Fix a bug that assumes size_t can be negative