Application crashes when input field is cleaned or text is added.

Reproduction steps:
1. Open the attached project.
2. Build and run the "Scenes > Test" scene.
3. Select the input field.
4. Clean or edit the text.
- Application crashes:

IL2CPP mobile:
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=2, address=0x16fc1fff0)
* frame #0: 0x0000000100117454 unitydev`NullCheck(this_ptr=<unavailable>) at il2cpp-codegen.h:734
frame #1: 0x0000000100557234 unitydev`::Object_IsNativeObjectAlive_m434626365(__this=0x0000000000000000, ___o0=0x0000000106f1aee0, method=0x0000000000000000) at Bulk_UnityEngine_1.cpp:9437
frame #2: 0x0000000100557054 unitydev`::Object_CompareBaseObjects_m2625210252(__this=0x0000000000000000, ___lhs0=0x0000000106f1aee0, ___rhs1=0x0000000000000000, method=0x0000000000000000) at Bulk_UnityEngine_1.cpp:9395
frame #3: 0x0000000100546a48 unitydev`::Object_op_Equality_m3964590952(__this=0x0000000000000000, ___x0=0x0000000106f1aee0, ___y1=0x0000000000000000, method=0x0000000000000000) at Bulk_UnityEngine_1.cpp:9574
frame #4: 0x0000000100175590 unitydev`::TMP_FontUtilities_SearchForGlyph_m2182989533(__this=0x0000000000000000, ___font0=0x0000000106f1aee0, ___character1=69, ___glyph2=0x000000016fd18f70, method=0x0000000000000000) at Bulk_Assembly-CSharp_1.cpp:42567
frame #5: 0x0000000100175870 unitydev`::TMP_FontUtilities_SearchForGlyph_m2182989533(__this=0x0000000000000000, ___font0=0x0000000106f1ae00, ___character1=69, ___glyph2=0x000000016fd18f70, method=0x0000000000000000) at Bulk_Assembly-CSharp_1.cpp:42669
frame #6: 0x0000000100175870 unitydev`::TMP_FontUtilities_SearchForGlyph_m2182989533(__this=0x0000000000000000, ___font0=0x0000000106f1aee0, ___character1=69, ___glyph2=0x000000016fd18f70, method=0x0000000000000000) at Bulk_Assembly-CSharp_1.cpp:42669
frame #7: 0x0000000100175870 unitydev`::TMP_FontUtilities_SearchForGlyph_m2182989533(__this=0x0000000000000000, ___font0=0x0000000106f1ae00, ___character1=69, ___glyph2=0x000000016fd18f70, method=0x0000000000000000) at Bulk_Assembly-CSharp_1.cpp:42669

Mono2x mobile:
Attached in the edit ("lldb-rpc-server_2017-06-01-122459-iMac")

macOS Standalone:
Empty stack

Reproduced with:
5.3.8f2, 5.6.1p2
iOS, Android, macOS standalone
Mono2x, IL2CPP