Guard against double invocation of destructor