change maybe_realloc_dense to take the high index the array must contain after resizing.
change maybe_realloc_dense to take the high index the array must contain after resizing.

There were multiple calls to maybe_realloc_dense, and some were calling it with the second
arg assumed to be the number of elements to add to the array's length, and some were calling
it with the second arg assumed to be the resulting size.  Needless to say, this caused
problems.  Fixes a longstanding invalid read/write that caused all sorts of crashes (mostly
GC-related).

toshok/echojs,carlosalberto/echo-js,carlosalberto/echo-js,carlosalberto/echo-js,toshok/echojs,toshok/echojs,toshok/echojs,carlosalberto/echo-js,toshok/echojs,toshok/echojs,toshok/echojs,carlosalberto/echo-js,toshok/echojs,carlosalberto/echo-js