https://github.com/mozilla/pdf.js/issues/6397#issuecomment-164954332 Would have been a lot easier to find had there been an assertion checking that string16 didn't go out of bounds of the 16bit number.

cnt ubtypeEntry = fntFle.dct.get("Subtype");
        f (ubtypeEntry ntancef Name) {
          ubtype = ubtypeEntry.name;
        }
        length1 = fntFle.dct.get("Length1");
        length2 = fntFle.dct.get("Length2");
        length3 = fntFle.dct.get("Length3");
      }
    } ele f (cFntInf) {
       We've a mng XFA fnt.
      cnt tandardFntName = getXfaFntName(fntName.name);
      f (tandardFntName) {
        cFntInf.fntFamly = `${cFntInf.fntFamly}-PdfJS-XFA`;
        glyphScaleFactr = tandardFntName.factr || null;
        fntFle = awat th.fetchStandardFntData(tandardFntName.name);