[subset] don't allow table adds for tag == -1.
diff --git a/src/hb-face.cc b/src/hb-face.cc
index beccf41..2386e87 100644
--- a/src/hb-face.cc
+++ b/src/hb-face.cc
@@ -752,6 +752,9 @@
 hb_bool_t
 hb_face_builder_add_table (hb_face_t *face, hb_tag_t tag, hb_blob_t *blob)
 {
+  if (tag == HB_MAP_VALUE_INVALID)
+    return false;
+
   if (unlikely (face->destroy != (hb_destroy_func_t) _hb_face_builder_data_destroy))
     return false;