New bug type: AA_ASSERTION_OF_ARGUMENTS

[baloghadamsoftware]

Using assertions to validate arguments of public functions is a bad and dangerous practice because the validation does not happen if assertions are disabled, thus the behavior of the program depends on this compilation option. Therefore, we introduced a new detector FindArgumentAssertions to detect such cases and report AA_ASSERTION_OFR_ARGUMENTS for each of them.

---

Make sure these boxes are checked before submitting your PR -- thank you!

• Added an entry into CHANGELOG.md if you have changed SpotBugs code

Co-authored-by: Gábor Kutas <@vodorok>

[iloveeclipse]

I don't understand why assert for arguments is bad but assert for anything else is not.

I strongly believe that assert was the worst invention in Java and should be flagged as "BAD_PRACTICE" independently in which piece of code it is used.

[baloghadamsoftware]

Thank you for you comment, @iloveeclipse!

Actually, I believe that assert was introduced for the same reason that it exsits in C and C++: to add invariants to some points of the code. This serves two different purposes: it is a comment to the programmer and it is checked in runtime during testing, when assertions are enabled. For example, in private methods you can validate the arguments using assertions, thus in these cases assertions define the precondition of the method. Also it can define the postcondition at the end of the method. However, in public methods we cannot ensure that the caller invokes the method with the correct arguments thus explicit checking must be made or in simple cases we also can make use of annotations such as @NonNull or @Nullable.

[baloghadamsoftware]

No findings at all on SpotBugs, Jenkins, NanoHTTPD, Bt & Ttorrent.

26 true positives on MATSim-Libs.
2 true positives on OpenGrok.

[baloghadamsoftware]

Could someone take a look on this one, please? @ThrawnCA or @KengoTODA?

[hazendaz]

Thanks @baloghadamsoftware