Double free / use-after-free in `Chunk` and `InlineArray` removal methods when an element's `Drop` panics

Chunk::clear, dropleft, dropright and InlineArray::clear, truncate drop the removed elements before updating the metadata that records which slots hold live values — the left/right index pair for Chunk, the length field for InlineArray. If an element's Drop panics during the drop, that update is...