(x ++ y) is at least as safe as the least safe of x and y.