Array bound check on passInstructions

When copying the test operand of a pass2 instruction, make sure not to
write past the end of the passInstructions array.

Fixes #721
2 files changed