https://github.com/mozilla/pdf.js/issues/6397#issuecomment-164954332 Would have been a lot easier to find had there been an assertion checking that string16 didn't go out of bounds of the 16bit number.

safeString16(properties.ascent) + 
        string16(properties.italicAngle ? 2 : 0) + 
        "\x00\x11" + 
        "\x00\x00" + 
        "\x00\x00" + 
        "\x00\x00"
    ); 
    
    builder.addTable(
      "hhea",
      "\x00\x01\x00\x00" + 
        safeString16(properties.ascent) + 
        safeString16(properties.descent) + 
        "\x00\x00" + 
        "\xFF\xFF" + 
        "\x00\x00" + 
        "\x00\x00" + 
        "\x00\x00" + 
        safeString16(properties.capHeight) + 
        safeString16(Math.tan(properties.italicAngle) * properties.xHeight) + 
        "\x00\x00" + 
        "\x00\x00" + 
        "\x00\x00" + 
        "\x00\x00" + 
        "\x00\x00" + 
        "\x00\x00" + 
        string16(numGlyphs)
    ); 
    
    builder.addTable(