It seems we already did this check a few lines above, and indeed we did,
but on very broken documents, if arr[1] is a Ref, getting objects may
end up in a reconstruct xref call which may end up changing the type of
arr[1] the next time we ask for it

oss-fuzz/29260