Proposed improvement to ASSERT

[David A. Moon <Moon%SCRC-TENEX@MIT-MC>]

In going to implement ASSERT, we found that there is a problem with it.
The Laser manual says that "if the handler corrects the error, then the
test is re-evaluated."  However, there is no reasonable way for the
handler to correct the error, because there is no explicit specification
of what variables the test depends on, i.e. what variables the handler
should change the values of in order to correct the error and cause the
test to return true.

A good way to think about this is to consider ASSERT as a generalization
of CHECK-TYPE.  CHECK-TYPE makes a data-type test on one variable;
ASSERT makes any kind of test on any number of variables.

The proposed improvement is to make the syntax for ASSERT include any
number of variables whose values may be altered in order to correct the
error.  As with CHECK-TYPE, we allow the variables actually to be any
reference that SETF understands.  Any other variables that the test
depends on would be parameters that are not considered adjustable.  This
improvement can be made in a nearly upward-compatible way:

	ASSERT test-form [reference]* [string [args]*]

The first subform of the ASSERT special form (macro) is a test form;
if it evaluates to true, ASSERT returns; if it evaluates to false,
an error is signalled using the rest of the subforms.  Only in the
error case are the rest of the subforms evaluated.  If the error is
"corrected", ASSERT starts over at the beginning, evaluating the
test form again.

The remaining subforms, which are all optional, consist of any number of
references to adjustable variables, an error message string, and any
number of message-arguments.  The string is not evaluated and serves as
a delimiter between the references and the message-arguments.  FORMAT is
used with the string and the message-arguments to construct an error
message.  If the string is omitted, a default message such as "Assertion
failed" is used; in this case there must necessarily be no
message-arguments.  The handler of the error has the ability to see and
to change the values of the adjustable variable references, in an
implementation-dependent way.  It is permissible to have no references;
in this case the error may be uncorrectable, depending on the
implementation.

Examples:

	(ASSERT (VALVE-CLOSED-P V1) "Live steam is escaping!")

	(ASSERT (VALVE-CLOSED-P V1) (VALVE-MANUAL-CONTROL V1)
		"Live steam is escaping!")

	(ASSERT (<= MINBASE BASE MAXBASE) BASE
		"Base ~D is out of the range ~D-~D" BASE MINBASE MAXBASE)

	(ASSERT (= (ARRAY-DIMENSION A 1) (ARRAY-DIMENSION B 0)) A B
		"The matrix multiplication ~S x ~S cannot be performed" A B)