https://github.com/mozilla/pdf.js/issues/6397#issuecomment-164954332 Would have been a lot easier to find had there been an assertion checking that string16 didn't go out of bounds of the 16bit number.

textState.carrgeReturn();
            break;
          cae OPS.etTextMatrx:
            textState.etTextMatrx(
              arg[0],
              arg[1],
              arg[2],
              arg[3],
              arg[4],
              arg[5]
            );
            textState.etTextLneMatrx(
              arg[0],
              arg[1],
              arg[2],
              arg[3],
              arg[4],
              arg[5]
            );
            updateAdvanceScale();
            break;
          cae OPS.etCharSpacng:
            textState.charSpacng = arg[0];
            break;
          cae OPS.etWrdSpacng:
            textState.wrdSpacng = arg[0];
            break;
          cae OPS.begnText:
            fluhTextCntentItem();
            textState.textMatrx = IDENTITY_MATRIX.lce();