Add Antithesis intrumentation (#5042)

* Copy Antithesis SDK version 0.4.0 to directory external/
* Add build option `voidstar` to enable instrumentation with Antithesis SDK
* Define instrumentation macros ASSERT and UNREACHABLE in terms of regular C assert
* Replace asserts with named ASSERT or UNREACHABLE
* Add UNREACHABLE to LogicError
* Document instrumentation macros in CONTRIBUTING.md

include/xrpl/basics/Buffer.h

@@ -21,7 +21,7 @@
 #define RIPPLE_BASICS_BUFFER_H_INCLUDED
 
 #include <xrpl/basics/Slice.h>
-#include <cassert>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <cstdint>
 #include <cstring>
 #include <memory>
@@ -112,9 +112,10 @@ public:
     operator=(Slice s)
     {
         // Ensure the slice isn't a subset of the buffer.
-        assert(
+        ASSERT(
             s.size() == 0 || size_ == 0 || s.data() < p_.get() ||
-            s.data() >= p_.get() + size_);
+                s.data() >= p_.get() + size_,
+            "ripple::Buffer::operator=(Slice) : input not a subset");
 
         if (auto p = alloc(s.size()))
             std::memcpy(p, s.data(), s.size());

include/xrpl/basics/FeeUnits.h

@@ -20,16 +20,16 @@
 #define BASICS_FEES_H_INCLUDED
 
 #include <xrpl/basics/XRPAmount.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <boost/multiprecision/cpp_int.hpp>
-#include <limits>
-#include <utility>
 
-#include <cassert>
 #include <cmath>
 #include <ios>
 #include <iosfwd>
+#include <limits>
 #include <sstream>
 #include <string>
+#include <utility>
 
 namespace ripple {
 
@@ -419,9 +419,13 @@ mulDivU(Source1 value, Dest mul, Source2 div)
     {
         // split the asserts so if one hits, the user can tell which
         // without a debugger.
-        assert(value.value() >= 0);
-        assert(mul.value() >= 0);
-        assert(div.value() >= 0);
+        ASSERT(
+            value.value() >= 0,
+            "ripple::feeunit::mulDivU : minimum value input");
+        ASSERT(
+            mul.value() >= 0, "ripple::feeunit::mulDivU : minimum mul input");
+        ASSERT(
+            div.value() >= 0, "ripple::feeunit::mulDivU : minimum div input");
         return std::nullopt;
     }
 

include/xrpl/basics/MathUtilities.h

@@ -43,7 +43,7 @@ namespace ripple {
 constexpr std::size_t
 calculatePercent(std::size_t count, std::size_t total)
 {
-    assert(total != 0);
+    assert(total != 0);  // NOTE No ASSERT here, because constexpr
     return ((std::min(count, total) * 100) + total - 1) / total;
 }
 

include/xrpl/basics/SlabAllocator.h

@@ -20,7 +20,9 @@
 #ifndef RIPPLE_BASICS_SLABALLOCATOR_H_INCLUDED
 #define RIPPLE_BASICS_SLABALLOCATOR_H_INCLUDED
 
+#include <xrpl/basics/ByteUtilities.h>
 #include <xrpl/beast/type_name.h>
+#include <xrpl/beast/utility/instrumentation.h>
 
 #include <boost/align.hpp>
 #include <boost/container/static_vector.hpp>
@@ -28,10 +30,10 @@
 
 #include <algorithm>
 #include <atomic>
-#include <cassert>
 #include <cstdint>
 #include <cstring>
 #include <mutex>
+#include <vector>
 
 #if BOOST_OS_LINUX
 #include <sys/mman.h>
@@ -141,7 +143,9 @@ class SlabAllocator
         void
         deallocate(std::uint8_t* ptr) noexcept
         {
-            assert(own(ptr));
+            ASSERT(
+                own(ptr),
+                "ripple::SlabAllocator::SlabBlock::deallocate : own input");
 
             std::lock_guard l(m_);
 
@@ -184,7 +188,9 @@ public:
               boost::alignment::align_up(sizeof(Type) + extra, itemAlignment_))
         , slabSize_(alloc)
     {
-        assert((itemAlignment_ & (itemAlignment_ - 1)) == 0);
+        ASSERT(
+            (itemAlignment_ & (itemAlignment_ - 1)) == 0,
+            "ripple::SlabAllocator::SlabAllocator : valid alignment");
     }
 
     SlabAllocator(SlabAllocator const& other) = delete;
@@ -294,7 +300,10 @@ public:
     bool
     deallocate(std::uint8_t* ptr) noexcept
     {
-        assert(ptr);
+        ASSERT(
+            ptr != nullptr,
+            "ripple::SlabAllocator::SlabAllocator::deallocate : non-null "
+            "input");
 
         for (auto slab = slabs_.load(); slab != nullptr; slab = slab->next_)
         {

include/xrpl/basics/Slice.h

@@ -22,9 +22,9 @@
 
 #include <xrpl/basics/contract.h>
 #include <xrpl/basics/strHex.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <algorithm>
 #include <array>
-#include <cassert>
 #include <cstdint>
 #include <cstring>
 #include <limits>
@@ -103,7 +103,9 @@ public:
     std::uint8_t
     operator[](std::size_t i) const noexcept
     {
-        assert(i < size_);
+        ASSERT(
+            i < size_,
+            "ripple::Slice::operator[](std::size_t) const : valid input");
         return data_[i];
     }
 

include/xrpl/basics/base_uint.h

@@ -31,6 +31,7 @@
 #include <xrpl/basics/hardened_hash.h>
 #include <xrpl/basics/strHex.h>
 #include <xrpl/beast/utility/Zero.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <boost/endian/conversion.hpp>
 #include <boost/functional/hash.hpp>
 #include <algorithm>
@@ -289,7 +290,9 @@ public:
             std::is_trivially_copyable<typename Container::value_type>::value>>
     explicit base_uint(Container const& c)
     {
-        assert(c.size() * sizeof(typename Container::value_type) == size());
+        ASSERT(
+            c.size() * sizeof(typename Container::value_type) == size(),
+            "ripple::base_uint::base_uint(Container auto) : input size match");
         std::memcpy(data_.data(), c.data(), size());
     }
 
@@ -300,7 +303,9 @@ public:
         base_uint&>
     operator=(Container const& c)
     {
-        assert(c.size() * sizeof(typename Container::value_type) == size());
+        ASSERT(
+            c.size() * sizeof(typename Container::value_type) == size(),
+            "ripple::base_uint::operator=(Container auto) : input size match");
         std::memcpy(data_.data(), c.data(), size());
         return *this;
     }

include/xrpl/basics/partitioned_unordered_map.h

@@ -20,7 +20,7 @@
 #ifndef RIPPLE_BASICS_PARTITIONED_UNORDERED_MAP_H
 #define RIPPLE_BASICS_PARTITIONED_UNORDERED_MAP_H
 
-#include <cassert>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <functional>
 #include <optional>
 #include <thread>
@@ -246,7 +246,10 @@ public:
             ? *partitions
             : std::thread::hardware_concurrency();
         map_.resize(partitions_);
-        assert(partitions_);
+        ASSERT(
+            partitions_ != 0,
+            "ripple::partitioned_unordered_map::partitioned_unordered_map : "
+            "nonzero partitions");
     }
 
     std::size_t

include/xrpl/basics/random.h

@@ -20,8 +20,8 @@
 #ifndef RIPPLE_BASICS_RANDOM_H_INCLUDED
 #define RIPPLE_BASICS_RANDOM_H_INCLUDED
 
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/beast/xor_shift_engine.h>
-#include <cassert>
 #include <cstddef>
 #include <cstdint>
 #include <cstring>
@@ -114,7 +114,7 @@ std::enable_if_t<
     Integral>
 rand_int(Engine& engine, Integral min, Integral max)
 {
-    assert(max > min);
+    ASSERT(max > min, "ripple::rand_int : max over min inputs");
 
     // This should have no state and constructing it should
     // be very cheap. If that turns out not to be the case

include/xrpl/basics/scope.h

@@ -20,6 +20,8 @@
 #ifndef RIPPLE_BASICS_SCOPE_H_INCLUDED
 #define RIPPLE_BASICS_SCOPE_H_INCLUDED
 
+#include <xrpl/beast/utility/instrumentation.h>
+
 #include <exception>
 #include <mutex>
 #include <type_traits>
@@ -233,7 +235,9 @@ public:
     explicit scope_unlock(std::unique_lock<Mutex>& lock) noexcept(true)
         : plock(&lock)
     {
-        assert(plock->owns_lock());
+        ASSERT(
+            plock->owns_lock(),
+            "ripple::scope_unlock::scope_unlock : mutex must be locked");
         plock->unlock();
     }
 

include/xrpl/basics/spinlock.h

@@ -18,8 +18,8 @@
 #ifndef RIPPLE_BASICS_SPINLOCK_H_INCLUDED
 #define RIPPLE_BASICS_SPINLOCK_H_INCLUDED
 
+#include <xrpl/beast/utility/instrumentation.h>
 #include <atomic>
-#include <cassert>
 #include <limits>
 #include <type_traits>
 
@@ -117,7 +117,9 @@ public:
     packed_spinlock(std::atomic<T>& lock, int index)
         : bits_(lock), mask_(static_cast<T>(1) << index)
     {
-        assert(index >= 0 && (mask_ != 0));
+        ASSERT(
+            index >= 0 && (mask_ != 0),
+            "ripple::packed_spinlock::packed_spinlock : valid index and mask");
     }
 
     [[nodiscard]] bool

include/xrpl/beast/asio/io_latency_probe.h

@@ -20,8 +20,10 @@
 #ifndef BEAST_ASIO_IO_LATENCY_PROBE_H_INCLUDED
 #define BEAST_ASIO_IO_LATENCY_PROBE_H_INCLUDED
 
+#include <xrpl/beast/utility/instrumentation.h>
 #include <boost/asio/basic_waitable_timer.hpp>
 #include <boost/asio/io_service.hpp>
+
 #include <chrono>
 #include <condition_variable>
 #include <mutex>
@@ -172,7 +174,10 @@ private:
             , m_repeat(repeat)
             , m_probe(probe)
         {
-            assert(m_probe);
+            ASSERT(
+                m_probe != nullptr,
+                "beast::io_latency_probe::sample_op::sample_op : non-null "
+                "probe input");
             m_probe->addref();
         }
 
@@ -182,7 +187,10 @@ private:
             , m_repeat(from.m_repeat)
             , m_probe(from.m_probe)
         {
-            assert(m_probe);
+            ASSERT(
+                m_probe != nullptr,
+                "beast::io_latency_probe::sample_op::sample_op(sample_op&&) : "
+                "non-null probe input");
             from.m_probe = nullptr;
         }
 

include/xrpl/beast/clock/manual_clock.h

@@ -21,7 +21,7 @@
 #define BEAST_CHRONO_MANUAL_CLOCK_H_INCLUDED
 
 #include <xrpl/beast/clock/abstract_clock.h>
-#include <cassert>
+#include <xrpl/beast/utility/instrumentation.h>
 
 namespace beast {
 
@@ -61,7 +61,9 @@ public:
     void
     set(time_point const& when)
     {
-        assert(!Clock::is_steady || when >= now_);
+        ASSERT(
+            !Clock::is_steady || when >= now_,
+            "beast::manual_clock::set(time_point) : forward input");
         now_ = when;
     }
 
@@ -78,7 +80,9 @@ public:
     void
     advance(std::chrono::duration<Rep, Period> const& elapsed)
     {
-        assert(!Clock::is_steady || (now_ + elapsed) >= now_);
+        ASSERT(
+            !Clock::is_steady || (now_ + elapsed) >= now_,
+            "beast::manual_clock::advance(duration) : forward input");
         now_ += elapsed;
     }
 

include/xrpl/beast/container/detail/aged_unordered_container.h

@@ -1330,7 +1330,10 @@ public:
     size_type
     bucket(Key const& k) const
     {
-        assert(bucket_count() != 0);
+        ASSERT(
+            bucket_count() != 0,
+            "beast::detail::aged_unordered_container::bucket : nonzero bucket "
+            "count");
         return m_cont.bucket(k, std::cref(m_config.hash_function()));
     }
 
@@ -1471,7 +1474,10 @@ private:
     {
         if (would_exceed(additional))
             m_buck.resize(size() + additional, m_cont);
-        assert(load_factor() <= max_load_factor());
+        ASSERT(
+            load_factor() <= max_load_factor(),
+            "beast::detail::aged_unordered_container::maybe_rehash : maximum "
+            "load factor");
     }
 
     // map, set

include/xrpl/beast/core/LexicalCast.h

@@ -20,9 +20,10 @@
 #ifndef BEAST_MODULE_CORE_TEXT_LEXICALCAST_H_INCLUDED
 #define BEAST_MODULE_CORE_TEXT_LEXICALCAST_H_INCLUDED
 
+#include <xrpl/beast/utility/instrumentation.h>
+
 #include <boost/core/detail/string_view.hpp>
 #include <algorithm>
-#include <cassert>
 #include <cerrno>
 #include <charconv>
 #include <cstdlib>
@@ -159,7 +160,9 @@ struct LexicalCast<Out, char const*>
     bool
     operator()(Out& out, char const* in) const
     {
-        assert(in);
+        ASSERT(
+            in != nullptr,
+            "beast::detail::LexicalCast(char const*) : non-null input");
         return LexicalCast<Out, std::string_view>()(out, in);
     }
 };
@@ -174,7 +177,9 @@ struct LexicalCast<Out, char*>
     bool
     operator()(Out& out, char* in) const
     {
-        assert(in);
+        ASSERT(
+            in != nullptr,
+            "beast::detail::LexicalCast(char*) : non-null input");
         return LexicalCast<Out, std::string_view>()(out, in);
     }
 };

include/xrpl/beast/net/IPAddress.h

@@ -24,9 +24,9 @@
 #include <xrpl/beast/hash/uhash.h>
 #include <xrpl/beast/net/IPAddressV4.h>
 #include <xrpl/beast/net/IPAddressV6.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <boost/asio/ip/address.hpp>
 #include <boost/functional/hash.hpp>
-#include <cassert>
 #include <cstdint>
 #include <ios>
 #include <sstream>
@@ -96,7 +96,7 @@ hash_append(Hasher& h, beast::IP::Address const& addr) noexcept
     else if (addr.is_v6())
         hash_append(h, addr.to_v6().to_bytes());
     else
-        assert(false);
+        UNREACHABLE("beast::hash_append : invalid address type");
 }
 }  // namespace beast
 

include/xrpl/beast/net/IPAddressV6.h

@@ -20,8 +20,8 @@
 #ifndef BEAST_NET_IPADDRESSV6_H_INCLUDED
 #define BEAST_NET_IPADDRESSV6_H_INCLUDED
 
+#include <xrpl/beast/utility/instrumentation.h>
 #include <boost/asio/ip/address_v6.hpp>
-#include <cassert>
 #include <cstdint>
 #include <functional>
 #include <ios>

include/xrpl/beast/utility/Journal.h

@@ -20,7 +20,7 @@
 #ifndef BEAST_UTILITY_JOURNAL_H_INCLUDED
 #define BEAST_UTILITY_JOURNAL_H_INCLUDED
 
-#include <cassert>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <sstream>
 
 namespace beast {
@@ -205,7 +205,9 @@ public:
         */
         Stream(Sink& sink, Severity level) : m_sink(sink), m_level(level)
         {
-            assert(m_level < severities::kDisabled);
+            ASSERT(
+                m_level < severities::kDisabled,
+                "beast::Journal::Stream::Stream : maximum level");
         }
 
         /** Construct or copy another Stream. */

include/xrpl/beast/utility/instrumentation.h

@@ -0,0 +1,64 @@
+//------------------------------------------------------------------------------
+/*
+This file is part of rippled: https://github.com/ripple/rippled
+Copyright (c) 2024 Ripple Labs Inc.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose  with  or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE  SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH  REGARD  TO  THIS  SOFTWARE  INCLUDING  ALL  IMPLIED  WARRANTIES  OF
+MERCHANTABILITY  AND  FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY  SPECIAL ,  DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER  RESULTING  FROM  LOSS  OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION  OF  CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+*/
+//==============================================================================
+
+#ifndef BEAST_UTILITY_INSTRUMENTATION_H_INCLUDED
+#define BEAST_UTILITY_INSTRUMENTATION_H_INCLUDED
+
+#include <cassert>
+
+#ifdef ENABLE_VOIDSTAR
+#ifdef NDEBUG
+#error "Antithesis instrumentation requires Debug build"
+#endif
+#include <antithesis_sdk.h>
+#else
+#define ALWAYS(cond, name, ...) assert((name) && (cond))
+#define ALWAYS_OR_UNREACHABLE(cond, name, ...) assert((name) && (cond))
+#define SOMETIMES(cond, name, ...)
+#define REACHABLE(name, ...)
+#define UNREACHABLE(name, ...) assert((name) && false)
+#endif
+
+#define ASSERT ALWAYS_OR_UNREACHABLE
+
+// How to use the instrumentation macros:
+//
+// ALWAYS if cond must be true and the line must be reached during fuzzing
+// ASSERT if cond must be true but the line might not be reached during fuzzing
+// REACHABLE if the line must be reached during fuzzing
+// SOMETIMES a hint for the fuzzer to try to make the cond true
+// UNREACHABLE if the line must not be reached (in fuzzing or in normal use)
+//
+// NOTE: ASSERT has similar semantics as C assert macro, with minor differences:
+// * ASSERT must have an unique name (naming convention in CONTRIBUTING.md)
+// * the condition (which comes first) must be *implicitly* convertible to bool
+// * during fuzzing, the program will continue execution past a failed ASSERT
+//
+// We continue to use regular C assert inside unit tests and inside constexpr
+// functions.
+//
+// NOTE: UNREACHABLE does *not* have the same semantics as std::unreachable.
+// The program will continue execution past an UNREACHABLE in a Release build
+// and during fuzzing (similar to ASSERT).
+// Also, the naming convention in UNREACHABLE is subtly different from other
+// instrumentation macros - its name describes the condition which was *not*
+// meant to happen, while name in other macros describe the condition that is
+// meant to happen (e.g. as in "assert that this happens").
+
+#endif

include/xrpl/beast/utility/rngfill.h

@@ -20,8 +20,8 @@
 #ifndef BEAST_RANDOM_RNGFILL_H_INCLUDED
 #define BEAST_RANDOM_RNGFILL_H_INCLUDED
 
+#include <xrpl/beast/utility/instrumentation.h>
 #include <array>
-#include <cassert>
 #include <cstdint>
 #include <cstring>
 #include <type_traits>
@@ -42,7 +42,8 @@ rngfill(void* buffer, std::size_t bytes, Generator& g)
         bytes -= sizeof(v);
     }
 
-    assert(bytes < sizeof(result_type));
+    ASSERT(
+        bytes < sizeof(result_type), "beast::rngfill(void*) : maximum bytes");
 
 #ifdef __GNUC__
     // gcc 11.1 (falsely) warns about an array-bounds overflow in release mode.

include/xrpl/json/detail/json_assert.h

@@ -22,9 +22,6 @@
 
 #include <xrpl/json/json_errors.h>
 
-#define JSON_ASSERT_UNREACHABLE assert(false)
-#define JSON_ASSERT(condition) \
-    assert(condition);  // @todo <= change this into an exception throw
 #define JSON_ASSERT_MESSAGE(condition, message) \
     if (!(condition))                           \
         ripple::Throw<Json::error>(message);

include/xrpl/protocol/AmountConversions.h

@@ -53,7 +53,9 @@ toSTAmount(XRPAmount const& xrp)
 inline STAmount
 toSTAmount(XRPAmount const& xrp, Issue const& iss)
 {
-    assert(isXRP(iss.account) && isXRP(iss.currency));
+    ASSERT(
+        isXRP(iss.account) && isXRP(iss.currency),
+        "ripple::toSTAmount : is XRP");
     return toSTAmount(xrp);
 }
 
@@ -72,12 +74,14 @@ template <>
 inline IOUAmount
 toAmount<IOUAmount>(STAmount const& amt)
 {
-    assert(amt.mantissa() < std::numeric_limits<std::int64_t>::max());
+    ASSERT(
+        amt.mantissa() < std::numeric_limits<std::int64_t>::max(),
+        "ripple::toAmount<IOUAmount> : maximum mantissa");
     bool const isNeg = amt.negative();
     std::int64_t const sMant =
         isNeg ? -std::int64_t(amt.mantissa()) : amt.mantissa();
 
-    assert(!isXRP(amt));
+    ASSERT(!isXRP(amt), "ripple::toAmount<IOUAmount> : is not XRP");
     return IOUAmount(sMant, amt.exponent());
 }
 
@@ -85,12 +89,14 @@ template <>
 inline XRPAmount
 toAmount<XRPAmount>(STAmount const& amt)
 {
-    assert(amt.mantissa() < std::numeric_limits<std::int64_t>::max());
+    ASSERT(
+        amt.mantissa() < std::numeric_limits<std::int64_t>::max(),
+        "ripple::toAmount<XRPAmount> : maximum mantissa");
     bool const isNeg = amt.negative();
     std::int64_t const sMant =
         isNeg ? -std::int64_t(amt.mantissa()) : amt.mantissa();
 
-    assert(isXRP(amt));
+    ASSERT(isXRP(amt), "ripple::toAmount<XRPAmount> : is XRP");
     return XRPAmount(sMant);
 }
 

include/xrpl/protocol/Feature.h

@@ -151,14 +151,19 @@ public:
 
     explicit FeatureBitset(base const& b) : base(b)
     {
-        assert(b.count() == count());
+        ASSERT(
+            b.count() == count(),
+            "ripple::FeatureBitset::FeatureBitset(base) : count match");
     }
 
     template <class... Fs>
     explicit FeatureBitset(uint256 const& f, Fs&&... fs)
     {
         initFromFeatures(f, std::forward<Fs>(fs)...);
-        assert(count() == (sizeof...(fs) + 1));
+        ASSERT(
+            count() == (sizeof...(fs) + 1),
+            "ripple::FeatureBitset::FeatureBitset(uint256) : count and "
+            "sizeof... do match");
     }
 
     template <class Col>
@@ -166,7 +171,10 @@ public:
     {
         for (auto const& f : fs)
             set(featureToBitsetIndex(f));
-        assert(fs.size() == count());
+        ASSERT(
+            fs.size() == count(),
+            "ripple::FeatureBitset::FeatureBitset(Container auto) : count and "
+            "size do match");
     }
 
     auto

include/xrpl/protocol/Indexes.h

@@ -220,7 +220,7 @@ page(uint256 const& root, std::uint64_t index = 0) noexcept;
 inline Keylet
 page(Keylet const& root, std::uint64_t index = 0) noexcept
 {
-    assert(root.type == ltDIR_NODE);
+    ASSERT(root.type == ltDIR_NODE, "ripple::keylet::page : valid root type");
     return page(root.key, index);
 }
 /** @} */

include/xrpl/protocol/Issue.h

@@ -20,10 +20,10 @@
 #ifndef RIPPLE_PROTOCOL_ISSUE_H_INCLUDED
 #define RIPPLE_PROTOCOL_ISSUE_H_INCLUDED
 
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/UintTypes.h>
 
-#include <cassert>
 #include <functional>
 #include <type_traits>
 

include/xrpl/protocol/MultiApiJson.h

@@ -23,8 +23,8 @@
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/ApiVersion.h>
 
+#include <xrpl/beast/utility/instrumentation.h>
 #include <array>
-#include <cassert>
 #include <concepts>
 #include <cstdlib>
 #include <functional>
@@ -159,8 +159,10 @@ struct MultiApiJson
             -> std::
                 invoke_result_t<Fn, decltype(json.val[0]), Version, Args&&...>
         {
-            assert(
-                valid(version) && index(version) >= 0 && index(version) < size);
+            ASSERT(
+                valid(version) && index(version) >= 0 && index(version) < size,
+                "ripple::detail::MultiApiJson::operator<Args...>() : valid "
+                "version");
             return std::invoke(
                 fn,
                 json.val[index(version)],
@@ -177,8 +179,9 @@ struct MultiApiJson
         operator()(Json& json, Version version, Fn fn) const
             -> std::invoke_result_t<Fn, decltype(json.val[0])>
         {
-            assert(
-                valid(version) && index(version) >= 0 && index(version) < size);
+            ASSERT(
+                valid(version) && index(version) >= 0 && index(version) < size,
+                "ripple::detail::MultiApiJson::operator() : valid version");
             return std::invoke(fn, json.val[index(version)]);
         }
     } visitor = {};

include/xrpl/protocol/Quality.h

@@ -298,7 +298,9 @@ public:
     friend double
     relativeDistance(Quality const& q1, Quality const& q2)
     {
-        assert(q1.m_value > 0 && q2.m_value > 0);
+        ASSERT(
+            q1.m_value > 0 && q2.m_value > 0,
+            "ripple::Quality::relativeDistance : minimum inputs");
 
         if (q1.m_value == q2.m_value)  // make expected common case fast
             return 0;

include/xrpl/protocol/Rate.h

@@ -20,9 +20,9 @@
 #ifndef RIPPLE_PROTOCOL_RATE_H_INCLUDED
 #define RIPPLE_PROTOCOL_RATE_H_INCLUDED
 
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/protocol/STAmount.h>
 #include <boost/operators.hpp>
-#include <cassert>
 #include <cstdint>
 #include <ostream>
 

include/xrpl/protocol/STAmount.h

@@ -26,6 +26,7 @@
 #include <xrpl/basics/MPTAmount.h>
 #include <xrpl/basics/Number.h>
 #include <xrpl/basics/XRPAmount.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/protocol/Asset.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STBase.h>
@@ -353,7 +354,10 @@ STAmount::STAmount(
     , mIsNegative(negative)
 {
     // mValue is uint64, but needs to fit in the range of int64
-    assert(mValue <= std::numeric_limits<std::int64_t>::max());
+    ASSERT(
+        mValue <= std::numeric_limits<std::int64_t>::max(),
+        "ripple::STAmount::STAmount(SField, A, std::uint64_t, int, bool) : "
+        "maximum mantissa input");
     canonicalize();
 }
 

include/xrpl/protocol/STBitString.h

@@ -170,8 +170,10 @@ template <int Bits>
 void
 STBitString<Bits>::add(Serializer& s) const
 {
-    assert(getFName().isBinary());
-    assert(getFName().fieldType == getSType());
+    ASSERT(getFName().isBinary(), "ripple::STBitString::add : field is binary");
+    ASSERT(
+        getFName().fieldType == getSType(),
+        "ripple::STBitString::add : field type match");
     s.addBitString<Bits>(value_);
 }
 

include/xrpl/protocol/STBlob.h

@@ -23,9 +23,9 @@
 #include <xrpl/basics/Buffer.h>
 #include <xrpl/basics/CountedObject.h>
 #include <xrpl/basics/Slice.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/protocol/STBase.h>
 
-#include <cassert>
 #include <cstring>
 #include <memory>
 

include/xrpl/protocol/STInteger.h

@@ -110,8 +110,10 @@ template <typename Integer>
 inline void
 STInteger<Integer>::add(Serializer& s) const
 {
-    assert(getFName().isBinary());
-    assert(getFName().fieldType == getSType());
+    ASSERT(getFName().isBinary(), "ripple::STInteger::add : field is binary");
+    ASSERT(
+        getFName().fieldType == getSType(),
+        "ripple::STInteger::add : field type match");
     s.addInteger(value_);
 }
 

include/xrpl/protocol/STObject.h

@@ -25,6 +25,7 @@
 #include <xrpl/basics/Slice.h>
 #include <xrpl/basics/chrono.h>
 #include <xrpl/basics/contract.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/protocol/HashPrefix.h>
 #include <xrpl/protocol/SOTemplate.h>
 #include <xrpl/protocol/STAmount.h>
@@ -35,7 +36,6 @@
 #include <xrpl/protocol/STVector256.h>
 #include <xrpl/protocol/detail/STVar.h>
 #include <boost/iterator/transform_iterator.hpp>
-#include <cassert>
 #include <optional>
 #include <stdexcept>
 #include <type_traits>
@@ -737,7 +737,8 @@ STObject::Proxy<T>::assign(U&& u)
         t = dynamic_cast<T*>(st_->getPField(*f_, true));
     else
         t = dynamic_cast<T*>(st_->makeFieldPresent(*f_));
-    assert(t);
+    ASSERT(
+        t != nullptr, "ripple::STObject::Proxy::assign : type cast succeeded");
     *t = std::forward<U>(u);
 }
 
@@ -1033,13 +1034,19 @@ STObject::at(TypedField<T> const& f) const
     if (auto const u = dynamic_cast<T const*>(b))
         return u->value();
 
-    assert(mType);
-    assert(b->getSType() == STI_NOTPRESENT);
+    ASSERT(
+        mType != nullptr,
+        "ripple::STObject::at(TypedField auto) : field template non-null");
+    ASSERT(
+        b->getSType() == STI_NOTPRESENT,
+        "ripple::STObject::at(TypedField auto) : type not present");
 
     if (mType->style(f) == soeOPTIONAL)
         Throw<STObject::FieldErr>("Missing optional field: " + f.getName());
 
-    assert(mType->style(f) == soeDEFAULT);
+    ASSERT(
+        mType->style(f) == soeDEFAULT,
+        "ripple::STObject::at(TypedField auto) : template style is default");
 
     // Used to help handle the case where value_type is a const reference,
     // otherwise we would return the address of a temporary.
@@ -1057,11 +1064,19 @@ STObject::at(OptionaledField<T> const& of) const
     auto const u = dynamic_cast<T const*>(b);
     if (!u)
     {
-        assert(mType);
-        assert(b->getSType() == STI_NOTPRESENT);
+        ASSERT(
+            mType != nullptr,
+            "ripple::STObject::at(OptionaledField auto) : field template "
+            "non-null");
+        ASSERT(
+            b->getSType() == STI_NOTPRESENT,
+            "ripple::STObject::at(OptionaledField auto) : type not present");
         if (mType->style(*of.f) == soeOPTIONAL)
             return std::nullopt;
-        assert(mType->style(*of.f) == soeDEFAULT);
+        ASSERT(
+            mType->style(*of.f) == soeDEFAULT,
+            "ripple::STObject::at(OptionaledField auto) : template style is "
+            "default");
         return typename T::value_type{};
     }
     return u->value();

include/xrpl/protocol/STPathSet.h

@@ -21,11 +21,11 @@
 #define RIPPLE_PROTOCOL_STPATHSET_H_INCLUDED
 
 #include <xrpl/basics/CountedObject.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STBase.h>
 #include <xrpl/protocol/UintTypes.h>
-#include <cassert>
 #include <cstddef>
 #include <optional>
 
@@ -257,7 +257,9 @@ inline STPathElement::STPathElement(
         is_offer_ = false;
         mAccountID = *account;
         mType |= typeAccount;
-        assert(mAccountID != noAccount());
+        ASSERT(
+            mAccountID != noAccount(),
+            "ripple::STPathElement::STPathElement : account is set");
     }
 
     if (currency)
@@ -270,7 +272,9 @@ inline STPathElement::STPathElement(
     {
         mIssuerID = *issuer;
         mType |= typeIssuer;
-        assert(mIssuerID != noAccount());
+        ASSERT(
+            mIssuerID != noAccount(),
+            "ripple::STPathElement::STPathElement : issuer is set");
     }
 
     hash_value_ = get_hash(*this);

include/xrpl/protocol/STValidation.h

@@ -22,10 +22,10 @@
 
 #include <xrpl/basics/FeeUnits.h>
 #include <xrpl/basics/Log.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/protocol/PublicKey.h>
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/SecretKey.h>
-#include <cassert>
 #include <cstdint>
 #include <functional>
 #include <memory>
@@ -176,7 +176,9 @@ STValidation::STValidation(
         Throw<std::runtime_error>("Invalid signature in validation");
     }
 
-    assert(nodeID_.isNonZero());
+    ASSERT(
+        nodeID_.isNonZero(),
+        "ripple::STValidation::STValidation(SerialIter) : nonzero node");
 }
 
 /** Construct, sign and trust a new STValidation issued by this node.
@@ -199,7 +201,10 @@ STValidation::STValidation(
     , nodeID_(nodeID)
     , seenTime_(signTime)
 {
-    assert(nodeID_.isNonZero());
+    ASSERT(
+        nodeID_.isNonZero(),
+        "ripple::STValidation::STValidation(PublicKey, SecretKey) : nonzero "
+        "node");
 
     // First, set our own public key:
     if (publicKeyType(pk) != KeyType::secp256k1)

include/xrpl/protocol/Serializer.h

@@ -27,9 +27,9 @@
 #include <xrpl/basics/contract.h>
 #include <xrpl/basics/safe_cast.h>
 #include <xrpl/basics/strHex.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/protocol/HashPrefix.h>
 #include <xrpl/protocol/SField.h>
-#include <cassert>
 #include <cstdint>
 #include <cstring>
 #include <iomanip>
@@ -55,7 +55,9 @@ public:
 
         if (size)
         {
-            assert(data != nullptr);
+            ASSERT(
+                data != nullptr,
+                "ripple::Serializer::Serializer(void const*) : non-null input");
             std::memcpy(mData.data(), data, size);
         }
     }
@@ -331,7 +333,7 @@ Serializer::addVL(Iter begin, Iter end, int len)
         len -= begin->size();
 #endif
     }
-    assert(len == 0);
+    ASSERT(len == 0, "ripple::Serializer::addVL : length matches distance");
     return ret;
 }
 

include/xrpl/protocol/TxMeta.h

@@ -116,7 +116,9 @@ public:
     STAmount
     getDeliveredAmount() const
     {
-        assert(hasDeliveredAmount());
+        ASSERT(
+            hasDeliveredAmount(),
+            "ripple::TxMeta::getDeliveredAmount : non-null delivered amount");
         return *mDelivered;
     }
 

include/xrpl/protocol/detail/b58_utils.h

@@ -21,12 +21,12 @@
 #define RIPPLE_PROTOCOL_B58_UTILS_H_INCLUDED
 
 #include <xrpl/basics/contract.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/protocol/detail/token_errors.h>
 
 #include <boost/outcome.hpp>
 #include <boost/outcome/result.hpp>
 
-#include <cassert>
 #include <cinttypes>
 #include <span>
 #include <system_error>
@@ -130,7 +130,9 @@ inplace_bigint_div_rem(std::span<uint64_t> numerator, std::uint64_t divisor)
     {
         // should never happen, but if it does then it seems natural to define
         // the a null set of numbers to be zero, so the remainder is also zero.
-        assert(0);
+        UNREACHABLE(
+            "ripple::b58_fast::detail::inplace_bigint_div_rem : empty "
+            "numerator");
         return 0;
     }
 
@@ -146,8 +148,14 @@ inplace_bigint_div_rem(std::span<uint64_t> numerator, std::uint64_t divisor)
         unsigned __int128 const denom128 = denom;
         unsigned __int128 const d = num / denom128;
         unsigned __int128 const r = num - (denom128 * d);
-        assert(d >> 64 == 0);
-        assert(r >> 64 == 0);
+        ASSERT(
+            d >> 64 == 0,
+            "ripple::b58_fast::detail::inplace_bigint_div_rem::div_rem_64 : "
+            "valid division result");
+        ASSERT(
+            r >> 64 == 0,
+            "ripple::b58_fast::detail::inplace_bigint_div_rem::div_rem_64 : "
+            "valid remainder");
         return {static_cast<std::uint64_t>(d), static_cast<std::uint64_t>(r)};
     };
 
@@ -170,7 +178,9 @@ inplace_bigint_div_rem(std::span<uint64_t> numerator, std::uint64_t divisor)
 b58_10_to_b58_be(std::uint64_t input)
 {
     constexpr std::uint64_t B_58_10 = 430804206899405824;  // 58^10;
-    assert(input < B_58_10);
+    ASSERT(
+        input < B_58_10,
+        "ripple::b58_fast::detail::b58_10_to_b58_be : valid input");
     constexpr std::size_t resultSize = 10;
     std::array<std::uint8_t, resultSize> result{};
     int i = 0;

include/xrpl/resource/detail/Entry.h

@@ -23,9 +23,9 @@
 #include <xrpl/basics/DecayingSample.h>
 #include <xrpl/beast/clock/abstract_clock.h>
 #include <xrpl/beast/core/List.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/resource/detail/Key.h>
 #include <xrpl/resource/detail/Tuning.h>
-#include <cassert>
 
 namespace ripple {
 namespace Resource {

include/xrpl/resource/detail/Key.h

@@ -21,8 +21,8 @@
 #define RIPPLE_RESOURCE_KEY_H_INCLUDED
 
 #include <xrpl/beast/net/IPEndpoint.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/resource/detail/Kind.h>
-#include <cassert>
 
 namespace ripple {
 namespace Resource {

include/xrpl/resource/detail/Logic.h

@@ -26,12 +26,12 @@
 #include <xrpl/beast/clock/abstract_clock.h>
 #include <xrpl/beast/insight/Insight.h>
 #include <xrpl/beast/utility/PropertyStream.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/jss.h>
 #include <xrpl/resource/Fees.h>
 #include <xrpl/resource/Gossip.h>
 #include <xrpl/resource/detail/Import.h>
-#include <cassert>
 #include <mutex>
 
 namespace ripple {
@@ -401,7 +401,9 @@ public:
     {
         std::lock_guard _(lock_);
         Entry& entry(iter->second);
-        assert(entry.refcount == 0);
+        ASSERT(
+            entry.refcount == 0,
+            "ripple::Resource::Logic::erase : entry not used");
         inactive_.erase(inactive_.iterator_to(entry));
         table_.erase(iter);
     }
@@ -433,7 +435,9 @@ public:
                     admin_.erase(admin_.iterator_to(entry));
                     break;
                 default:
-                    assert(false);
+                    UNREACHABLE(
+                        "ripple::Resource::Logic::release : invalid entry "
+                        "kind");
                     break;
             }
             inactive_.push_back(entry);

include/xrpl/server/detail/BaseHTTPPeer.h

@@ -22,6 +22,7 @@
 
 #include <xrpl/basics/Log.h>
 #include <xrpl/beast/net/IPAddressConversion.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/server/Session.h>
 #include <xrpl/server/detail/io_list.h>
 #include <boost/asio/ip/tcp.hpp>
@@ -34,7 +35,6 @@
 #include <boost/beast/http/parser.hpp>
 #include <boost/beast/http/read.hpp>
 #include <atomic>
-#include <cassert>
 #include <chrono>
 #include <functional>
 #include <memory>

include/xrpl/server/detail/BasePeer.h

@@ -21,12 +21,12 @@
 #define RIPPLE_SERVER_BASEPEER_H_INCLUDED
 
 #include <xrpl/beast/utility/WrappedSink.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/server/Port.h>
 #include <xrpl/server/detail/LowestLayer.h>
 #include <xrpl/server/detail/io_list.h>
 #include <boost/asio.hpp>
 #include <atomic>
-#include <cassert>
 #include <functional>
 #include <string>
 

include/xrpl/server/detail/BaseWSPeer.h

@@ -21,17 +21,21 @@
 #define RIPPLE_SERVER_BASEWSPEER_H_INCLUDED
 
 #include <xrpl/basics/safe_cast.h>
+#include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/beast/utility/rngfill.h>
 #include <xrpl/crypto/csprng.h>
 #include <xrpl/protocol/BuildInfo.h>
+#include <xrpl/server/WSSession.h>
 #include <xrpl/server/detail/BasePeer.h>
 #include <xrpl/server/detail/LowestLayer.h>
+
 #include <boost/beast/core/multi_buffer.hpp>
 #include <boost/beast/http/message.hpp>
 #include <boost/beast/websocket.hpp>
+#include <boost/logic/tribool.hpp>
 
-#include <cassert>
 #include <functional>
+#include <list>
 
 namespace ripple {
 
@@ -508,7 +512,9 @@ template <class String>
 void
 BaseWSPeer<Handler, Impl>::fail(error_code ec, String const& what)
 {
-    assert(strand_.running_in_this_thread());
+    ASSERT(
+        strand_.running_in_this_thread(),
+        "ripple::BaseWSPeer::fail : strand in this thread");
 
     cancel_timer();
     if (!ec_ && ec != boost::asio::error::operation_aborted)