Crashes when using the class JsonPrimitive.

[Mozhan]

gson Version: 2.7
Operating System: Ubuntu 16.04.4 LTS, McOs High Sierra (version 10.13.5)
Machine: single machine (laptop)
Junit version: 4.12

Steps to reproduce

Please run the attached test suite for the class com.google.gson.JsonPrimitive.

JsonPrimitiveTestSuite.txt

Context:

The tests I provided come from a static analysis prototype I have been working on as part of a research project. The tool analyses a specified dependency of a project to identify risky API calls which may potentially lead to runtime exceptions. Runtime exceptions may occur either because 1) an API is lacking sufficient documentation, or 2) usage of the API does not conform to the specification, or 3) API wrapper does not indicate the API specification as part of its own specification. The prototype then automatically generates test cases which show how such exceptions may be triggered.

I have been evaluating the tool on various open source projects. In the case of Gson-2.7, JDK API calls are analyzed. Each provided test case triggers a unique crash due to how data are forwarded to the JDK APIs (e.g. Short.parseShort(...)).

Possible fixes

Before calling the JDK APIs, there should be some checks on the forwarded values.

[ashutoshcp]

For non Number values, the API throws NumberFormatException. you need to make changes at your implementation level. you can use try catch and if it goes to catch , it's not a number and you can just leave those values or prompt them to console if u want or u can use them in ur ways.

[Mozhan]

Hi @ashu01
Actually from what I see, NumberformatException, is neither specified in the documentation nor is it in the method signatures of the methods being tested, namely: getAsByte, getAsShort, and getAsCharacter.

So I would say documentation for the above methods could be extended by adding @throws NumberFormatException.

[Mozhan]

@ashu01 @swankjesse @joel-leitch @inder123
Since I would like to evaluate the prototype which generated the failing tests for com.google.gson.JsonPrimitive, I wonder:

Would you confirm that 1) adding internal checks on the values before they are forwarded to JDK APIs or 2) specifying the potential runtime exceptions in the documentation/method signatures could help prevent the triggered crashes?