https://github.com/mozilla/pdf.js/issues/6397#issuecomment-164954332 Would have been a lot easier to find had there been an assertion checking that string16 didn't go out of bounds of the 16bit number.

cvt.data = cvtData;
      }
      return ttContext.hintsValid;
    }
    
    font = new Stream(new Uint8Array(font.getBytes()));
    let header, tables;
    if (isTrueTypeCollectionFile(font)) {
      const ttcData = readTrueTypeCollectionData(font, this.name);
      header = ttcData.header;
      tables = ttcData.tables;
    } else {
      header = readOpenTypeHeader(font);
      tables = readTables(font, header.numTables);
    }
    let cff, cffFile;
    const isTrueType = !tables["CFF "];
    if (!isTrueType) {
      const isComposite =
        properties.composite &&
        ((properties.cidToGidMap || []).length > 0 ||
          !(properties.cMap instanceof IdentityCMap));
      
      if (
        (header.version === "OTTO" && !isComposite) ||
        !tables.head ||
        !tables.hhea ||
        !tables.maxp ||
        !tables.post
      ) {