When I try to create a child frame that is completely on the right of
the top frame with emacs -Q -nw, the attached file loaded and doing C-l
master crashes as follows:

Program received signal SIGSEGV, Segmentation fault.
0x0000000000549b5c in FACE_FROM_ID (f=0x0, id=0) at ../../src/frame.h:1631
1631	  eassert (0 <= id && id < FRAME_FACE_CACHE (f)->used);
(gdb) bt
#0  0x0000000000549b5c in FACE_FROM_ID (f=0x0, id=0) at ../../src/frame.h:1631
#1  0x000000000054bfa2 in tty_write_glyphs (f=0x35852d30, string=0x7f8e1f63b2c0, len=81) at ../../src/term.c:793
#2  0x000000000055759b in write_glyphs (f=0x35852d30, string=0x7f8e1f63a140, len=81) at ../../src/terminal.c:182
#3  0x000000000042c9b4 in write_row (f=0x35852d30, vpos=10, updating_menu_p=false) at ../../src/dispnew.c:5935
#4  0x000000000042beae in write_matrix (f=0x35852d30, inhibit_id_p=false, updating_menu_p=false) at ../../src/dispnew.c:5716
#5  0x00000000004276ed in combine_updates_for_frame (f=0x35852d30, inhibit_scrolling=false) at ../../src/dispnew.c:4019
#6  0x0000000000427a29 in combine_updates (roots=XIL(0x7f8e1efff303)) at ../../src/dispnew.c:4068
#7  0x000000000048320f in redisplay_internal () at ../../src/xdisp.c:17613
#8  0x0000000000480ac4 in redisplay () at ../../src/xdisp.c:16670
#9  0x00000000005f6ae1 in read_char (commandflag=1, map=XIL(0x7f8e1f000183), prev_event=XIL(0), used_mouse_menu=0x7ffdae903a0f, end_time=0x0) at ../../src/keyboard.c:2672
#10 0x000000000060ab40 in read_key_sequence (keybuf=0x7ffdae903bc0, prompt=XIL(0), dont_downcase_last=false, can_return_switch_frame=true, fix_current_buffer=true, prevent_redisplay=false, disable_text_conversion_p=false) at ../../src/keyboard.c:10757
#11 0x00000000005f2e62 in command_loop_1 () at ../../src/keyboard.c:1424
#12 0x00000000006d012d in internal_condition_case (bfun=0x5f2a33 <command_loop_1>, handlers=XIL(0x90), hfun=0x5f1eb5 <cmd_error>) at ../../src/eval.c:1602
#13 0x00000000005f25fa in command_loop_2 (handlers=XIL(0x90)) at ../../src/keyboard.c:1163
#14 0x00000000006cf597 in internal_catch (tag=XIL(0x123f0), func=0x5f25d0 <command_loop_2>, arg=XIL(0x90)) at ../../src/eval.c:1282
#15 0x00000000005f258c in command_loop () at ../../src/keyboard.c:1141
#16 0x00000000005f1957 in recursive_edit_1 () at ../../src/keyboard.c:749
#17 0x00000000005f1b83 in Frecursive_edit () at ../../src/keyboard.c:832
#18 0x00000000005ed365 in main (argc=5, argv=0x7ffdae9041f8) at ../../src/emacs.c:2562

Lisp Backtrace:
"redisplay_internal (C function)" (0x0)

martin

In GNU Emacs 31.0.50 (build 61, x86_64-pc-linux-gnu, GTK+ Version
  3.24.38, cairo version 1.16.0) of 2025-02-26 built on restno
Repository revision: 5815bd52279fdedc752f9f92ace86f8243fbd604
Repository branch: master
Windowing system distributor 'The X.Org Foundation', version 11.0.12101007
System Description: Debian GNU/Linux 12 (bookworm)

Configured using:
  'configure --with-gif=ifavailable --with-tiff=ifavailable
  --with-gnutls=no --without-pop --enable-checking=yes,glyphs,structs
  --enable-check-lisp-object-type=yes 'CFLAGS=-O0 -g3 -no-pie
  -Wno-missing-braces''

Configured features:
CAIRO DBUS FREETYPE GIF GLIB GSETTINGS HARFBUZZ JPEG LIBSELINUX MODULES
NOTIFY INOTIFY PDUMPER PNG RSVG SECCOMP SOUND THREADS TIFF
TOOLKIT_SCROLL_BARS WEBP X11 XDBE XIM XINERAMA XINPUT2 XPM XRANDR GTK3
ZLIB

Important settings:
   value of $LANG: de_AT.UTF-8
   value of $XMODIFIERS: @im=ibus
   locale-coding-system: utf-8-unix

Major mode: Lisp Interaction

Minor modes in effect:
   tooltip-mode: t
   global-eldoc-mode: t
   eldoc-mode: t
   show-paren-mode: t
   electric-indent-mode: t
   mouse-wheel-mode: t
   tool-bar-mode: t
   menu-bar-mode: t
   file-name-shadow-mode: t
   global-font-lock-mode: t
   font-lock-mode: t
   blink-cursor-mode: t
   minibuffer-regexp-mode: t
   line-number-mode: t
   indent-tabs-mode: t
   transient-mark-mode: t
   auto-composition-mode: t
   auto-encryption-mode: t
   auto-compression-mode: t

Load-path shadows:
None found.

Features:
(shadow sort mail-extr emacsbug lisp-mnt message mailcap yank-media puny
dired dired-loaddefs rfc822 mml mml-sec password-cache epa derived epg
rfc6068 epg-config gnus-util text-property-search time-date subr-x
mm-decode mm-bodies mm-encode mail-parse rfc2231 mailabbrev gmm-utils
mailheader cl-loaddefs cl-lib sendmail rfc2047 rfc2045 ietf-drums
mm-util mail-prsvr mail-utils rmc iso-transl tooltip cconv eldoc paren
electric uniquify ediff-hook vc-hooks lisp-float-type elisp-mode mwheel
term/x-win x-win term/common-win x-dnd touch-screen tool-bar dnd fontset
image regexp-opt fringe tabulated-list replace newcomment text-mode
lisp-mode prog-mode register page tab-bar menu-bar rfn-eshadow isearch
easymenu timer select scroll-bar mouse jit-lock font-lock syntax
font-core term/tty-colors frame minibuffer nadvice seq simple cl-generic
indonesian philippine cham georgian utf-8-lang misc-lang vietnamese
tibetan thai tai-viet lao korean japanese eucjp-ms cp51932 hebrew greek
romanian slovak czech european ethiopic indian cyrillic chinese
composite emoji-zwj charscript charprop case-table epa-hook
jka-cmpr-hook help abbrev obarray oclosure cl-preloaded button loaddefs
theme-loaddefs faces cus-face macroexp files window text-properties
overlay sha1 md5 base64 format env code-pages mule custom widget keymap
hashtable-print-readable backquote threads dbusbind inotify
dynamic-setting system-font-setting font-render-setting cairo gtk
x-toolkit xinput2 x multi-tty move-toolbar make-network-process
tty-child-frames emacs)

Memory information:
((conses 16 40341 9445) (symbols 48 5445 0) (strings 32 13146 2478)
  (string-bytes 1 321308) (vectors 16 9699)
  (vector-slots 8 116264 4423) (floats 8 21 3) (intervals 56 243 0)
  (buffers 984 10))