Currently revert_to() will try to look up the TrieLog for each block as it walks backwards. It uses this to undo state.
However, I believe it is silently returning an empty Vec when there is no TrieLog stored for the requested block. From here, it fails to replay those changes and silently moves on, leaving it in an inconsistent state.
It should instead fail hard. An additional sanity check would be to make sure the requested blocks fits within the configured max trie logs setting.