Loading the attached file `bug.el' (containing the single PUA
character U+E6A3) with

  emacs -Q bug.el

causes a crash:

  xdisp.c:28955:
    Emacs fatal error:
      assertion failed:
        it->ascent >= 0 && it->descent >= 0

I've also attached the output of `bt full'.


    Werner


In GNU Emacs 27.0.50 (build 1, x86_64-pc-linux-gnu, GTK+ Version 3.20.10)
 of 2018-12-27 built on linux
Repository revision: 806ae9fc48f59751a8fce543be40ffe473f548bf
Repository branch: master
Windowing system distributor 'The X.Org Foundation', version 11.0.11803000
System Description: openSUSE Leap 42.3

Recent messages:
Loading /usr/local/share/emacs/site-lisp/cjk-enc.el (source)...done
Loading /usr/local/share/emacs/site-lisp/cjktilde.el (source)...done
Loading /usr/local/share/emacs/site-lisp/quail-reverse.el (source)...done
Loading mew...done
Loading calendar...done
For information about GNU Emacs and the GNU system, type C-h C-a.
Making completion list...
Quit
Type C-x 1 to remove help window.  

Configured using:
 'configure --with-x-toolkit=gtk --enable-checking=yes,glyphs
 --enable-check-lisp-object-type 'CFLAGS=-O0 -g3 -gdwarf-4''

Configured features:
XPM JPEG TIFF GIF PNG RSVG IMAGEMAGICK SOUND GPM DBUS GSETTINGS GLIB
NOTIFY INOTIFY GNUTLS LIBXML2 FREETYPE M17N_FLT LIBOTF XFT ZLIB
TOOLKIT_SCROLL_BARS GTK3 X11 XDBE XIM THREADS LIBSYSTEMD JSON LCMS2

Important settings:
  value of $LANG: de_AT.UTF-8
  value of $XMODIFIERS: @im=none
  locale-coding-system: utf-8-unix

Major mode: Fundamental

Minor modes in effect:
  TeX-PDF-mode: t
  tooltip-mode: t
  global-eldoc-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  buffer-read-only: t
  column-number-mode: t
  line-number-mode: t
  transient-mark-mode: t

Load-path shadows:
/usr/local/share/emacs/site-lisp/thai-word hides /usr/local/share/emacs/27.0.50/lisp/language/thai-word

Features:
(shadow pp mew-varsx mew-unix emacsbug message rmc puny dired
dired-loaddefs format-spec rfc822 mml mml-sec epa derived epg
gnus-util rmail rmail-loaddefs time-date mm-decode mm-bodies mm-encode
mail-parse rfc2231 mailabbrev gmm-utils mailheader sendmail rfc2047
rfc2045 ietf-drums mail-utils apropos elec-pair edmacro kmacro
rng-nxml rng-valid rng-loc rng-uri rng-parse nxml-parse rng-match
rng-dt rng-util rng-pttrn nxml-ns nxml-mode nxml-outln nxml-rap
nxml-util nxml-enc xmltok sgml-mode dom hideshow cal-menu calendar
cal-loaddefs mew-auth mew-config mew-imap2 mew-imap mew-nntp2 mew-nntp
mew-pop mew-smtp mew-ssl mew-ssh mew-net mew-highlight mew-sort
mew-fib mew-ext mew-refile mew-demo mew-attach mew-draft mew-message
mew-thread mew-virtual mew-summary4 mew-summary3 mew-summary2
mew-summary mew-search mew-pick mew-passwd mew-scan mew-syntax mew-bq
mew-smime mew-pgp mew-header mew-exec mew-mark mew-mime mew-edit
mew-decode mew-encode mew-cache mew-minibuf mew-complete mew-addrbook
mew-local mew-vars3 mew-vars2 mew-vars mew-env mew-mule3 mew-mule
mew-gemacs mew-key mew-func mew-blvs mew-const mew tex dbus xml crm
advice auto-loads tex-site quail help-mode cjktilde mm-util mail-prsvr
disp-table finder-inf package easymenu epg-config url-handlers
url-parse auth-source cl-seq eieio eieio-core cl-macs eieio-loaddefs
password-cache json map url-vars seq byte-opt gv bytecomp byte-compile
cconv cl-loaddefs cl-lib mule-util tooltip eldoc electric uniquify
ediff-hook vc-hooks lisp-float-type mwheel term/x-win x-win
term/common-win x-dnd tool-bar dnd fontset image regexp-opt fringe
tabulated-list replace newcomment text-mode elisp-mode lisp-mode
prog-mode register page menu-bar rfn-eshadow isearch timer select
scroll-bar mouse jit-lock font-lock syntax facemenu font-core
term/tty-colors frame cl-generic cham georgian utf-8-lang misc-lang
vietnamese tibetan thai tai-viet lao korean japanese eucjp-ms cp51932
hebrew greek romanian slovak czech european ethiopic indian cyrillic
chinese composite charscript charprop case-table epa-hook
jka-cmpr-hook help simple abbrev obarray minibuffer cl-preloaded
nadvice loaddefs button faces cus-face macroexp files text-properties
overlay sha1 md5 base64 format env code-pages mule custom widget
hashtable-print-readable backquote threads dbusbind inotify lcms2
dynamic-setting system-font-setting font-render-setting move-toolbar
gtk x-toolkit x multi-tty make-network-process emacs)

Memory information:
((conses 16 202452 4316)
 (symbols 48 30527 61)
 (strings 32 71159 885)
 (string-bytes 1 1786347)
 (vectors 16 27728)
 (vector-slots 8 678829 13622)
 (floats 8 80 76)
 (intervals 56 645 221)
 (buffers 992 13)
 (heap 1024 50769 2024))