> This patch appears, so far, to run without a segfault

Can you please verify that when the (unmodified) code does segfault,
the offending face ID is indeed stored in
last_escape_glyph_merged_face_id?  I'd like to be sure we have really
found the source of that face ID.