Crash in GC_make_disappearing_links_disappear during garbage collection

The Editor (and standalone Player) can crash inside the the garbage collector during finalization, with the top of the stack in GC_make_disappearing_links_disappear.

The crash is not tied to a single workflow. It has been observed across a variety of managed heap heavy operations (for example, repeatedly generating a TextMeshPro font atlas via the Font Asset Creator, but also in other scenarios reported through support). It reproduces intermittently during garbage collection, when disappearing links (i.e. the clearing of WeakReferences) are processed.

Expected result: Garbage collection completes without crashing
Actual result: The Editor/Player crashes inside the GC finalizer

Reproducible with: (to fill in)

Representative stack trace:

(mono-2.0-bdwgc) [external/bdwgc/finalize.c:1000] GC_make_disappearing_links_disappear
(mono-2.0-bdwgc) [external/bdwgc/finalize.c:1178] GC_finalize
(mono-2.0-bdwgc) [external/bdwgc/alloc.c:1087] GC_finish_collection
(mono-2.0-bdwgc) [external/bdwgc/alloc.c:699] GC_collect_a_little_inner
(mono-2.0-bdwgc) [external/bdwgc/malloc.c:57] GC_alloc_large
(mono-2.0-bdwgc) [external/bdwgc/malloc.c:264] GC_generic_malloc
(mono-2.0-bdwgc) [external/bdwgc/malloc.c:333] GC_malloc_kind

Notes:
The crash is intermittent and depends on the managed heap state. In the font atlas repro, higher atlas resolutions increase the reproduction rate.