Fix crashes when restoring sub-char-tables from desktop file

 src/lread.c (substitute_object_recurse): For sub-char-tables, start
 the recursive SUBSTITUTE loop from index of 2, to skip the
 non-Lisp members of the sub-char-table.  See the discussion at
 http://lists.gnu.org/archive/html/emacs-devel/2015-03/msg00520.html
 for the details.

src/ChangeLog

 2015-03-27  Eli Zaretskii  <eliz@gnu.org>
 
+	* lread.c (substitute_object_recurse): For sub-char-tables, start
+	the recursive SUBSTITUTE loop from index of 2, to skip the
+	non-Lisp members of the sub-char-table.  See the discussion at
+	http://lists.gnu.org/archive/html/emacs-devel/2015-03/msg00520.html
+	for the details.
+
 	Support non-blocking connect on MS-Windows.
 	Based on ideas from Kim F. Storm <storm@cua.dk>, see
 	http://lists.gnu.org/archive/html/emacs-devel/2006-12/msg00873.html.

src/lread.c

@@ -3280,7 +3280,7 @@ substitute_object_recurse (Lisp_Object object, Lisp_Object placeholder, Lisp_Obj
     {
     case Lisp_Vectorlike:
       {
-	ptrdiff_t i, length = 0;
+	ptrdiff_t i = 0, length = 0;
 	if (BOOL_VECTOR_P (subtree))
 	  return subtree;		/* No sub-objects anyway.  */
 	else if (CHAR_TABLE_P (subtree) || SUB_CHAR_TABLE_P (subtree)
@@ -3295,7 +3295,9 @@ substitute_object_recurse (Lisp_Object object, Lisp_Object placeholder, Lisp_Obj
 	     behavior.  */
 	  wrong_type_argument (Qsequencep, subtree);
 
-	for (i = 0; i < length; i++)
+	if (SUB_CHAR_TABLE_P (subtree))
+	  i = 2;
+	for ( ; i < length; i++)
 	  SUBSTITUTE (AREF (subtree, i),
 		      ASET (subtree, i, true_value));
 	return subtree;