https://github.com/mozilla/pdf.js/issues/6397#issuecomment-164954332 Would have been a lot easier to find had there been an assertion checking that string16 didn't go out of bounds of the 16bit number.

const unitsPerEm =
    override.unitsPerEm ||
    1 / (properties.fontMatrix || FONT_IDENTITY_MATRIX)[0];
  
  
  const scale = properties.ascentScaled
    ? 1.0
    : unitsPerEm / PDF_GLYPH_SPACE_UNITS;
  const typoAscent =
    override.ascent || Math.round(scale * (properties.ascent || bbox[3]));
  let typoDescent =
    override.descent || Math.round(scale * (properties.descent || bbox[1]));
  if (typoDescent > 0 && properties.descent > 0 && bbox[1] < 0) {
    typoDescent = -typoDescent; 
  }
  const winAscent = override.yMax || typoAscent;
  const winDescent = -override.yMin || -typoDescent;
  return (
    "\x00\x03" + 
    "\x02\x24" + 
    "\x01\xF4" + 
    "\x00\x05" + 
    "\x00\x00" + 
    "\x02\x8A" + 
    "\x02\xBB" + 
    "\x00\x00" + 
    "\x00\x8C" + 
    "\x02\x8A" + 
    "\x02\xBB" + 
    "\x00\x00" +