FlexArrayIter::next::<T> stepped over a lone-sign slot before finding that
null is not a T, so a caller that then read the slot as another type got
the item after it. The slot is now passed only when null is a T, as a value
of another type is left in place. The sign-token tests also require the
lone-sign fixtures to parse and check raw_iter's null slots directly.
A lone + or ++ passes the first pass, which skips it as a number, but no
number is read from it (ISO 32000-2 7.3.3). Dict::entries and Dict's Debug
unwrapped the failed read and panicked, Array::raw_iter did too, and
Array::iter stopped there and dropped the items after it.
Vendor patch (46): a dictionary leaves such an entry out, as Dict::get
already did (7.3.7), and an array reads it as null in its slot (7.3.9). A
typed read still ends at it, as at any value of another type.