Statically analyze buffer correctness

[swankjesse]

Formal methods found a bug in TimSort: http://envisage-project.eu/proving-android-java-and-python-sorting-algorithm-is-broken-and-how-to-fix-it/

We could try out this software to check that tricky methods like Buffer.write satisfy their promises, specifically memory use.