Philosophical question on dependencies, etc.

[Brooks Moses]

(This is phrased as a specific question, but I'm asking more because of 
the general implications than because of the details of this one 
situation....)

In looking through how GFC_MAX_SYMBOL_LEN is used, I noticed the following:

* In match.c, gfc_match_name assumes that the value of 
gfc_option.max_identifier_length is not greater than GFC_MAX_SYMBOL_LEN. 
  If this is false, a buffer overflow will occur for identifiers longer 
than GFC_MAX_SYMBOL_LEN.

* In option.c, if one explicitly sets max_identifier_length via a 
command line option, it is checked to ensure that it's less than or 
equal to GFC_MAX_SYMBOL_LEN.  However, if one chooses -std=f2003 or 
-std=f95, then max_identifier_length is set to 63 or 31, respectively, 
without any checking of GFC_MAX_SYMBOL_LEN.

* In gfortran.h, GFC_MAX_SYMBOL_LEN is currently set to 63.

So, match.c assumes that option.c is limiting max_identifier_length, and 
that option.c assumes that gfortran.h is supplying a GFC_MAX_SYMBOL_LEN 
that is sufficient for -std=f2003, but nowhere in any of the three files 
is there any documentation of this interdependency.

Obviously, there should be at least a little documentation of this; I 
don't think that's a question.

My question, though, is whether there should be some active checking to 
ensure that this chain of assumptions hasn't broken down.  Should 
match.c check whether GFC_MAX_SYMBOL_LEN is exceeded, to avoid buffer 
overflows?  Should options.c check to make sure a maximum length of 63 
is allowed, when implementing -std=f2003?

And, if there should be some active checking, is a gcc_assert() a 
sufficient way of doing it?  From a cursory glance, it looks like 
gcc_assert() is defined as a no-op in everything but Stage 1, which I 
think would mean that it's largely a no-op in anything meaningful with 
gfortran -- does the bootstrap process even run the stage-1 gfortran at 
all?  Certainly it doesn't run it on code with errors or weird corner 
cases....

(That's actually a somewhat concerning observation, given that we have 
something like a couple of hundred instances of gcc_assert.  I think it 
might well be worth putting a "#define ENABLE_ASSERT_CHECKING" in 
gfortran.h, at least on non-release branches.)

- Brooks