in #1784312: Stop doing so much pre-kernel bootstrapping introduced a BootstrapConfigStorageFactory which I don't understand at all. It references $conf['drupal_bootstrap_config_storage'] but is the only place in core to do so. I also don't see that part discussed in this issue at all.
I'm hitting this in the D7 -> D8 upgrade path. BootstrapConfigStorageFactory is called from DrupalKernel::registerBundles which is called (a couple levels up in the stack) from DrupalKernel::boot() right in update_fix_d8_requirements(). Most importantly this is called before checking if settings.php exists. Excerpt:
<?php
// Bootstrap the kernel.
// Do not attempt to dump and write it.
$kernel = new DrupalKernel('update', FALSE, drupal_classloader(), FALSE);
$kernel->boot();
// Check whether settings.php needs to be rewritten.
$settings_exist = !empty($GLOBALS['config_directories']);
?>Therefore in BootstrapConfigStorageFactory the call to config_get_config_directory() happens with empty global $config_directories and everything blows up. I have no idea how the upgrade path even remotely works at this point (it doesn't for me locally). The reason I am not opening a new issue is that I am not able to make any sense at all of BootstrapConfigStorageFactory.
The attached patch resolves the fatal at least, but update.php still doesn't spit anything out.