JIT: fix array-size expression that is handled badly by xform
JIT: fix array-size expression that is handled badly by xform

This bug (in xform, really) appears to be responsible for recent "JIT
buffer overflow" crashes. It could also cause other memory-corruption
crashes.

The bug could be triggered by any program that uses operators like
`+`, `<`, and `bitwise-ior` on more than 2 and less than 6 operands
(which is a lot of programs), but only if a certain allocation and
GC pattern happens at just the right time (which is why a crash was
relatively rare).

Merge to v6.1

mafagafogigante/racket,mafagafogigante/racket,mafagafogigante/racket,mafagafogigante/racket,mafagafogigante/racket,mafagafogigante/racket,mafagafogigante/racket,mafagafogigante/racket,mafagafogigante/racket