Crash in merge faces

[Lennart Borgman]

I tried to merge in a background face during font-lock, like below,
but got a crash/loop/hang:

          (with-silent-modifications
            (while (and (> 200 (setq n (1+ n)))
                        (not (eobp)))
              (setq old-face (get-text-property beg 'face))
              (setq end (or (next-single-property-change (point) 'face)
                            (point-max)))
              (if (listp old-face)
                  (setq new-face (cons bg-face old-face))
                (setq new-face (list bg-face old-face)))
              (put-text-property beg end 'face new-face)
              (goto-char end)
              (setq beg (point)))

First it looped, then it stopped and finally it crashed. Before that I
got to see a bt with line 2784 in xfaces.c over and over again:

          if (! NILP (next))
            ok = merge_face_ref (f, next, to, err_msgs, named_merge_points);

(defun reb-font-lock-error-marker (limit)
  (when (eq limit (point-max))
    (save-restriction
      (widen)
      (with-silent-modifications
        (dolist (rec reb-read-error-positions)
          (let ((beg (car rec))
                (end (cdr rec)))
            (put-text-property beg end 'face 'font-lock-warning-face)))))))


Am I doing something very wrong or is this a bug?

(This is with my patched build from 2010-05-31. I have no patches that
I believe can influence faces.)