bug#29632: 25.3; Core dump after changing fonts

[Thomas Morgan]

I started emacs with `emacs -Q', entered the following in *scratch*,
and evaluated with C-M-x.

  (progn
    (create-fontset-from-fontset-spec
     "-*-Liberation Mono-normal-normal-normal-*-*-*-*-*-m-0-fontset-liberation")
    (set-fontset-font "fontset-liberation" 'unicode-bmp "Freemono")
    (set-face-font 'default "fontset-liberation")
    (font-at 0 nil "ɏ")       ; 0x024F: LATIN SMALL LETTER Y WITH STROKE
    (set-fontset-font "fontset-auto1" 'unicode-bmp "Freemono")
    (font-at 0 nil "ɐ"))      ; 0x0250: LATIN SMALL LETTER TURNED A

This caused a core dump:

  Fatal error 11: Segmentation fault

Information from report-emacs-bug:

In GNU Emacs 25.3.1 (x86_64-pc-linux-gnu, GTK+ Version 3.22.21)
 of 2017-11-05 built on localhost
Windowing system distributor 'The X.Org Foundation', version 11.0.11905000
Configured using:
 'configure --disable-dependency-tracking
 --prefix=/nix/store/7px74nmmy9wnl594jsk0lcgz1ygsbwfj-emacs-25.3
 --with-modules --with-x-toolkit=gtk3 --with-xft'

Configured features:
XPM JPEG TIFF GIF PNG RSVG SOUND DBUS GSETTINGS NOTIFY LIBSELINUX GNUTLS
LIBXML2 FREETYPE XFT ZLIB TOOLKIT_SCROLL_BARS GTK3 X11 MODULES

Important settings:
  value of $LC_ALL: en_US.utf8
  value of $LC_COLLATE: C
  value of $LANG: en_US.UTF-8
  value of $XMODIFIERS: @im=ibus
  locale-coding-system: utf-8-unix

Major mode: Lisp Interaction

Minor modes in effect:
  tooltip-mode: t
  global-eldoc-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent messages:
For information about GNU Emacs and the GNU system, type C-h C-a.

Load-path shadows:
None found.

Features:
(shadow sort mail-extr emacsbug message dired format-spec rfc822 mml
mml-sec password-cache epg epg-config gnus-util mm-decode mm-bodies
mm-encode mail-parse rfc2231 mailabbrev gmm-utils mailheader sendmail
rfc2047 rfc2045 ietf-drums mm-util help-fns help-mode easymenu
cl-loaddefs pcase cl-lib mail-prsvr mail-utils time-date mule-util
tooltip eldoc electric uniquify ediff-hook vc-hooks lisp-float-type
mwheel x-win term/common-win x-dnd tool-bar dnd fontset image regexp-opt
fringe tabulated-list newcomment elisp-mode lisp-mode prog-mode register
page menu-bar rfn-eshadow timer select scroll-bar mouse jit-lock
font-lock syntax facemenu font-core frame cl-generic cham georgian
utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao korean
japanese eucjp-ms cp51932 hebrew greek romanian slovak czech european
ethiopic indian cyrillic chinese charscript case-table epa-hook
jka-cmpr-hook help simple abbrev minibuffer cl-preloaded nadvice
loaddefs button faces cus-face macroexp files text-properties overlay
sha1 md5 base64 format env code-pages mule custom widget
hashtable-print-readable backquote dbusbind inotify dynamic-setting
system-font-setting font-render-setting move-toolbar gtk x-toolkit x
multi-tty make-network-process emacs)

Memory information:
((conses 16 86871 5800)
 (symbols 48 19952 0)
 (miscs 40 46 96)
 (strings 32 14532 4936)
 (string-bytes 1 432130)
 (vectors 16 11866)
 (vector-slots 8 438242 4685)
 (floats 8 166 6)
 (intervals 56 196 0)
 (buffers 976 18))