Unexpected Exceptions

What happens if a function you call throws?
You must make sure nothing leaks
You must maintain invariants
This is easier if all functions offer one the guarantees