https://github.com/mozilla/pdf.js/issues/6397#issuecomment-164954332 Would have been a lot easier to find had there been an assertion checking that string16 didn't go out of bounds of the 16bit number.

}
  if (trailingRangesCount > 0) {
    endCount += "\xFF\xFF";
    startCount += "\xFF\xFF";
    idDeltas += "\x00\x01";
    idRangeOffsets += "\x00\x00";
  }
  const format314 =
    "\x00\x00" + 
    string16(2 * segCount) +
    string16(searchParams.range) +
    string16(searchParams.entry) +
    string16(searchParams.rangeShift) +
    endCount +
    "\x00\x00" +
    startCount +
    idDeltas +
    idRangeOffsets +
    glyphsIds;
  let format31012 = "";
  let header31012 = "";
  if (numTables > 1) {
    cmap +=
      "\x00\x03" + 
      "\x00\x0A" + 
      string32(4 + numTables * 8 + 4 + format314.length); 
    format31012 = "";
    for (i = 0, ii = ranges.length; i < ii; i++) {
      range = ranges[i];
      start = range[0];