Buffer: actually enforce the invariant that (b.position <= b.length)

See ocaml#8596 (comment)
and the rest of the conversation.

stdlib/buffer.ml

@@ -202,6 +202,11 @@ let really_input_up_to ic buf ofs len =
 let unsafe_add_channel_up_to b ic len =
   if b.position + len > b.length then resize b len;
   let n = really_input_up_to ic b.buffer b.position len in
+  (* The assertion below may fail in weird scenario where
+     threaded/finalizer code races on the buffer; we don't
+     support these use-cases, but we want to at least
+     preserve the invariant. *)
+  assert (b.position + n <= b.length);
   b.position <- b.position + n;
   n