Implement new unprotect strategy
The old idiom was
// do stuff
The second line expresses the hope that we are unprotecting the same
thing that we protected. However, this can fail when "do stuff" involves
anything non-trivial. If there is a protect (or worse, an extra
unprotect) inside "do stuff" then the unprotect will not unprotect foo
but something else.
The new strategy is to check whether the protect stack is
at the same place where we protected, ensuring that our
protects are always balanced by unprotects. It is still
required to think about what is necessary to protect,
but now there is less chance of something going wrong
in the unprotect part.