I agree with Raymond.  A comment *might* be sufficient, but ... in some 
sense, that is the purpose of an assert.

The loop is reasonably long; it already includes macros which could 
(but currently don't) change the value, and function calls which might 
plausibly (but don't) reset a "why" variable.  The why variable is 
techically local, but the scope is still pretty large, so that isn't 
clear at first.

It took me some work to verify the assertion, and I'm not at all 
confident that a later change wouldn't violate it.  Nor am I confident 
that the symptoms would make for straightforward debugging.  (Would it 
look like stack corruption?  Would it take several more opcodes before 
a problem was visible?)