I would add the above assert here. Also assert in debug mode that the subtraction didn't underflow.