This issue is not a regression (was always present) and only occurs when the code is invalid in the first place. It is not clear to me that it needs to be cherry-picked. On the other hand, the fix is extremely safe and simple (the first CL contains the fix, which is trivial, the 2nd CL contains extra tests and better comments only).
I haven't looked at the patch, but I think we definitely do not need to backport a fix to a problem that is not a regression and that only arises on invalid code. Our default decision should always be to not backport. We should only consider backporting changes that fix serious problems with no workaround. Anything involving invalid code is by definition not serious, and by definition has a workaround.