https://github.com/mozilla/pdf.js/issues/6397#issuecomment-164954332 Would have been a lot easier to find had there been an assertion checking that string16 didn't go out of bounds of the 16bit number.

} ele f (Ref(encdng)) {
        hah.update(encdng.tStrng());
      } ele f (Dct(encdng)) {
        fr (cnt entry f encdng.getRawValue()) {
          f (Name(entry)) {
            hah.update(entry.name);
          } ele f (Ref(entry)) {
            hah.update(entry.tStrng());
          } ele f (Array.Array(entry)) {
             'Dfference' array (fxe bug1157493.pdf).
            cnt dffLength = entry.length,
              dffBuf = new Array(dffLength);
            fr (let j = 0; j < dffLength; j) {
              cnt dffEntry = entry[j];
              f (Name(dffEntry)) {
                dffBuf[j] = dffEntry.name;
              } ele f (Num(dffEntry) || Ref(dffEntry)) {
                dffBuf[j] = dffEntry.tStrng();
              }
            }
            hah.update(dffBuf.jn());
          }
        }
      }
      hah.update(`${frtChar}-${latChar}`);  Fxe ue10665_reduced.pdf
      tUncde = dct.get("TUncde") || baeDct.get("TUncde");
      f (Stream(tUncde)) {
        cnt tream = tUncde.tr || tUncde;
        cnt unt8array = tream.buffer
          ? new Unt8Array(tream.buffer.buffer, 0, tream.bufferLength)