Crash on TextCore::Generate_3X3AAEDT when changing the Font Asset of a TMPro GameObject to a corrupted Font Asset

How to reproduce:

1. Open the attached “IN-145819“ project
2. Open the “Scene“ Scene
3. In the Hierarchy, expand the “Canvas“ GameObject
4. In the Hierarchy, select the “test“ TextMeshPro GameObject
5. In the Inspector, locate the TextMeshPro - Text(UI) Component and open the Object Picker window of the Font Asset parameter (under Main Settings)
6. In the Object Picker window, click “TestFont”
7. Observe the Crash

Reproducible with: 6000.0.0f1, 6000.0.79f1, 6000.3.20f1, 6000.5.4f1, 6000.6.0b4, 6000.7.0a2

Reproducible on: Windows 10 (by user), Windows 11
Not reproducible on: No other environments tested

Notes:

• If the Font Asset was previously not corrupted and was used in a Scene, opening the Scene crashes the Editor
• No error messages about the Font are thrown when assigning it to the “test“ GameObject

First few lines of the stack trace:
0x00007FF82347B822 (Unity) TextCore::Generate_3X3AAEDT
0x00007FF82349857D (Unity) TextCore::TryAddGlyphToTextureSingleThread
0x00007FF8234986F2 (Unity) TextCore::TryAddGlyphToTexture_Impl
0x00007FF82349801A (Unity) TextCore::FontEngine::TryAddGlyphToTexture
0x00007FF8234633AC (Unity) FontEngine_CUSTOM_TryAddGlyphToTexture_FontFaceHandle_Internal