UB in BorshDeserialize for types that have validity invariants

[dtolnay]

Repro that ends up executing SIGILL due to undefined behavior:

use borsh::BorshDeserialize;
use std::io::Result;

struct B(u8, Void);
enum Void {}

impl BorshDeserialize for B {
    fn deserialize(_buf: &mut &[u8]) -> Result<Self> {
        unreachable!()
    }
    fn is_u8() -> bool {
        true
    }
}

fn main() {
    let x = Vec::<B>::deserialize(&mut &[1, 0, 0, 0, 0][..]).unwrap();
    match x[0].1 {}
}

$ cargo run --release
Illegal instruction (core dumped)

[frol]

@evgenykuzyakov It seems that we should mark is_u8 as unsafe and make sure we have the documentation on why it is so.

@dtolnay Do you think there is a better approach?