[sgen] Fix the merging code.

[sgen] Fix the merging code.

The right behavior is that the loop move values up to the original size
and them the store after the loop store past it.

Let's see the last 2 iterations:

//i == size - 1 (value = array[size - 2], tmp = array [size - 1])
dyn_array_int_set (array, size, value); //ok
value = tmp; //ok
tmp = dyn_array_int_get (array, i + 1); //tmp has an unknown value, as the last element was never stored to.

//i == size (value = array[size - 1], tmp = array [size])
dyn_array_int_set (array, size, value); //This sets the last element to the right value
value = tmp; //value is undefined, as tmp has
tmp = dyn_array_int_get (array, i + 1); //this is an out-of-bounds read as we're reading 2 elements past the end.

The after the loop store (tmp = array [size + 1]):
dyn_array_int_set (array, size + 1, tmp); //This sets the last element to an unknown value.

With the fix on the last iteration is - 1. The post store will use value, which has
the right value (array [size - 1]).