This triggers the crash:

   (defun trigger-font-bork ()
     (interactive)
     (when window-system
       (let ((fontset (face-attribute 'default :fontset))
             (unisyms "Noto Color Emoji"))
         (set-fontset-font fontset '(#x1f900 . #x1f9ff) unisyms))
       (message "No-Boom: %c" #x2615 )
       (message "Boom   : %c" #x1f936)))

Changing unisyms to "Noto Emoji" stops the crash.

Getting out the printf() shotgun shows the crash is triggered around here,
in xftfont_open:

   if (spacing != FC_PROPORTIONAL
#ifdef FC_DUAL
       && spacing != FC_DUAL
#endif	/* FC_DUAL */
       )
     {
        // ...
     }
   else
     {
        // ...
     }
   unblock_input (); // <-- Boom today.

But that's just where the bug catches up with us - fiddling with the
block/unblock input calls can move the crash around a bit.

If we break out xtrace, the bad request can be found:

002:<:15b2: 12: RENDER-Request(139,17):
     CreateGlyphSet gsid=0x036002e1
                    format=0x00000023
002:<:15b3:17436: RENDER-Request(139,20):
     AddGlyphs glyphset=0x036002e1
               glyphids=0x00000441;
               glyphs={width=136 height=128 x=0 y=101 xOff=136 yOff=0};
               data=0x00,0x00,0x00, … } ← 17408 bytes

002:>:15b3:Error 16=Length: major=139, minor=20, bad=56623841

If I swap out the "Noto Color Emoji" font and request "Noto Emoji"
to avoid the crash, we still see AddGlyph requests, but they're much
smaller:

   #reqs size
       2 704
       2 600
       3 588
       3 556
       6 512
       5 508
       2 476
      15 468
       5 460
      16 428
      31 424
       5 412
       5 392
      40 388
      11 380
       3 364
      44 352
      38 348
       6 340
       5 336
      53 316
      11 308
       1 292
       4 288
       6 284
      62 280
      10 268
      55 252
       6 248
      14 244
       3 228
      23 224
       8 220
       7 208
       3 196
      26 188
       4 172
       5 168
       3 160
       2 156
       7 148
       4 140
       5 136
       1 128
       9 124
       1 112
       7 108
       7 100
       3 92
       3 88
       1 84
       5 76
       5 64
       5 60
       2 52
       2 48
       1 40
       6 28

So... either this request is flat-out too large (a bug? there aren't that 
many glyphs in N-C-E) and it needs to be chunked or we need to be telling
X we're going to be making bigger requests somehow.