bug#48732: 28.0.50; lisp_string_width segfaults on startup under macOS

[Naofumi Yasufuku]

After changes for auto-composition aware string-width (*),
emacs segfaults frequently on startup under macOS.

gdb 'bt full’ is attached:
  emacs_crash-lisp_string_width-gdb_bt_full.txt
  emacs_crash-lisp_string_width-macOS_report.txt

On my machine, crash occurrence frequency can be increased with
attached init.el.  Unfortunately, I cannot reproduce the crash with
`--enable-checking='yes,glyphs' --enable-check-lisp-object-type`
configure options.

Sometimes emacs starts without crash, but font setting is corrupted
like the attached screenshot: after-lisp_string_width-autocmp.png

Regards,
—Naofumi

(*)
--------------------------------------------------------------------------------
commit 85da7b57bc204c4cc6953156c1a9a4dc6e875541
Author: Eli Zaretskii <eliz@gnu.org>
Date:   Wed May 26 20:08:47 2021 +0300

    Make 'string-width' auto-composition aware

    * src/composite.c (find_automatic_composition): Now extern.
    (char_composable_p): Don't assume 'unicode-category-table' is
    always available.
    * src/composite.h (find_automatic_composition): Add prototype.
    * src/character.c (lisp_string_width): Support automatic
    compositions; call 'find_automatic_composition' when
    'auto-composition-mode' is ON.
--------------------------------------------------------------------------------

(gdb) bt
#0  0x000000010028e955 in SYMBOL_NAME (sym=0x104621ba0) at ./lisp.h:2208
#1  0x000000010028e42d in font_style_to_value (prop=FONT_WIDTH_INDEX,
    val=0x104621ba0, noerror=true) at font.c:366
#2  0x00000001002976de in font_select_entity (f=0x10433f230,
    entities=0x1048cb913, attrs=0x103778800, pixel_size=12, c=-1)
    at font.c:3159
#3  0x00000001002971b9 in font_find_for_lface (f=0x10433f230,
    attrs=0x103778800, spec=0x10422c7ed, c=-1) at font.c:3302
#4  0x000000010033905e in fontset_find_font (fontset=0x104419835, c=1603,
    face=0x103778800, charset_id=-1, fallback=false) at fontset.c:660
#5  0x0000000100331c94 in fontset_font (fontset=0x10493a08d, c=1603,
    face=0x103778800, id=-1) at fontset.c:782
#6  0x000000010033228d in font_for_char (face=0x103778800, c=1603, pos=308,
    object=0x1033e79c4) at fontset.c:1063
#7  0x0000000100299d4f in font_range (pos=309, pos_byte=336,
    limit=0x7ffeefbf1310, w=0x104342e20, face=0x103778800, string=0x1033e79c4)
    at font.c:3883
#8  0x0000000100324fce in autocmp_chars (rule=0x105f2311d, charpos=308,
    bytepos=334, limit=312, win=0x104342e20, face=0x0, string=0x1033e79c4,
    direction=0x0) at composite.c:923
#9  0x0000000100325f1d in find_automatic_composition (pos=308, limit=308,
    start=0x7ffeefbf15a8, end=0x7ffeefbf15a0, gstring=0x7ffeefbf15b8,
    string=0x1033e79c4) at composite.c:1612
#10 0x00000001001248c8 in lisp_string_width (string=0x1033e79c4, from=0,
    to=479, precision=-1, nchars=0x7ffeefbf1a28, nbytes=0x7ffeefbf1a20)
    at character.c:375
#11 0x00000001002514db in styled_format (nargs=2, args=0x7ffeefbf74c0,
    message=false) at editfns.c:3392
#12 0x000000010024f48f in Fformat (nargs=2, args=0x7ffeefbf74c0)
    at editfns.c:3061
#13 0x000000010026b23b in call3 (fn=0x100420bf5, arg1=0x1000000000,
    arg2=0x7ffeefbf73f0, arg3=0x10026ec04 <xcdr_addr+20>) at eval.c:2912
#14 0x00000037c0001000 in ?? ()
#15 0x0000003700007170 in ?? ()
#16 0x00007fff80898338 in ?? ()
#17 0x0001003700000037 in ?? ()
#18 0x00007ffe0000005d in ?? ()
#19 0x00007ffeefbf751c in ?? ()
#20 0x0000000000007170 in ?? ()
#21 0x0000000000000000 in ?? ()
(gdb) 
--------------------------------------------------------------------------------

emacs_crash-lisp_string_width-gdb_bt_full.txt
Description: Text document

emacs_crash-lisp_string_width-macOS_report.txt
Description: Text document

init.el
Description: Binary data

--------------------------------------------------------------------------------

In GNU Emacs 28.0.50 (build 4, x86_64-apple-darwin20.5.0, NS appkit-2022.50 
Version 11.4 (Build 20F71))
of 2021-05-30 built on hyperion.local
Repository revision: 4d4c73da5a0aa4233b1dcdcf7db068fc79db6513
Repository branch: master
Windowing system distributor 'Apple', version 10.3.2022
System Description:  macOS 11.4

Configured using:
'configure 'CFLAGS=-O0 -g3''

Configured features:
ACL DBUS GIF GLIB GMP GNUTLS JPEG JSON LCMS2 LIBXML2 MODULES NOTIFY
KQUEUE NS PDUMPER PNG RSVG THREADS TIFF TOOLKIT_SCROLL_BARS XIM ZLIB

Important settings:
  value of $LANG: ja_JP.UTF-8
  locale-coding-system: utf-8-unix

Major mode: Fundamental

Minor modes in effect:
  shell-dirtrack-mode: t
  tooltip-mode: t
  global-eldoc-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  buffer-read-only: t
  line-number-mode: t
  transient-mark-mode: t

Load-path shadows:
/Users/naofumi/.emacs.d/elpa/transient-20210525.1141/transient hides 
/Users/naofumi/_git/git.sv.gnu.org/emacs/lisp/transient

Features:
(shadow sort mail-extr emacsbug message rmc puny dired dired-loaddefs
rfc822 mml mml-sec epa derived epg epg-config gnus-util rmail
rmail-loaddefs text-property-search mm-decode mm-bodies mm-encode
mail-parse rfc2231 mailabbrev gmm-utils mailheader sendmail rfc2047
rfc2045 ietf-drums mm-util mail-prsvr mail-utils ccc tramp
tramp-loaddefs trampver tramp-integration files-x tramp-compat shell
pcomplete comint ansi-color ring parse-time iso8601 time-date ls-lisp
format-spec advice edmacro kmacro slime-autoloads info package
browse-url url url-proxy url-privacy url-expand url-methods url-history
url-cookie url-domsuf url-util mailcap url-handlers url-parse
auth-source cl-seq eieio eieio-core cl-macs eieio-loaddefs
password-cache json subr-x map url-vars seq byte-opt gv bytecomp
byte-compile cconv cl-loaddefs cl-lib japan-util iso-transl tooltip
eldoc electric uniquify ediff-hook vc-hooks lisp-float-type mwheel
term/ns-win ns-win ucs-normalize mule-util term/common-win tool-bar dnd
fontset image regexp-opt fringe tabulated-list replace newcomment
text-mode elisp-mode lisp-mode prog-mode register page tab-bar menu-bar
rfn-eshadow isearch easymenu timer select scroll-bar mouse jit-lock
font-lock syntax font-core term/tty-colors frame minibuffer cl-generic
cham georgian utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao
korean japanese eucjp-ms cp51932 hebrew greek romanian slovak czech
european ethiopic indian cyrillic chinese composite charscript charprop
case-table epa-hook jka-cmpr-hook help simple abbrev obarray
cl-preloaded nadvice button loaddefs faces cus-face macroexp files
window text-properties overlay sha1 md5 base64 format env code-pages
mule custom widget hashtable-print-readable backquote threads dbusbind
kqueue cocoa ns lcms2 multi-tty make-network-process emacs)

Memory information:
((conses 16 102680 5259)
(symbols 48 11172 1)
(strings 32 36392 1490)
(string-bytes 1 1368236)
(vectors 16 21653)
(vector-slots 8 343327 9248)
(floats 8 36 13)
(intervals 56 340 0)
(buffers 992 11))

--------------------------------------------------------------------------------