When `arrayLimit` is exceeded and mixed array notation is used, result depends on the limit value

[krzysdz]

This is something that I found in #540 (comment), but was not fixed by #545 (fbc5206). Given a string with mixed array notation a[]=b&a[1]=c&a=d and arrayLimit values -1, 0 and 1 (the limit is always exceeded), qs.parse() returns 3 different results:

input	arrayLimit	result
a[]=b&a[1]=c&a=d	-1	{ a: { '0': 'b', '1': 'd' } }
a[]=b&a[1]=c&a=d	0	{ a: { '0': 'b', '1': 'c', d: true } }
a[]=b&a[1]=c&a=d	1	{ a: { '0': 'b', '1': 'c', '2': 'd' } }

This has something to do with the order in which everything is combined and when exactly is the overflow detected. When trying to debug it previously, I found out that there is a case, when object is not marked as an overflow object when the overflow is detected:

qs/lib/parse.js

Lines 197 to 203 in f6a7abf

	&& (options.parseArrays && index <= options.arrayLimit)
	) {
	obj = [];
	obj[index] = leaf;
	} else if (decodedRoot !== '__proto__') {
	obj[decodedRoot] = leaf;
	}

This is also possibly related to #529 (comment).