() const
+    {
+        return *p;
+    }
+
+    bool operator == (const ptr<T> & other) const
+    {
+        return p == other.p;
+    }
+
+    bool operator != (const ptr<T> & other) const
+    {
+        return p != other.p;
+    }
+};
+
 }