DoubleArray::new() does not check untrusted source about yada

[takuyaa]

@vbkaisetsu Thanks for raising this issue. This behavior that might cause unexpected SIGSEGV should be fixed to avoid user confusion.

The policy of the fix I would like to propose is as follows:

1. Introduce validate function that checks whether an array is valid or not as a representation of a double array.
   • The validation needs to check carefully so that all transitions of a double array are safe.
2. Add a procedure that calls validate function to check a given array of DoubleArray::new.
   • This means DoubleArray::new will be a safe method as far as we validated.
3. Introduce unsafe DoubleArray::new_without_verification method for expert users.
   • This method doesn't check an array at initialization. The behavior is the same as the current DoubleArray::new method.
   • Some users who are sure their array is valid might want this feature for faster initialization.

Does this proposal make sense to you?

[vbkaisetsu]

SGTM.