bug#39892: 28.0.50; Crash when running async command

[Eli Zaretskii]

> From: Robert Pluim <rpluim@gmail.com>
> Date: Wed, 04 Mar 2020 11:01:57 +0100
> Cc: 39892@debbugs.gnu.org
> 
>     Ravine> * Start 'emacs -Q'
> 
>     Ravine> * Eval this: (set-fontset-font t 'unicode "Noto Sans Symbols2" 
> nil 'append)
> 
>     Ravine> * In dired, run dired-do-async-shell-command (&) on 
> configure.gz.gpg and
>     Ravine>   give 'gpg -d'. gpg now sends the decrypted output to stdout.
> 
>     Ravine> * At this point emacs crashes.
> 
> Indeed. A simpler recipe is to do the set-fontset-font and then
> 
> 'C-x 8 RET e9f8'

In fact, _any_ font seems to cause that, as long as the other
arguments of set-fontset-font are as above.

> The relevant code is:
> 
>   for (i = 0; i < size; i++)
>     {
>       Lisp_Object rfont_def = AREF (vec, i);
>       Lisp_Object font_def = RFONT_DEF_FONT_DEF (rfont_def);
> 
> 'vec' at that point is
> 
> [
> [nil [#<font-spec nil nil nil nil iso10646-1 nil nil nil nil nil nil nil nil> 
> 144 nil] nil 0]
> nil
> [nil [#<font-spec nil nil Noto\ Sans\ Symbols2 nil nil nil nil nil nil nil 
> nil nil ((:name . "Noto Sans Symbols2"))> 0 0] nil 2]
> ]
> 
> and i == 1, so rfont_def ends up as nil.
> 
> How did that 'nil' get in there?

I don't know.  The code seems to expect one nil as the last element of
the vector, but not in the middle.  Note that the commentary at the
beginning of fontset.c explains when RFONT_DEF may be nil.

I will look into this soon if no one beats me to it.

Btw, U+E9F8 is a PUA character; how did it get into a context where we
are trying to display it?