bug#73022: 31.0.50; Crash in build_frame_matrix_from_leaf_window after C-x 2 and reducing terminal size

I get this on Emacs 30.2 and 29.3 too.

From emacs -Q:

1. emacs -Q -nw
2. C-x 2
3. Shrink the terminal window to 5 lines or fewer.
4. Enlarge it again.  -> abort

It aborts while enlarging, not while shrinking.  C-x 3 alone doesn't
do it.

> Here I can never crash a build that doesn't check assertions.  Can you?

Yes.  I ran into this first with the stock Ubuntu 29.3 and 30.2
packages, which are plain release builds.

From a build configured with --without-x --enable-checking=yes,glyphs
CFLAGS='-O0 -g3':

  (gdb) p tty->Wcm->cm_curX       $1 = 120
  (gdb) p tty->Wcm->cm_curY       $2 = 4
  (gdb) p tty->Wcm->cm_cols       $3 = 120
  (gdb) p tty->Wcm->cm_rows       $4 = 5
  (gdb) p tty->Wcm->cm_magicwrap  $5 = true
  (gdb) p XFRAME (tty->top_frame)->text_lines   $7 = 5
  (gdb) p XFRAME (tty->top_frame)->text_cols    $8 = 120

  #0  cmcheckmagic (tty=...) at cm.c:122
  #1  tty_write_glyphs (f=..., len=120) at term.c:819
  #2  write_glyphs (f=..., len=120) at terminal.c:164
  #3  update_frame_line (f=..., vpos=4, updating_menu_p=false) at dispnew.c:5326
  #4  update_frame_1 (...) at dispnew.c:5008
  #5  update_frame (...) at dispnew.c:3346
  #6  redisplay_internal () at xdisp.c:17472
  #7  redisplay_preserve_echo_area (from_where=11) at xdisp.c:17755
  #8  wait_reading_process_output (...) at process.c:5590
  #9  sit_for (...) at dispnew.c:6335
  #10 read_char (...) at keyboard.c:2923

After C-x 2, (set-frame-height nil 1) takes the frame from 28 to 9
lines, window count stays 2, no crash.  Resizing the terminal gets it
to 5 and below.

  GNU Emacs 30.2 (also 29.3), built from the 30.2 tarball
  Ubuntu on WSL2, Windows Terminal, TERM=xterm-256color, no tmux