NullReferenceException for large amount of splice

[OneFirefly]

Jint version: 3.0.0-beta-1828

Here is my C# code:

var engine = new Engine();
var parser = new JavaScriptParser(code);
var script = parser.ParseScript();
engine.Execute(script); //<--- NullReferenceException

Here is the js code I used:

let arr = [];
for (let i = 0; i < 10000; i++) arr.push(i);
for (let i=0;i<10000;i++) arr.splice(0, 1);

What happens?
I get a NullReferenceException in the line engine.Execute(script);

Here is the full stack trace from Visual Studio

 	Jint.dll!Jint.Native.Array.ArrayInstance.EnsureCapacity(uint capacity)	Unknown
 	Jint.dll!Jint.Native.Array.ArrayOperations.ArrayInstanceOperations.EnsureCapacity(ulong capacity)	Unknown
 	Jint.dll!Jint.Native.Array.ArrayPrototype.Splice(Jint.Native.JsValue thisObj, Jint.Native.JsValue[] arguments)	Unknown
 	Jint.dll!Jint.Runtime.Interop.ClrFunctionInstance.Call(Jint.Native.JsValue thisObject, Jint.Native.JsValue[] arguments)	Unknown
 	Jint.dll!Jint.Runtime.Interpreter.Expressions.JintCallExpression.EvaluateInternal()	Unknown
 	Jint.dll!Jint.Runtime.Interpreter.Expressions.JintExpression.Evaluate()	Unknown
 	Jint.dll!Jint.Runtime.Interpreter.Expressions.JintExpression.GetValue()	Unknown
 	Jint.dll!Jint.Runtime.Interpreter.Statements.JintExpressionStatement.ExecuteInternal()	Unknown
 	Jint.dll!Jint.Runtime.Interpreter.Statements.JintForStatement.ForBodyEvaluation()	Unknown
 	Jint.dll!Jint.Runtime.Interpreter.Statements.JintForStatement.ExecuteInternal()	Unknown
 	Jint.dll!Jint.Runtime.Interpreter.JintStatementList.Execute()	Unknown
 	Jint.dll!Jint.Engine.Execute(Esprima.Ast.Script program)	Unknown
>	jint playground.dll!jint_playground.Program.Main(string[] args) Line 40	C#

Note:
This only happens with large arrays (if I enter 1000 instead of 10000 it doesn't happen)
In case you can't reproduce the bug try adding a 0 to the 10000

[lahma]

Thanks for reporting, created #746 to address the issue.