- We define Type Conversion Bugs (TCV) as follows:
- A data value is cast or coerced into another data type improperly.
- Fig. 1 depicts TCV causes, attributes and consequences.
Fig 1. Type Conversion Bugs (TCV) Class - click on image for detailed view.
-
The TCV operations are: Cast and Coerce. They reflect the improper use of data types in object data value conversion to another data type.
| Operation Value | Definition |
|---|---|
| Cast | Explicitly convert the value of an object to another data type. |
| Coerce | Implicitly (forced by the Type System) convert the value of a passed in/out argument or the return into the corresponding parameter or return data type. (Type Coercion is known also as Type Juggling.) |
- The graph of causes shows that there are three main causes for declaration bugs: Improper Operation,
Improper Data Value, Improper DataType, and Improper Function.
- constructor
- +(int,double) overload
- function override in subtype.
- An object is declared int, while it should be float.
- A class implements a cloneable or a serializable interface.
- Comparison via = vs. ==.
| Improper Operation | ||
|---|---|---|
| Value | Definition | Examples |
| Missing | The operation is absent. | Missing:
|
| Wrong | An inappropriate data type is specified; or an inappropriate function/operator is used. | |
| Operands | |
|---|---|
| Concept | Definition |
| Data Value | A numeric, text, pointer/address, or boolean value stored in an object’s memory. |
| Data Type | A set of allowed values and the operations allowed over them. |
| Function | An organized block of code that when called takes in data, processes it, and produces a result(s). |
- The graph of consequences shows Improper DataValue and Improper Data Type as consequences.
| Improper Data Value | |
|---|---|
| Concept | Definition |
| Under Range | Data value is smaller than type’s lower range. |
| Over Range | Data value is larger than type’s upper range. |
| Flipped Sign | Sign bit is overwritten from type related calculation. |
| Wrong Argument Value | Inaccurate input data value; i.e., non-verified for harmed semantics. |
| Wrong Object Resolved Value | Object is resolved from wrong scope. |
| Reference vs. Object | Object’s address instead of object’s data value. |
| Wrong Result | Incorrect value from type conversion or computation. |
| Wrap Around | A moved around-the-clock value over its data type upper or lower range, as it exceeds that range. (Integer Over-/Under-flow is a wrapped-around the upper/lower range integer value; may become very small/large and change to the opposite sign.) |
| Truncated Value | Rightmost bits of value that won’t fit type size are cut off. |
| Distorted Value | Incorrect value (although fits type size) due to sign flip or signed/unsigned and vice versa conversions. |
| Rounded Value | Real number value precision loss. |
| Improper Data Type | |
|---|---|
| Concept | Definition |
| Wrong Type | Data type range or structure is not correct. |
| Wrong Type Resolved | Data type is resolved from wrong scope. |
| Wrong Object Resolved Type | Object is resolved from wrong scope,so it’s data type might be wrong. |
| Wrong Sign Type | Unsigned instead of signed data type is specified or vise versa. |
| Wrong Precision Type | Higher precision data type is needed (e.g. double instead of float). |
| Incomplete Type | Specific constructor, method, or overloaded function is missing. |
| Mismatched Argument Type | Argument’s data type is different from function’s parameter data type. |
| Wrong Generic Type | Generic object instantiated via wrong type argument. |
| Confused Subtype | Object invoking an overriden function is of wrong subtype data type. |
| Wrong Argument Type | Argument to an overloaded function is of wrong data type. |
- The attributes of TCV are:
| Name | Value | Definition |
|---|---|---|
| Source Code | Codebase | The operation is in programmer’s code – in the application itself. |
| Third Party | The operation is in a third party library. | |
| Standard Library | The operation is in the standard library for a particular programming language. | |
| Compiler/Interpreter | The operation is in the language processor that allows execution or creates executables (compiler, assembler, interpreter). | |
| Data Type Kind | Primitive | Mimics the hardware units and is not built from other data types – e.g. int (long, short, signed), float, double, string, boolean. |
| Structured | Builds of other data types; have members of primitive and/or structured data types – e.g. array, record, struct, union, class, interface. | |
| Mechanism | Pass In | Supply ”in” arguments’ data values to a func- tion/ operator. |
| Pass Out | Supply ”out” or ”in/out” arguments’ data values or a return value to a function/ operator. | |
| Data Value Kind | Numeric | A number stored in an object’s memory. |
| Text | A string stored in an object’s memory. | |
| Pointer | A holder of the memory address of an object. | |
| Boolean | A truth value (true or false; 1 or 0), stored in an object’s memory. |
- TCV sites are the cast operators and the in/out argument passing and return statements
- Application examples are provided here.