What appears to happen at a cursory look:
Array::remove => dim -= 1;
Array::insert => realloc() corrupts array as no resize occurs
[Next Loop]
Array::remove => memmove causes ICE because 'dim' is no longer valid.
Comment #3 by ibuclaw — 2014-01-14T15:24:20Z
Looks like the culprit is Array::insert on a zero-length'd array.