https://github.com/mozilla/pdf.js/issues/6397#issuecomment-164954332 Would have been a lot easier to find had there been an assertion checking that string16 didn't go out of bounds of the 16bit number.

tables.hhea.data[10] = 0xff;
      tables.hhea.data[11] = 0xff;
    }
    
    
    const metricsOverride = {
      unitsPerEm: int16(tables.head.data[18], tables.head.data[19]),
      yMax: int16(tables.head.data[42], tables.head.data[43]),
      yMin: signedInt16(tables.head.data[38], tables.head.data[39]),
      ascent: signedInt16(tables.hhea.data[4], tables.hhea.data[5]),
      descent: signedInt16(tables.hhea.data[6], tables.hhea.data[7]),
      lineGap: signedInt16(tables.hhea.data[8], tables.hhea.data[9]),
    };
    
    this.ascent = metricsOverride.ascent / metricsOverride.unitsPerEm;
    this.descent = metricsOverride.descent / metricsOverride.unitsPerEm;
    this.lineGap = metricsOverride.lineGap / metricsOverride.unitsPerEm;
    this.lineHeight = this.ascent - this.descent + this.lineGap;
    
    if (tables.post) {
      readPostScriptTable(tables.post, properties, numGlyphs);
    }
    
    tables.post = {
      tag: "post",
      data: createPostTable(properties),
    };
    const charCodeToGlyphId = [];
    
    function hasGlyph(glyphId) {