merge-base: do not leak commit list