If you're so convinced that this won't happen, please add the matching
abort () to protect the invariant.
I might as well return zero then instead of aborting, but the problem is
that there's no easy way of doing that: what we're talking about is adding
a new mechanism just to detect this case.