ivec self-append has illegal memory access

[brson]

This conversion of run-pass/vec-self-append fails to valgrind:

use std;
import std::ivec;

fn main() {
    // Make sure we properly handle repeated self-appends.
    let a: [int] = ~[0];
    let i = 20;
    let expected_len = 1u;
    while i > 0 {
        log_err ivec::len(a);
        assert (ivec::len(a) == expected_len);
        a += a;
        i -= 1;
        expected_len *= 2u;
    }
}

==18327== Thread 5:
==18327== Invalid read of size 4
==18327==    at 0x8048F33: _rust_main (in /home/banderson/Dev/rust/build/test/run-pass/vec-self-append.stage1)
==18327==    by 0x80490EB: _rust_main_wrap (in /home/banderson/Dev/rust/build/test/run-pass/vec-self-append.stage1)
==18327==    by 0xDEADBEEE: ???
==18327==  Address 0x7131cec is 20 bytes inside a block of size 52 free'd
==18327==    at 0x48DD96C: realloc (vg_replace_malloc.c:525)
==18327==    by 0x4904B53: rust_srv::realloc(void*, unsigned int) (rust_srv.cpp:23)
==18327==    by 0x490B756: memory_region::realloc(void*, unsigned int) (memory_region.cpp:71)
==18327==    by 0x49050BD: rust_kernel::realloc(void*, unsigned int) (rust_kernel.cpp:108)
==18327==    by 0x49016A7: upcall_ivec_resize_shared (rust_upcall.cpp:563)
==18327==    by 0x8048E82: _rust_main (in /home/banderson/Dev/rust/build/test/run-pass/vec-self-append.stage1)
==18327==    by 0x80490EB: _rust_main_wrap (in /home/banderson/Dev/rust/build/test/run-pass/vec-self-append.stage1)
==18327==    by 0xDEADBEEE: ???
==18327==

[brson]

I've updated vec-self-append to the above and XFAILed it