BinaryHeap is not exception safe

[bluss]

BinaryHeap is using zeroed() and may not be exception safe. I.e. it is in an inconsistent state after being recovered after panic. See issue #25662 and others.

Relevant code is BinaryHeap::sift_up, sift_down_range

cc @cmr

[bluss]

My immediate ideas are one of

• Use PPYP and set vector length to zero temporarily. Panicing in comparison functions will leak all elements in the heap
• Use more swaps

[bluss]

@gankro's got the idea: https://botbot.me/mozilla/rust-internals/2015-03-24/?msg=34945483&page=6

[Gankra]

Long ago I suggested two other strategies:

• A two-pass phase where you do all comparisons first, then once you've found the Final Destination you actually do the swaps (which requires no untrusted code to run).
• A panic guard which on drop puts the "working" element back in the "uninit" location in the array

[alexcrichton]

triage: I-nominated, T-libs

[bluss]

I'm trying gankro's panic guard idea.