https://github.com/mozilla/pdf.js/issues/6397#issuecomment-164954332 Would have been a lot easier to find had there been an assertion checking that string16 didn't go out of bounds of the 16bit number.

for (let ii = data.length; i < ii; ) {
        const op = data[i++];
        
        
        if (op === 0x40) {
          
          n = data[i++];
          if (inFDEF || inELSE) {
            i += n;
          } else {
            for (j = 0; j < n; j++) {
              stack.push(data[i++]);
            }
          }
        } else if (op === 0x41) {
          
          n = data[i++];
          if (inFDEF || inELSE) {
            i += n * 2;
          } else {
            for (j = 0; j < n; j++) {
              b = data[i++];
              stack.push((b << 8) | data[i++]);
            }
          }
        } else if ((op & 0xf8) === 0xb0) {
          
          n = op - 0xb0 + 1;
          if (inFDEF || inELSE) {
            i += n;