Don't throw BoundsError when reporting UnexpectedEOF

[quinnj]

The bug

Any JSON input that ends mid-token throws BoundsError from inside the error-reporting path, instead of the ArgumentError the parser means to raise:

julia> using JSON

julia> JSON.parse("{")
ERROR: BoundsError: attempt to access 1-element Base.CodeUnits{UInt8, String} at index [1:2]
Stacktrace:
 [3] view @ ./subarray.jl:214 [inlined]
 [4] _invalid(error::JSON.Error, buf::String, pos::Int64, typename::String) @ JSON src/JSON.jl:53

Same for JSON.parse("["), JSON.parse("[1"), JSON.parse("\"a"), JSON.parse("{\"a\":"), and whitespace-only buffers such as " " and "\n". It reaches the typed, lazy and byte-buffer entry points alike (JSON.parse(str, T), JSON.lazy(str)[], JSON.parse(Vector{UInt8}(...))).

Cause

_invalid computes the error's line number as

line_no = count(b -> b == UInt8('\n'), view(cus, 1:pos)) + 1

without clamping pos to the buffer, while the snippet slice two lines below already clamps (ri = min(sizeof(cus), pos + 20)). UnexpectedEOF is reported at the byte the parser wanted to read, so truncated input always arrives here with pos == sizeof(cus) + 1 and the view is out of bounds.

Inputs that stop exactly at the last byte (e.g. JSON.parse("{\"cmd\":\"echo hi\\")) report pos == sizeof(cus) and correctly raise ArgumentError, which is why this went unnoticed — the existing incomplete-escape test in test/parse.jl takes that path.

Fix

Clamp the line-count range, and the snippet's left index for good measure. The message is otherwise unchanged — position, line number, snippet and caret still point at the truncation:

julia> JSON.parse("{\n  \"a\": 1,\n  \"b\":")
ERROR: ArgumentError: invalid JSON at byte position 19 (line 3) parsing type object: UnexpectedEOF
{   "a": 1,   "b": <EOF>
                   ^

Tests

New @testset "truncated input reports UnexpectedEOF" in test/parse.jl covering 13 truncation shapes across the string, typed, lazy and byte-buffer entry points, plus assertions that the message still carries the right byte position, line number and <EOF> marker. Verified these fail on unfixed code (all BoundsError) and pass with the fix. Full suite green via Pkg.test().

How it turned up

Fuzzing tool-argument parsing in a downstream agent framework: a truncated LLM-produced arguments string surfaced as BoundsError rather than the ArgumentError the caller catches to report malformed input.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.99%. Comparing base (1e36d84) to head (23910d7).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #477   +/-   ##
=======================================
  Coverage   89.98%   89.99%           
=======================================
  Files           7        7           
  Lines        1518     1519    +1     
=======================================
+ Hits         1366     1367    +1     
  Misses        152      152           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.