Jacob

We use asserts all the time in Turso DB and also in the Turso Server. They're in release builds and shipped to production. And yes, they could crash the server. Asserts are my favorites, and I use them whenever possible. Just yesterday I merged a PR that contained asserts and nothing more. So when do you use them? Use asserts for checking invariants. If that invariant has failed, then something must have gone horribly wrong; I'd prefer to crash the server than continue. Like this made-up example: let a = 5; let b = 7; assert!(a < b, "likely the world has ended"); Asserts help quickly catch logical bugs and prevent something catastrophic. In a database, if some invariant isn't holding up, it could lead to corruption, data loss, or failure of ACID guarantees. Crashing is preferred over proceeding. However, it's incorrect to use them as error handling. 1. You can assert that a write txn has the exclusive write lock before it writes 2. When you read a page from disk, if the read is successful, you can assert that the page exists in the buffer pool 3. Like in MVCC, you can assert that the row's timestamp is less than the txn's (i.e., a txn cannot read rows from some future txn) In practice, we have two macros: `assert` and `debug_assert`. We have a friendly wrapper on top of these. `debug_assert` is fatal in debug builds and logs the condition and message as an error in release builds. `assert` is shipped in both - it's fatal on failure. Rust has a rich type system. Sometimes types help, but most of the time we need asserts. Last year I spent a lot of time writing state machines and used plenty of asserts to check conditions. For example, if the code isn't supposed to be in state X without condition A being true, that's checked with an assert. Asserts also go well with Deterministic Simulation Testing. DST is the one strong reason that we have asserts all over the place. DST is that magical testing philosophy which lets you reproduce the super hard bugs easily. I keep running the simulator, let the asserts fail and then fix the logical bug. We don't use asserts for data from user inputs or S3 (we assume S3 could get corrupted), and for tenant-specific cases we raise errors instead since we're multi-tenant.