Yes. They could simply not panic. But you see where this is going, I think "double panics are never acceptable" is a bad rule, because it squelches errors like, not panicking on
That being said,
JoinGuard does indeed not need to double-panic. The only reason it needs to panic is so the parent thread can't do memory-unsafe things, but since it's already panicking that is already being taken care of.