[subset] bail if region_map is in error.

Fixes fuzzer case https://oss-fuzz.com/testcase-detail/5499162606043136.

src/hb-ot-layout-common.hh

@@ -2788,6 +2788,7 @@ struct VariationStore
     hb_inc_bimap_t region_map;
     for (unsigned int i = 0; i < inner_maps.length; i++)
       (src+src->dataSets[i]).collect_region_refs (region_map, inner_maps[i]);
+    if (region_map.in_error()) return_trace (false);
     region_map.sort ();
 
     if (unlikely (!regions.serialize_serialize (c, &(src+src->regions), region_map)))