Use internerr() or BUG() instead of assert()

The problem with assert() is that it does not print the contents of
the variables. It also can be disabled on NDEBUG. But we always want
these consistency checks no matter what, and they are not performance
sensitive anyway.

Enable -Wno-nonnull-compare so that we can keep doing run-time non-NULL
checks in functions, instead of just compile-time checks.

35 files changed, 235 insertions, 115 deletions

diff --git a/TODO b/TODO
index bc2dee0a9..a4f485da4 100644
--- a/TODO
+++ b/TODO
@@ -28,7 +28,6 @@ TODO
    - Do more unused header include removal.
    - Add needed includes to all header files.
    - Get rid of useless "unsigned" modifiers.
-   - Use internerr instead of assert, and print more meaningful messages.
    - Use enums for currently hardcoded literals (replacingfilesandsaid,
      filetriggers_edited, etc).
    - Do not use nfmalloc (and friends) for non in-core db memory.
diff --git a/debian/changelog b/debian/changelog
index 0574fb529..3d59b4278 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -44,6 +44,9 @@ dpkg (1.19.1) UNRELEASED; urgency=medium
     initialized, instead of non-zero.
   * Switch a fatal() call in start-stop-daemon into the new BUG() macro,
     because it is really an internal error.
+  * Switch all assert() calls (except in update-alternatives) into internerr()
+    or BUG() calls, to get way better reporting with variable contents and
+    descriptions, and to make them always present independent of NDEBUG.
   * Architecture support:
     - Add support for riscv64 CPU. Closes: #822914
       Thanks to Manuel A. Fernandez Montecelo <mafm@debian.org>
diff --git a/debian/rules b/debian/rules
index 27a2499ef..d5e13c67f 100755
--- a/debian/rules
+++ b/debian/rules
@@ -3,7 +3,12 @@
 # Copyright © 2004 Scott James Remnant <scott@netsplit.com>
 # Copyright © 2006-2012 Guillem Jover <guillem@debian.org>
 
-WFLAGS := -Wall -Wextra -Wno-unused-parameter -Wno-missing-field-initializers
+WFLAGS := \
+	-Wall -Wextra \
+	-Wno-missing-field-initializers \
+	-Wno-nonnull-compare \
+	-Wno-unused-parameter \
+	$(nil)
 
 # Use the in-tree dpkg-buildflags
 dpkg_buildflags = \
diff --git a/debian/usertags b/debian/usertags
index 5ef5a449a..97a6d8d44 100644
--- a/debian/usertags
+++ b/debian/usertags
@@ -15,7 +15,8 @@ Generic tags
 usertag			description
 -------			-----------
 
-assert			Errors caused by assert().
+assert			Errors caused by assert() (obsoleted by internerr()
+			  usage).
 segfault		Errors that cause segmentation faults.
 conffile		Issues with configuration file handling.
 symlink			Issues related to symlink handling.
diff --git a/dpkg-split/join.c b/dpkg-split/join.c
index 0a61bc921..b5e14712e 100644
--- a/dpkg-split/join.c
+++ b/dpkg-split/join.c
@@ -21,7 +21,6 @@
 #include <config.h>
 #include <compat.h>
 
-#include <assert.h>
 #include <limits.h>
 #include <string.h>
 #include <fcntl.h>
@@ -120,7 +119,9 @@ do_join(const char *const *argv)
   refi= NULL;
   for (pq= queue; pq; pq= pq->nextinqueue)
     if (!refi || pq->info.thispartn < refi->thispartn) refi= &pq->info;
-  assert(refi);
+  if (refi == NULL)
+    internerr("empty deb part queue");
+
   partlist= nfmalloc(sizeof(struct partinfo*)*refi->maxpartn);
   for (i = 0; i < refi->maxpartn; i++)
     partlist[i] = NULL;
diff --git a/dselect/baselist.cc b/dselect/baselist.cc
index d74ed439d..80fee6935 100644
--- a/dselect/baselist.cc
+++ b/dselect/baselist.cc
@@ -25,7 +25,6 @@
 
 #include <sys/ioctl.h>
 
-#include <assert.h>
 #include <errno.h>
 #include <string.h>
 #include <termios.h>
@@ -155,7 +154,10 @@ baselist::draw_column_item(column &col, int y, const char *item)
 
 void baselist::setheights() {
   int y= ymax - (title_height + colheads_height + thisstate_height);
-  assert(y>=1);
+
+  if (y < 1)
+    internerr("widget y=%d < 1", y);
+
   if (showinfo==2 && y>=7) {
     list_height= 5;
     whatinfo_height= 1;
diff --git a/dselect/main.cc b/dselect/main.cc
index 55ced3351..e634e7447 100644
--- a/dselect/main.cc
+++ b/dselect/main.cc
@@ -26,7 +26,6 @@
 #include <sys/types.h>
 #include <sys/wait.h>
 
-#include <assert.h>
 #include <errno.h>
 #include <limits.h>
 #if HAVE_LOCALE_H
diff --git a/dselect/methlist.cc b/dselect/methlist.cc
index 331bf0562..6cc280cf4 100644
--- a/dselect/methlist.cc
+++ b/dselect/methlist.cc
@@ -22,7 +22,6 @@
 #include <config.h>
 #include <compat.h>
 
-#include <assert.h>
 #include <errno.h>
 #include <string.h>
 #include <stdio.h>
@@ -129,10 +128,16 @@ methodlist::methodlist() : baselist(&methodlistbindings) {
 
   struct dselect_option *opt, **ip;
   for (opt=options, ip=table, nitems=0; opt; opt=opt->next, nitems++) {
-    if (opt == coption) { assert(newcursor==-1); newcursor= nitems; }
+    if (opt == coption) {
+      if (newcursor != -1)
+        internerr("multiple methods with same index");
+      newcursor = nitems;
+    }
     *ip++= opt;
   }
-  assert(nitems==noptions);
+  if (nitems != noptions)
+    internerr("inconsistent number of items: ntimes=%d != noptions=%d",
+              nitems, noptions);
 
   if (newcursor==-1) newcursor= 0;
   setcursor(newcursor);
diff --git a/dselect/method.cc b/dselect/method.cc
index 74ac9842c..76863bc34 100644
--- a/dselect/method.cc
+++ b/dselect/method.cc
@@ -27,7 +27,6 @@
 #include <sys/file.h>
 #include <sys/wait.h>
 
-#include <assert.h>
 #include <errno.h>
 #include <limits.h>
 #include <string.h>
@@ -71,8 +70,10 @@ sthfailed(const char * reasoning)
 static void cu_unlockmethod(int, void**) {
   struct flock fl;
 
-  assert(methodlockfile);
-  assert(methlockfd >= 0);
+  if (methodlockfile == NULL)
+    internerr("method lock file is NULL");
+  if (methlockfd < 0)
+    internerr("method lock fd is %d < 0", methlockfd);
   fl.l_type=F_UNLCK; fl.l_whence= SEEK_SET; fl.l_start=fl.l_len=0;
   if (fcntl(methlockfd,F_SETLK,&fl) == -1)
     sthfailed(_("cannot unlock access method area"));
diff --git a/dselect/methparse.cc b/dselect/methparse.cc
index 131e79fbf..a1ab31a8b 100644
--- a/dselect/methparse.cc
+++ b/dselect/methparse.cc
@@ -26,7 +26,6 @@
 #include <sys/stat.h>
 #include <sys/wait.h>
 
-#include <assert.h>
 #include <errno.h>
 #include <limits.h>
 #include <string.h>
@@ -292,7 +291,9 @@ void getcurrentopt() {
 void writecurrentopt() {
   struct atomic_file *file;
 
-  assert(methoptfile);
+  if (methoptfile == NULL)
+    internerr("method options filename is NULL");
+
   file = atomic_file_new(methoptfile, (enum atomic_file_flags)0);
   atomic_file_open(file);
   if (fprintf(file->fp, "%s %s\n", coption->meth->name, coption->name) == EOF)
diff --git a/dselect/pkgdepcon.cc b/dselect/pkgdepcon.cc
index 87886ffb6..2104d2c8c 100644
--- a/dselect/pkgdepcon.cc
+++ b/dselect/pkgdepcon.cc
@@ -22,7 +22,6 @@
 #include <config.h>
 #include <compat.h>
 
-#include <assert.h>
 #include <string.h>
 #include <stdio.h>
 
@@ -401,7 +400,8 @@ packagelist::deppossatisfied(deppossi *possi, perpackagestate **fixbyupgrade)
     // been specified, in which case we don't need to look at the rest
     // anyway.
     if (useavailable(&possi->ed->pkg)) {
-      assert(want == PKG_WANT_INSTALL);
+      if (want != PKG_WANT_INSTALL)
+        internerr("depossi package is not want-install, is %d", want);
       return versionsatisfied(&possi->ed->pkg.available, possi);
     } else {
       if (versionsatisfied(&possi->ed->pkg.installed, possi))
diff --git a/dselect/pkglist.cc b/dselect/pkglist.cc
index 105f3c1aa..cb144e773 100644
--- a/dselect/pkglist.cc
+++ b/dselect/pkglist.cc
@@ -23,7 +23,6 @@
 #include <config.h>
 #include <compat.h>
 
-#include <assert.h>
 #include <errno.h>
 #include <string.h>
 #include <stdlib.h>
@@ -113,7 +112,10 @@ void packagelist::addheading(enum ssavailval ssavail,
                              pkgpriority priority,
                              const char *otherpriority,
                              const char *section) {
-  assert(nitems <= nallocated);
+  if (nitems > nallocated)
+    internerr("inconsistent state: ntimes=%d > nallocated=%d",
+              nitems, nallocated);
+
   if (nitems == nallocated) {
     nallocated += nallocated+50;
     struct perpackagestate **newtable= new struct perpackagestate*[nallocated];
@@ -266,7 +268,9 @@ void packagelist::sortmakeheads() {
   discardheadings();
   ensurestatsortinfo();
   sortinplace();
-  assert(nitems);
+
+  if (nitems == 0)
+    internerr("cannot sort 0 items");
 
   debug(dbg_general,
         "packagelist[%p]::sortmakeheads() sortorder=%d statsortorder=%d",
@@ -275,7 +279,9 @@ void packagelist::sortmakeheads() {
   int nrealitems= nitems;
   addheading(ssa_none, sss_none, PKG_PRIO_UNSET, nullptr, nullptr);
 
-  assert(sortorder != so_unsorted);
+  if (sortorder == so_unsorted)
+    internerr("cannot sort unsorted order");
+
   if (sortorder == so_alpha && statsortorder == sso_unsorted) { sortinplace(); return; }
 
   // Important: do not save pointers into table in this function, because
@@ -287,7 +293,8 @@ void packagelist::sortmakeheads() {
   int a;
   for (a=0; a<nrealitems; a++) {
     thispkg= table[a]->pkg;
-    assert(thispkg->set->name);
+    if (thispkg->set->name == NULL)
+      internerr("package set has no name at table index %d", a);
     int ssdiff= 0;
     ssavailval ssavail= ssa_none;
     ssstateval ssstate= sss_none;
@@ -456,11 +463,13 @@ perpackagestate::free(bool recursive)
   if (pkg->set->name) {
     if (modstatdb_get_status() == msdbrw_write) {
       if (uprec) {
-        assert(recursive);
+        if (!recursive)
+          internerr("unexpected non-recursive free requested");
         uprec->selected= selected;
         pkg->clientdata= uprec;
       } else {
-        assert(!recursive);
+        if (recursive)
+          internerr("unexpected recursive free requested");
         if (pkg->want != selected &&
             !(pkg->want == PKG_WANT_UNKNOWN && selected == PKG_WANT_PURGE)) {
           pkg->want= selected;
diff --git a/dselect/pkgsublist.cc b/dselect/pkgsublist.cc
index 30b202f7d..d25334f4b 100644
--- a/dselect/pkgsublist.cc
+++ b/dselect/pkgsublist.cc
@@ -22,7 +22,6 @@
 #include <config.h>
 #include <compat.h>
 
-#include <assert.h>
 #include <string.h>
 #include <stdio.h>
 
@@ -102,8 +101,12 @@ void packagelist::addunavailable(deppossi *possi) {
   if (!recursive) return;
   if (alreadydone(&unavdone,possi)) return;
 
-  assert(possi->up->up->clientdata);
-  assert(possi->up->up->clientdata->uprec);
+  if (possi->up->up->clientdata == nullptr)
+    internerr("deppossi from package %s has nullptr clientdata",
+              pkg_name(possi->up->up, pnaw_always));
+  if (possi->up->up->clientdata->uprec == nullptr)
+    internerr("deppossi from package %s has nullptr clientdata's uprec",
+              pkg_name(possi->up->up, pnaw_always));
 
   varbuf& vb= possi->up->up->clientdata->relations;
   vb(possi->ed->name);
diff --git a/dselect/pkgtop.cc b/dselect/pkgtop.cc
index 0da1f109d..6e233a1f9 100644
--- a/dselect/pkgtop.cc
+++ b/dselect/pkgtop.cc
@@ -22,7 +22,6 @@
 #include <config.h>
 #include <compat.h>
 
-#include <assert.h>
 #include <string.h>
 #include <stdio.h>
 
@@ -42,7 +41,9 @@ pkgprioritystring(const struct pkginfo *pkg)
   } else if (pkg->priority == PKG_PRIO_OTHER) {
     return pkg->otherpriority;
   } else {
-    assert(pkg->priority <= PKG_PRIO_UNKNOWN);
+    if (pkg->priority > PKG_PRIO_UNKNOWN)
+      internerr("package %s has out-of-range priority %d",
+                pkg_name(pkg, pnaw_always), pkg->priority);
     return gettext(prioritystrings[pkg->priority]);
   }
 }
diff --git a/lib/dpkg/arch.c b/lib/dpkg/arch.c
index 099957170..36b482972 100644
--- a/lib/dpkg/arch.c
+++ b/lib/dpkg/arch.c
@@ -23,7 +23,6 @@
 #include <config.h>
 #include <compat.h>
 
-#include <assert.h>
 #include <limits.h>
 #include <string.h>
 #include <stdbool.h>
@@ -59,7 +58,8 @@ dpkg_arch_name_is_illegal(const char *name)
 	static char buf[150];
 	const char *p = name;
 
-	assert(name);
+	if (name == NULL)
+		internerr("arch name argument is NULL");
 	if (!*p)
 		return _("may not be empty string");
 	if (!c_isalnum(*p))
diff --git a/lib/dpkg/dbmodify.c b/lib/dpkg/dbmodify.c
index ec1102107..9baa58373 100644
--- a/lib/dpkg/dbmodify.c
+++ b/lib/dpkg/dbmodify.c
@@ -27,7 +27,6 @@
 #include <sys/types.h>
 #include <sys/wait.h>
 
-#include <assert.h>
 #include <errno.h>
 #include <limits.h>
 #include <string.h>
@@ -307,13 +306,19 @@ modstatdb_get_status(void)
 void modstatdb_checkpoint(void) {
   int i;
 
-  assert(cstatus >= msdbrw_write);
+  if (cstatus < msdbrw_write)
+    internerr("modstatdb status '%d' is not writtable", cstatus);
+
   writedb(statusfile, wdb_must_sync);
 
   for (i=0; i<nextupdate; i++) {
     sprintf(updatefnrest, IMPORTANTFMT, i);
+
     /* Have we made a real mess? */
-    assert(strlen(updatefnrest) <= IMPORTANTMAXLEN);
+    if (strlen(updatefnrest) > IMPORTANTMAXLEN)
+      internerr("modstatdb update entry name '%s' longer than %d",
+                updatefnrest, IMPORTANTMAXLEN);
+
     if (unlink(updatefnbuf))
       ohshite(_("failed to remove my own update file %.255s"),updatefnbuf);
   }
@@ -349,7 +354,8 @@ void modstatdb_shutdown(void) {
 static void
 modstatdb_note_core(struct pkginfo *pkg)
 {
-  assert(cstatus >= msdbrw_write);
+  if (cstatus < msdbrw_write)
+    internerr("modstatdb status '%d' is not writtable", cstatus);
 
   varbuf_reset(&uvb);
   varbufrecord(&uvb, pkg, &pkg->installed);
@@ -377,7 +383,9 @@ modstatdb_note_core(struct pkginfo *pkg)
   dir_sync_path(updatesdir);
 
   /* Have we made a real mess? */
-  assert(strlen(updatefnrest) <= IMPORTANTMAXLEN);
+  if (strlen(updatefnrest) > IMPORTANTMAXLEN)
+    internerr("modstatdb update entry name '%s' longer than %d",
+              updatefnrest, IMPORTANTMAXLEN);
 
   nextupdate++;
 
diff --git a/lib/dpkg/dump.c b/lib/dpkg/dump.c
index a04f673d9..8086cf77f 100644
--- a/lib/dpkg/dump.c
+++ b/lib/dpkg/dump.c
@@ -30,7 +30,6 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 
-#include <assert.h>
 #include <errno.h>
 #include <string.h>
 #include <unistd.h>
@@ -57,7 +56,9 @@ w_name(struct varbuf *vb,
        const struct pkginfo *pkg, const struct pkgbin *pkgbin,
        enum fwriteflags flags, const struct fieldinfo *fip)
 {
-  assert(pkg->set->name);
+  if (pkg->set->name == NULL)
+    internerr("pkgset has no name");
+
   if (flags&fw_printheader)
     varbuf_add_str(vb, "Package: ");
   varbuf_add_str(vb, pkg->set->name);
@@ -230,7 +231,11 @@ w_priority(struct varbuf *vb,
 {
   if (pkg->priority == PKG_PRIO_UNKNOWN)
     return;
-  assert(pkg->priority <= PKG_PRIO_UNKNOWN);
+
+  if (pkg->priority > PKG_PRIO_UNKNOWN)
+    internerr("package %s has out-of-range priority %d",
+              pkgbin_name(pkg, pkgbin, pnaw_always), pkg->priority);
+
   if (flags&fw_printheader)
     varbuf_add_str(vb, "Priority: ");
   varbuf_add_str(vb, pkg_priority_name(pkg));
@@ -245,38 +250,46 @@ w_status(struct varbuf *vb,
 {
   if (pkgbin != &pkg->installed)
     return;
-  assert(pkg->want <= PKG_WANT_PURGE);
-  assert(pkg->eflag <= PKG_EFLAG_REINSTREQ);
 
-#define PEND pkg->trigpend_head
-#define AW pkg->trigaw.head
+  if (pkg->want > PKG_WANT_PURGE)
+    internerr("package %s has unknown want state %d",
+              pkgbin_name(pkg, pkgbin, pnaw_always), pkg->want);
+  if (pkg->eflag > PKG_EFLAG_REINSTREQ)
+    internerr("package %s has unknown error state %d",
+              pkgbin_name(pkg, pkgbin, pnaw_always), pkg->eflag);
+
   switch (pkg->status) {
   case PKG_STAT_NOTINSTALLED:
   case PKG_STAT_CONFIGFILES:
-    assert(!PEND);
-    assert(!AW);
+    if (pkg->trigpend_head || pkg->trigaw.head)
+      internerr("package %s in state %s, has awaited or pending triggers",
+              pkgbin_name(pkg, pkgbin, pnaw_always), pkg_status_name(pkg));
     break;
   case PKG_STAT_HALFINSTALLED:
   case PKG_STAT_UNPACKED:
   case PKG_STAT_HALFCONFIGURED:
-    assert(!PEND);
+    if (pkg->trigpend_head)
+      internerr("package %s in state %s, has pending triggers",
+              pkgbin_name(pkg, pkgbin, pnaw_always), pkg_status_name(pkg));
     break;
   case PKG_STAT_TRIGGERSAWAITED:
-    assert(AW);
+    if (pkg->trigaw.head == NULL)
+      internerr("package %s in state %s, has no awaited triggers",
+                pkgbin_name(pkg, pkgbin, pnaw_always), pkg_status_name(pkg));
     break;
   case PKG_STAT_TRIGGERSPENDING:
-    assert(PEND);
-    assert(!AW);
+    if (pkg->trigpend_head == NULL || pkg->trigaw.head)
+      internerr("package %s in stata %s, has awaited or no pending triggers",
+              pkgbin_name(pkg, pkgbin, pnaw_always), pkg_status_name(pkg));
     break;
   case PKG_STAT_INSTALLED:
-    assert(!PEND);
-    assert(!AW);
+    if (pkg->trigpend_head || pkg->trigaw.head)
+      internerr("package %s in state %s, has awaited or pending triggers",
+              pkgbin_name(pkg, pkgbin, pnaw_always), pkg_status_name(pkg));
     break;
   default:
     internerr("unknown package status '%d'", pkg->status);
   }
-#undef PEND
-#undef AW
 
   if (flags&fw_printheader)
     varbuf_add_str(vb, "Status: ");
@@ -295,7 +308,9 @@ void varbufdependency(struct varbuf *vb, struct dependency *dep) {
 
   possdel= "";
   for (dop= dep->list; dop; dop= dop->next) {
-    assert(dop->up == dep);
+    if (dop->up != dep)
+      internerr("dependency and deppossi not linked properly");
+
     varbuf_add_str(vb, possdel);
     possdel = " | ";
     varbuf_add_str(vb, dop->ed->name);
@@ -339,7 +354,10 @@ w_dependency(struct varbuf *vb,
 
   for (dyp = pkgbin->depends; dyp; dyp = dyp->next) {
     if (dyp->type != fip->integer) continue;
-    assert(dyp->up == pkg);
+
+    if (dyp->up != pkg)
+      internerr("dependency and package %s not linked properly",
+                pkgbin_name(pkg, pkgbin, pnaw_always));
 
     if (dep_found) {
       varbuf_add_str(vb, ", ");
@@ -389,8 +407,10 @@ w_trigpend(struct varbuf *vb,
   if (pkgbin == &pkg->available || !pkg->trigpend_head)
     return;
 
-  assert(pkg->status >= PKG_STAT_TRIGGERSAWAITED &&
-         pkg->status <= PKG_STAT_TRIGGERSPENDING);
+  if (pkg->status < PKG_STAT_TRIGGERSAWAITED ||
+      pkg->status > PKG_STAT_TRIGGERSPENDING)
+    internerr("package %s in non-trigger state %s, has pending triggers",
+              pkgbin_name(pkg, pkgbin, pnaw_always), pkg_status_name(pkg));
 
   if (flags & fw_printheader)
     varbuf_add_str(vb, "Triggers-Pending:");
@@ -412,8 +432,10 @@ w_trigaw(struct varbuf *vb,
   if (pkgbin == &pkg->available || !pkg->trigaw.head)
     return;
 
-  assert(pkg->status > PKG_STAT_CONFIGFILES &&
-         pkg->status <= PKG_STAT_TRIGGERSAWAITED);
+  if (pkg->status <= PKG_STAT_CONFIGFILES ||
+      pkg->status > PKG_STAT_TRIGGERSAWAITED)
+    internerr("package %s in state %s, has awaited triggers",
+              pkgbin_name(pkg, pkgbin, pnaw_always), pkg_status_name(pkg));
 
   if (flags & fw_printheader)
     varbuf_add_str(vb, "Triggers-Awaited:");
diff --git a/lib/dpkg/file.c b/lib/dpkg/file.c
index f8afdeb8a..cd261222c 100644
--- a/lib/dpkg/file.c
+++ b/lib/dpkg/file.c
@@ -25,7 +25,6 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 
-#include <assert.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <unistd.h>
@@ -79,7 +78,8 @@ file_unlock(int lockfd, const char *lock_desc)
 {
 	struct flock fl;
 
-	assert(lockfd >= 0);
+	if (lockfd < 0)
+		internerr("lock fd is %d < 0", lockfd);
 
 	file_lock_setup(&fl, F_UNLCK);
 
diff --git a/lib/dpkg/parse.c b/lib/dpkg/parse.c
index d75c54458..221067881 100644
--- a/lib/dpkg/parse.c
+++ b/lib/dpkg/parse.c
@@ -28,7 +28,6 @@
 #include <sys/mman.h>
 #endif
 
-#include <assert.h>
 #include <fcntl.h>
 #include <string.h>
 #include <unistd.h>
@@ -493,7 +492,10 @@ pkg_parse_copy(struct parsedb_state *ps,
     dst_pkg->trigpend_head = src_pkg->trigpend_head;
     dst_pkg->trigaw = src_pkg->trigaw;
     for (ta = dst_pkg->trigaw.head; ta; ta = ta->sameaw.next) {
-      assert(ta->aw == src_pkg);
+      if (ta->aw != src_pkg)
+        internerr("trigger awaited package %s and origin package %s not linked properly",
+                  pkg_name(ta->aw, pnaw_always),
+                  pkgbin_name(src_pkg, src_pkgbin, pnaw_always));
       ta->aw = dst_pkg;
       /* ->othertrigaw_head is updated by trig_note_aw in *(pkg_db_find())
        * rather than in dst_pkg. */
diff --git a/lib/dpkg/path-remove.c b/lib/dpkg/path-remove.c
index ab26b4a8d..ef9cde7b5 100644
--- a/lib/dpkg/path-remove.c
+++ b/lib/dpkg/path-remove.c
@@ -24,7 +24,6 @@
 
 #include <sys/stat.h>
 
-#include <assert.h>
 #include <errno.h>
 #include <string.h>
 #include <unistd.h>
@@ -122,7 +121,8 @@ path_remove_tree(const char *pathname)
 	const char *u;
 
 	u = path_skip_slash_dotslash(pathname);
-	assert(*u);
+	if (u[0] == '\0')
+		internerr("pathname '%s' reduces to nothing", pathname);
 
 	debug(dbg_eachfile, "%s '%s'", __func__, pathname);
 	if (!rmdir(pathname))
diff --git a/lib/dpkg/pkg-array.c b/lib/dpkg/pkg-array.c
index 24c6dc0e2..cf5c34d3f 100644
--- a/lib/dpkg/pkg-array.c
+++ b/lib/dpkg/pkg-array.c
@@ -22,7 +22,6 @@
 #include <config.h>
 #include <compat.h>
 
-#include <assert.h>
 #include <string.h>
 #include <stdlib.h>
 
@@ -74,7 +73,9 @@ pkg_array_init_from_db(struct pkg_array *a)
 		a->pkgs[i] = pkg;
 	pkg_db_iter_free(iter);
 
-	assert(i == a->n_pkgs);
+	if (i != a->n_pkgs)
+		internerr("inconsistent state in pkg array: i=%d != npkgs=%d",
+		          i, a->n_pkgs);
 }
 
 /**
diff --git a/lib/dpkg/pkg-db.c b/lib/dpkg/pkg-db.c
index 300c1cad8..7135450a3 100644
--- a/lib/dpkg/pkg-db.c
+++ b/lib/dpkg/pkg-db.c
@@ -24,7 +24,6 @@
 #include <config.h>
 #include <compat.h>
 
-#include <assert.h>
 #include <string.h>
 #include <stdlib.h>
 
@@ -171,8 +170,10 @@ pkg_db_get_pkg(struct pkgset *set, const struct dpkg_arch *arch)
 {
   struct pkginfo *pkg, **pkgp;
 
-  assert(arch);
-  assert(arch->type != DPKG_ARCH_NONE);
+  if (arch == NULL)
+    internerr("arch argument is NULL");
+  if (arch->type == DPKG_ARCH_NONE)
+    internerr("arch argument is none");
 
   pkg = &set->pkg;
 
diff --git a/lib/dpkg/pkg.c b/lib/dpkg/pkg.c
index 1fc3d0c21..4141fddb2 100644
--- a/lib/dpkg/pkg.c
+++ b/lib/dpkg/pkg.c
@@ -22,9 +22,9 @@
 #include <config.h>
 #include <compat.h>
 
-#include <assert.h>
 #include <string.h>
 
+#include <dpkg/ehandle.h>
 #include <dpkg/string.h>
 #include <dpkg/dpkg-db.h>
 #include <dpkg/pkg.h>
@@ -42,7 +42,9 @@ pkg_set_status(struct pkginfo *pkg, enum pkgstatus status)
 	else if (status == PKG_STAT_NOTINSTALLED)
 		pkg->set->installed_instances--;
 
-	assert(pkg->set->installed_instances >= 0);
+	if (pkg->set->installed_instances < 0)
+		internerr("pkgset %s went into negative installed instances %d",
+		          pkg->set->name, pkg->set->installed_instances);
 
 	pkg->status = status;
 }
diff --git a/lib/dpkg/triglib.c b/lib/dpkg/triglib.c
index 57bd2a66b..a067d1450 100644
--- a/lib/dpkg/triglib.c
+++ b/lib/dpkg/triglib.c
@@ -26,7 +26,6 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 
-#include <assert.h>
 #include <errno.h>
 #include <stdlib.h>
 #include <unistd.h>
@@ -104,7 +103,9 @@ trig_clear_awaiters(struct pkginfo *notpend)
 	struct trigaw *ta;
 	struct pkginfo *aw;
 
-	assert(!notpend->trigpend_head);
+	if (notpend->trigpend_head)
+		internerr("package %s has pending triggers",
+		          pkg_name(notpend, pnaw_always));
 
 	ta = notpend->othertrigaw_head;
 	notpend->othertrigaw_head = NULL;
@@ -400,7 +401,10 @@ trk_file_interest_change(const char *trig, struct pkginfo *pkg,
 
 	fnn = trigh.namenode_find(trig, signum <= 0);
 	if (!fnn) {
-		assert(signum < 0);
+		if (signum >= 0)
+			internerr("lost filename node '%s' for package %s "
+			          "triggered to add", trig,
+			          pkgbin_name(pkg, pkgbin, pnaw_always));
 		return;
 	}
 
@@ -627,7 +631,10 @@ trig_cicb_interest_change(const char *trig, struct pkginfo *pkg,
 {
 	const struct trigkindinfo *tki = trig_classify_byname(trig);
 
-	assert(filetriggers_edited >= 0);
+	if (filetriggers_edited < 0)
+		internerr("trigger control file for package %s not read",
+		          pkgbin_name(pkg, pkgbin, pnaw_always));
+
 	tki->interest_change(trig, pkg, pkgbin, signum, opts);
 }
 
diff --git a/m4/dpkg-compiler.m4 b/m4/dpkg-compiler.m4
index a2e68e372..a6192f63a 100644
--- a/m4/dpkg-compiler.m4
+++ b/m4/dpkg-compiler.m4
@@ -56,6 +56,7 @@ AC_DEFUN([DPKG_CHECK_COMPILER_WARNINGS], [
   DPKG_CHECK_COMPILER_FLAG([-Wmissing-declarations])
   DPKG_CHECK_COMPILER_FLAG([-Wmissing-format-attribute])
   DPKG_CHECK_COMPILER_FLAG([-Wno-missing-field-initializers])
+  DPKG_CHECK_COMPILER_FLAG([-Wno-nonnull-compare])
   DPKG_CHECK_COMPILER_FLAG([-Wno-tautological-constant-out-of-range-compare])
   DPKG_CHECK_COMPILER_FLAG([-Wno-unused-parameter])
   DPKG_CHECK_COMPILER_FLAG([-Wnull-dereference])
diff --git a/src/archives.c b/src/archives.c
index b82ee4f56..113b76c3d 100644
--- a/src/archives.c
+++ b/src/archives.c
@@ -29,7 +29,6 @@
 #include <sys/time.h>
 #include <sys/stat.h>
 
-#include <assert.h>
 #include <errno.h>
 #include <string.h>
 #include <time.h>
@@ -631,7 +630,8 @@ linktosameexistingdir(const struct tar_entry *ti, const char *fname,
     varbuf_add_str(symlinkfn, instdir);
   } else {
     lastslash= strrchr(fname, '/');
-    assert(lastslash);
+    if (lastslash == NULL)
+      internerr("tar entry filename '%s' does not contain '/'", fname);
     varbuf_add_buf(symlinkfn, fname, (lastslash - fname) + 1);
   }
   varbuf_add_str(symlinkfn, ti->linkname);
@@ -1267,7 +1267,11 @@ void check_breaks(struct dependency *dep, struct pkginfo *pkg,
     char action[512];
 
     ensure_package_clientdata(fixbydeconf);
-    assert(fixbydeconf->clientdata->istobe == PKG_ISTOBE_NORMAL);
+
+    if (fixbydeconf->clientdata->istobe != PKG_ISTOBE_NORMAL)
+      internerr("package %s being fixed by deconf is not to be normal, "
+                "is to be %d",
+                pkg_name(pkg, pnaw_always), fixbydeconf->clientdata->istobe);
 
     sprintf(action, _("installation of %.250s"),
             pkgbin_name(pkg, &pkg->available, pnaw_nonambig));
@@ -1329,8 +1333,13 @@ void check_conflict(struct dependency *dep, struct pkginfo *pkg,
             fixbyrm->want != PKG_WANT_HOLD) ||
            does_replace(pkg, &pkg->available, fixbyrm, &fixbyrm->installed)) &&
           (!fixbyrm->installed.essential || fc_removeessential)))) {
-      assert(fixbyrm->clientdata->istobe == PKG_ISTOBE_NORMAL ||
-             fixbyrm->clientdata->istobe == PKG_ISTOBE_DECONFIGURE);
+
+      if (fixbyrm->clientdata->istobe != PKG_ISTOBE_NORMAL &&
+          fixbyrm->clientdata->istobe != PKG_ISTOBE_DECONFIGURE)
+        internerr("package %s to be fixed by removal is not to be normal "
+                  "nor deconfigure, is to be %d",
+                  pkg_name(pkg, pnaw_always), fixbyrm->clientdata->istobe);
+
       fixbyrm->clientdata->istobe = PKG_ISTOBE_REMOVE;
       notice(_("considering removing %s in favour of %s ..."),
              pkg_name(fixbyrm, pnaw_nonambig),
diff --git a/src/configure.c b/src/configure.c
index 815882425..3c565c61d 100644
--- a/src/configure.c
+++ b/src/configure.c
@@ -29,7 +29,6 @@
 #include <sys/stat.h>
 #include <sys/wait.h>
 
-#include <assert.h>
 #include <errno.h>
 #include <ctype.h>
 #include <string.h>
@@ -681,7 +680,9 @@ deferred_configure(struct pkginfo *pkg)
 		pkg_set_status(pkg, PKG_STAT_HALFCONFIGURED);
 	}
 
-	assert(pkg->status == PKG_STAT_HALFCONFIGURED);
+	if (pkg->status != PKG_STAT_HALFCONFIGURED)
+		internerr("package %s in state %s, instead of half-configured",
+		          pkg_name(pkg, pnaw_always), pkg_status_name(pkg));
 
 	modstatdb_note(pkg);
 
diff --git a/src/depcon.c b/src/depcon.c
index 924c53ac8..398d06a36 100644
--- a/src/depcon.c
+++ b/src/depcon.c
@@ -27,7 +27,6 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 
-#include <assert.h>
 #include <errno.h>
 #include <stdlib.h>
 #include <unistd.h>
@@ -314,10 +313,14 @@ depisok(struct dependency *dep, struct varbuf *whynot,
    * Allow 250x3 for package names, versions, &c, + 250 for ourselves. */
   char linebuf[1024];
 
-  assert(dep->type == dep_depends || dep->type == dep_predepends ||
-	 dep->type == dep_breaks || dep->type == dep_conflicts ||
-	 dep->type == dep_recommends || dep->type == dep_suggests ||
-	 dep->type == dep_enhances);
+  if (dep->type != dep_depends &&
+      dep->type != dep_predepends &&
+      dep->type != dep_breaks &&
+      dep->type != dep_conflicts &&
+      dep->type != dep_recommends &&
+      dep->type != dep_suggests &&
+      dep->type != dep_enhances)
+    internerr("unknown dependency type %d", dep->type);
 
   if (canfixbyremove)
     *canfixbyremove = NULL;
diff --git a/src/enquiry.c b/src/enquiry.c
index b299f841b..99349ba7c 100644
--- a/src/enquiry.c
+++ b/src/enquiry.c
@@ -26,7 +26,6 @@
 
 #include <sys/types.h>
 
-#include <assert.h>
 #include <string.h>
 #include <fcntl.h>
 #include <unistd.h>
@@ -495,7 +494,9 @@ predeppackage(const char *const *argv)
 
   if (!dep)
     return 1; /* Not found. */
-  assert(pkg);
+  if (pkg == NULL)
+    internerr("unexpected unfound package");
+
   startpkg= pkg;
   pkg->clientdata->istobe = PKG_ISTOBE_PREINSTALL;
 
diff --git a/src/filesdb.c b/src/filesdb.c
index 5050144e8..7f157727d 100644
--- a/src/filesdb.c
+++ b/src/filesdb.c
@@ -32,7 +32,6 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 
-#include <assert.h>
 #include <errno.h>
 #include <string.h>
 #include <pwd.h>
@@ -600,8 +599,13 @@ struct filenamenode *findnamenode(const char *name, enum fnnflags flags) {
 
   pointerp = bins + (str_fnv_hash(name) % (BINS));
   while (*pointerp) {
-    /* XXX: Why is the assert needed? It's checking already added entries. */
-    assert((*pointerp)->name[0] == '/');
+    /* XXX: This should not be needed, but it has been a constant source
+     * of assertions over the years. Hopefully with the internerr() we will
+     * get better diagnostics. */
+    if ((*pointerp)->name[0] != '/')
+      internerr("filename node '%s' does not start with '/'",
+                (*pointerp)->name);
+
     if (strcmp((*pointerp)->name + 1, name) == 0)
       break;
     pointerp= &(*pointerp)->next;
diff --git a/src/packages.c b/src/packages.c
index f68c971ef..ae001757f 100644
--- a/src/packages.c
+++ b/src/packages.c
@@ -27,7 +27,6 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 
-#include <assert.h>
 #include <string.h>
 #include <fcntl.h>
 #include <dirent.h>
@@ -232,7 +231,9 @@ void process_queue(void) {
        * trigger processing, w/o jumping into the next dependtry. */
       dependtry++;
       sincenothing = 0;
-      assert(dependtry <= 4);
+      if (dependtry > 4)
+        internerr("exceeded dependtry %d (sincenothing=%d; queue.length=%d)",
+                  dependtry, sincenothing, queue.length);
     } else if (sincenothing > queue.length * 2 + 2) {
       /* XXX: This probably needs moving into a new dependtry instead. */
       if (progress_bytrigproc && progress_bytrigproc->trigpend_head) {
@@ -242,7 +243,9 @@ void process_queue(void) {
       } else {
         dependtry++;
         sincenothing = 0;
-        assert(dependtry <= 4);
+        if (dependtry > 4)
+          internerr("exceeded dependtry %d (sincenothing=%d, queue.length=%d)",
+                    dependtry, sincenothing, queue.length);
       }
     }
 
@@ -250,7 +253,8 @@ void process_queue(void) {
           pkg_name(pkg, pnaw_always), queue.length, sincenothing, dependtry);
 
     if (pkg->status > PKG_STAT_INSTALLED)
-      internerr("package status (%d) > PKG_STAT_INSTALLED", pkg->status);
+      internerr("package %s status %d is out-of-bounds",
+                pkg_name(pkg, pnaw_always), pkg->status);
 
     if (setjmp(ejbuf)) {
       /* Give up on it from the point of view of other packages, i.e. reset
@@ -295,7 +299,10 @@ void process_queue(void) {
 
     pop_error_context(ehflag_normaltidy);
   }
-  assert(!queue.length);
+
+  if (queue.length)
+    internerr("finished package processing with non-empty queue length %d",
+              queue.length);
 }
 
 /*** Dependency processing - common to --configure and --remove. ***/
@@ -424,7 +431,11 @@ deppossi_ok_found(struct pkginfo *possdependee, struct pkginfo *requiredby,
       return FOUND_OK;
     }
     if (possdependee->status == PKG_STAT_TRIGGERSAWAITED) {
-      assert(possdependee->trigaw.head);
+      if (possdependee->trigaw.head == NULL)
+        internerr("package %s in state %s, has no awaited triggers",
+                  pkg_name(possdependee, pnaw_always),
+                  pkg_status_name(possdependee));
+
       if (removing ||
           !(f_triggers ||
             possdependee->clientdata->istobe == PKG_ISTOBE_INSTALLNEW)) {
diff --git a/src/script.c b/src/script.c
index ac58779d1..ecf4a94a1 100644
--- a/src/script.c
+++ b/src/script.c
@@ -25,7 +25,6 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 
-#include <assert.h>
 #include <errno.h>
 #include <string.h>
 #include <unistd.h>
@@ -137,7 +136,10 @@ maintscript_pre_exec(struct command *cmd)
 	if (instdirlen == 0 || fc_script_chrootless)
 		return cmd->filename;
 
-	assert(strlen(cmd->filename) >= instdirlen);
+	if (strlen(cmd->filename) < instdirlen)
+		internerr("maintscript name '%s' length < instdir length %zd",
+		          cmd->filename, instdirlen);
+
 	return cmd->filename + instdirlen;
 }
 
diff --git a/src/trigproc.c b/src/trigproc.c
index b9681a273..9c73d4ca6 100644
--- a/src/trigproc.c
+++ b/src/trigproc.c
@@ -25,7 +25,6 @@
 
 #include <sys/stat.h>
 
-#include <assert.h>
 #include <fcntl.h>
 #include <stdlib.h>
 
@@ -335,8 +334,11 @@ check_trigger_cycle(struct pkginfo *processing_now)
 	debug(dbg_triggers, "check_triggers_cycle pnow=%s giveup=%s",
 	      pkg_name(processing_now, pnaw_always),
 	      pkg_name(giveup, pnaw_always));
-	assert(giveup->status == PKG_STAT_TRIGGERSAWAITED ||
-	       giveup->status == PKG_STAT_TRIGGERSPENDING);
+	if (giveup->status != PKG_STAT_TRIGGERSAWAITED &&
+	    giveup->status != PKG_STAT_TRIGGERSPENDING)
+		internerr("package %s in non-trigger state %s",
+		          pkg_name(giveup, pnaw_always),
+		          pkg_status_name(giveup));
 	pkg_set_status(giveup, PKG_STAT_HALFCONFIGURED);
 	modstatdb_note(giveup);
 	print_error_perpackage(_("triggers looping, abandoned"),
@@ -367,8 +369,11 @@ trigproc(struct pkginfo *pkg, enum trigproc_type type)
 	if (pkg->trigpend_head) {
 		enum dep_check ok;
 
-		assert(pkg->status == PKG_STAT_TRIGGERSPENDING ||
-		       pkg->status == PKG_STAT_TRIGGERSAWAITED);
+		if (pkg->status != PKG_STAT_TRIGGERSPENDING &&
+		    pkg->status != PKG_STAT_TRIGGERSAWAITED)
+			internerr("package %s in non-trigger state %s",
+			          pkg_name(pkg, pnaw_always),
+			          pkg_status_name(pkg));
 
 		if (dependtry > 1) {
 			gaveup = check_trigger_cycle(pkg);
diff --git a/src/unpack.c b/src/unpack.c
index ed2427206..f43c01e45 100644
--- a/src/unpack.c
+++ b/src/unpack.c
@@ -28,7 +28,6 @@
 #include <sys/stat.h>
 #include <sys/wait.h>
 
-#include <assert.h>
 #include <errno.h>
 #include <string.h>
 #include <time.h>
@@ -859,8 +858,12 @@ pkg_disappear_others(struct pkginfo *pkg)
 
     debug(dbg_veryverbose, "process_archive checking disappearance %s",
           pkg_name(otherpkg, pnaw_always));
-    assert(otherpkg->clientdata->istobe == PKG_ISTOBE_NORMAL ||
-           otherpkg->clientdata->istobe == PKG_ISTOBE_DECONFIGURE);
+
+    if (otherpkg->clientdata->istobe != PKG_ISTOBE_NORMAL &&
+        otherpkg->clientdata->istobe != PKG_ISTOBE_DECONFIGURE)
+      internerr("disappearing package %s is not to be normal or deconfigure, "
+                "is to be %d",
+                pkg_name(otherpkg, pnaw_always), otherpkg->clientdata->istobe);
 
     for (cfile = otherpkg->clientdata->files;
          cfile && strcmp(cfile->namenode->name, "/.") == 0;
@@ -1226,7 +1229,10 @@ void process_archive(const char *filename) {
 
   oldversionstatus= pkg->status;
 
-  assert(oldversionstatus <= PKG_STAT_INSTALLED);
+  if (oldversionstatus > PKG_STAT_INSTALLED)
+    internerr("package %s state %d is out-of-bounds",
+              pkg_name(pkg, pnaw_always), oldversionstatus);
+
   debug(dbg_general,"process_archive oldversionstatus=%s",
         statusstrings[oldversionstatus]);
 
@@ -1516,7 +1522,9 @@ void process_archive(const char *filename) {
     if (otherpkg->installed.arch != pkg->installed.arch)
       continue;
 
-    assert(otherpkg->status == PKG_STAT_NOTINSTALLED);
+    if (otherpkg->status != PKG_STAT_NOTINSTALLED)
+      internerr("other package %s instance in state %s instead of not-installed",
+                pkg_name(otherpkg, pnaw_always), pkg_status_name(otherpkg));
 
     pkg_blank(otherpkg);
   }
diff --git a/utils/start-stop-daemon.c b/utils/start-stop-daemon.c
index 611340ecc..faea3d176 100644
--- a/utils/start-stop-daemon.c
+++ b/utils/start-stop-daemon.c
@@ -80,7 +80,6 @@
 #include <sys/select.h>
 #include <sys/ioctl.h>
 
-#include <assert.h>
 #include <errno.h>
 #include <limits.h>
 #include <time.h>
@@ -959,7 +958,9 @@ parse_schedule(const char *schedule_str)
 			schedule[count].value = repeatat;
 			count++;
 		}
-		assert(count == schedule_length);
+		if (count != schedule_length)
+			BUG("count=%d != schedule_length=%d",
+			    count, schedule_length);
 	}
 }
 
@@ -2520,7 +2521,8 @@ run_stop_schedule(void)
 			else
 				continue;
 		default:
-			assert(!"schedule[].type value must be valid");
+			BUG("schedule[%d].type value %d is not valid",
+			    position, schedule[position].type);
 		}
 	}