This was already a runtime failure condition, but it's better to check
at validation time if possible.  Lightly modified version of a patch
by Shigeru Hanada.