Fuzzing Crash: Sum operation returns null for valid DecimalArray ChunkedArray

[github-actions]

Fuzzing Crash Report

Analysis

Crash Location: fuzz/src/array/mod.rs:587 in assert_scalar_eq (called during Sum action validation)

Error Message:

Scalar mismatch: expected decimal256(22337414285953441061567344838540486740290084953887815750718056913398681145773, precision=76, scale=75), got null in step 1

Stack Trace:

   3: assert_scalar_eq
             at ./fuzz/src/array/mod.rs:705:13
   4: run_fuzz_action
             at ./fuzz/src/array/mod.rs:587:17
   5: __libfuzzer_sys_run
             at ./fuzz/fuzz_targets/array_ops.rs:14:11
   6: rust_fuzzer_test_input
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.10/src/lib.rs:363:60

Root Cause:

The fuzzer discovered a bug where the sum operation on a ChunkedArray containing DecimalArrays returns a null scalar instead of the expected decimal value. The issue occurs with:

• Array type: ChunkedArray with 2 chunks of DecimalArrays
• Decimal dtype: Decimal(precision=76, scale=75, Nullable)
• Values type: I256 (decimal256)
• Operation: Sum operation (step 1)
• Expected result: decimal256(22337414285953441061567344838540486740290084953887815750718056913398681145773, precision=76, scale=75)
• Actual result: null

The ChunkedArray contains:

1. First chunk: DecimalArray with 4 elements (I256 values, AllValid)
2. Second chunk: DecimalArray with 3 elements (I256 values, AllValid)

All values are valid (no nulls), so the sum operation should return a valid decimal value. However, the sum operation is incorrectly returning null, suggesting a bug in either:

1. The sum implementation for DecimalArray
2. The sum implementation for ChunkedArray when dealing with decimal chunks
3. Scalar value construction or type handling for large decimal256 values
4. Overflow or precision handling during decimal summation

Debug Output

Output of `std::fmt::Debug`:

	FuzzArrayAction {
	    array: ChunkedArray {
	        dtype: Decimal(
	            DecimalDType {
	                precision: 76,
	                scale: 75,
	            },
	            Nullable,
	        ),
	        len: 7,
	        chunk_offsets: PrimitiveArray {
	            dtype: Primitive(
	                U64,
	                NonNullable,
	            ),
	            buffer: Buffer<u8> {
	                length: 24,
	                alignment: Alignment(
	                    8,
	                ),
	                as_slice: [0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, ...],
	            },
	            validity: NonNullable,
	            stats_set: ArrayStats {
	                inner: RwLock {
	                    data: StatsSet {
	                        values: [],
	                    },
	                },
	            },
	        },
	        chunks: [
	            DecimalArray {
	                dtype: Decimal(
	                    DecimalDType {
	                        precision: 76,
	                        scale: 75,
	                    },
	                    Nullable,
	                ),
	                values: Buffer<u8> {
	                    length: 128,
	                    alignment: Alignment(
	                        16,
	                    ),
	                    as_slice: [3, 0, 0, 0, 0, 0, 0, 0, 0, 144, 236, 228, 101, 118, 200, 187, ...],
	                },
	                values_type: I256,
	                validity: AllValid,
	                stats_set: ArrayStats {
	                    inner: RwLock {
	                        data: StatsSet {
	                            values: [],
	                        },
	                    },
	                },
	            },
	            DecimalArray {
	                dtype: Decimal(
	                    DecimalDType {
	                        precision: 76,
	                        scale: 75,
	                    },
	                    Nullable,
	                ),
	                values: Buffer<u8> {
	                    length: 96,
	                    alignment: Alignment(
	                        16,
	                    ),
	                    as_slice: [77, 71, 71, 71, 178, 71, 71, 255, 255, 79, 152, 30, 160, 222, 241, 221, ...],
	                },
	                values_type: I256,
	                validity: AllValid,
	                stats_set: ArrayStats {
	                    inner: RwLock {
	                        data: StatsSet {
	                            values: [],
	                        },
	                    },
	                },
	            },
	        ],
	        stats_set: ArrayStats {
	            inner: RwLock {
	                data: StatsSet {
	                    values: [],
	                },
	            },
	        },
	    },
	    actions: [
	        (
	            Sum,
	            Scalar(
	                Scalar {
	                    dtype: Decimal(
	                        DecimalDType {
	                            precision: 76,
	                            scale: 75,
	                        },
	                        Nullable,
	                    ),
	                    value: ScalarValue(
	                        Decimal(
	                            I256(
	                                i256(
	                                    22337414285953441061567344838540486740290084953887815750718056913398681145773,
	                                ),
	                            ),
	                        ),
	                    ),
	                },
	            ),
	        ),
	        (
	            Sum,
	            Scalar(
	                Scalar {
	                    dtype: Decimal(
	                        DecimalDType {
	                            precision: 76,
	                            scale: 75,
	                        },
	                        Nullable,
	                    ),
	                    value: ScalarValue(
	                        Decimal(
	                            I256(
	                                i256(
	                                    22337414285953441061567344838540486740290084953887815750718056913398681145773,
	                                ),
	                            ),
	                        ),
	                    ),
	                },
	            ),
	        ),
	        (
	            Sum,
	            Scalar(
	                Scalar {
	                    dtype: Decimal(
	                        DecimalDType {
	                            precision: 76,
	                            scale: 75,
	                        },
	                        Nullable,
	                    ),
	                    value: ScalarValue(
	                        Decimal(
	                            I256(
	                                i256(
	                                    22337414285953441061567344838540486740290084953887815750718056913398681145773,
	                                ),
	                            ),
	                        ),
	                    ),
	                },
	            ),
	        ),
	        (
	            Sum,
	            Scalar(
	                Scalar {
	                    dtype: Decimal(
	                        DecimalDType {
	                            precision: 76,
	                            scale: 75,
	                        },
	                        Nullable,
	                    ),
	                    value: ScalarValue(
	                        Decimal(
	                            I256(
	                                i256(
	                                    22337414285953441061567344838540486740290084953887815750718056913398681145773,
	                                ),
	                            ),
	                        ),
	                    ),
	                },
	            ),
	        ),
	    ],
	}

Summary

• Target: array_ops
• Crash File: crash-8e17520b7a4059d336d944b96e615c0028bdc415
• Branch: develop
• Commit: 265f29a
• Crash Artifact: (artifact URL not available)

Reproduction

1. Download the crash artifact (if available)

2. Reproduce locally:

# The artifact contains array_ops/crash-8e17520b7a4059d336d944b96e615c0028bdc415
cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-8e17520b7a4059d336d944b96e615c0028bdc415 -- -rss_limit_mb=0

3. Get full backtrace:

RUST_BACKTRACE=full cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-8e17520b7a4059d336d944b96e615c0028bdc415 -- -rss_limit_mb=0

---

Auto-created by fuzzing workflow with Claude analysis

[github-actions]

Related Crash Detected

A similar crash was detected in the array_ops target.

Crash Details

Crash Location: fuzz/src/array/mod.rs:587 in assert_scalar_eq (called during Sum action validation)

Error Message:

Scalar mismatch: expected decimal256(27693971604943987757262947649678417179695216937688450016519895924314886270445, precision=76, scale=75), got null in step 1

Stack Trace:

   3: assert_scalar_eq
             at ./fuzz/src/array/mod.rs:705:13
   4: run_fuzz_action
             at ./fuzz/src/array/mod.rs:587:17
   5: __libfuzzer_sys_run
             at ./fuzz/fuzz_targets/array_ops.rs:14:11
   6: rust_fuzzer_test_input
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.10/src/lib.rs:363:60

Similarities to Original Issue:

• Same crash location: fuzz/src/array/mod.rs:587 in assert_scalar_eq
• Same error pattern: Sum operation returns null instead of expected decimal256 value
• Same data type: Decimal(precision=76, scale=75, Nullable) with I256 values
• Same array structure: ChunkedArray with 2 chunks of DecimalArrays, all valid elements
• Same operation: Sum at step 1

Differences:

• Number of elements: 12 total (4 + 8 elements) vs 7 total (4 + 3 elements) in original
• Different decimal value expected: 27693971604943987757262947649678417179695216937688450016519895924314886270445 vs 22337414285953441061567344838540486740290084953887815750718056913398681145773
• Note: These differences indicate the same root cause manifesting with different input data

Debug Output

Output of `std::fmt::Debug`:

	FuzzArrayAction {
	    array: ChunkedArray {
	        dtype: Decimal(
	            DecimalDType {
	                precision: 76,
	                scale: 75,
	            },
	            Nullable,
	        ),
	        len: 12,
	        chunk_offsets: PrimitiveArray {
	            dtype: Primitive(
	                U64,
	                NonNullable,
	            ),
	            buffer: Buffer<u8> {
	                length: 24,
	                alignment: Alignment(
	                    8,
	                ),
	                as_slice: [0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, ...],
	            },
	            validity: NonNullable,
	            stats_set: ArrayStats {
	                inner: RwLock {
	                    data: StatsSet {
	                        values: [],
	                    },
	                },
	            },
	        },
	        chunks: [
	            DecimalArray {
	                dtype: Decimal(
	                    DecimalDType {
	                        precision: 76,
	                        scale: 75,
	                    },
	                    Nullable,
	                ),
	                values: Buffer<u8> {
	                    length: 128,
	                    alignment: Alignment(
	                        16,
	                    ),
	                    as_slice: [3, 0, 0, 0, 0, 0, 0, 0, 0, 144, 236, 228, 101, 118, 200, 187, ...],
	                },
	                values_type: I256,
	                validity: AllValid,
	                stats_set: ArrayStats {
	                    inner: RwLock {
	                        data: StatsSet {
	                            values: [],
	                        },
	                    },
	                },
	            },
	            DecimalArray {
	                dtype: Decimal(
	                    DecimalDType {
	                        precision: 76,
	                        scale: 75,
	                    },
	                    Nullable,
	                ),
	                values: Buffer<u8> {
	                    length: 256,
	                    alignment: Alignment(
	                        16,
	                    ),
	                    as_slice: [1, 0, 0, 0, 0, 0, 0, 0, 0, 208, 64, 171, 43, 14, 159, 225, ...],
	                },
	                values_type: I256,
	                validity: AllValid,
	                stats_set: ArrayStats {
	                    inner: RwLock {
	                        data: StatsSet {
	                            values: [],
	                        },
	                    },
	                },
	            },
	        ],
	        stats_set: ArrayStats {
	            inner: RwLock {
	                data: StatsSet {
	                    values: [],
	                },
	            },
	        },
	    },
	    actions: [
	        (
	            Sum,
	            Scalar(
	                Scalar {
	                    dtype: Decimal(
	                        DecimalDType {
	                            precision: 76,
	                            scale: 75,
	                        },
	                        Nullable,
	                    ),
	                    value: ScalarValue(
	                        Decimal(
	                            I256(
	                                i256(
	                                    27693971604943987757262947649678417179695216937688450016519895924314886270445,
	                                ),
	                            ),
	                        ),
	                    ),
	                },
	            ),
	        ),
	        (
	            Sum,
	            Scalar(
	                Scalar {
	                    dtype: Decimal(
	                        DecimalDType {
	                            precision: 76,
	                            scale: 75,
	                        },
	                        Nullable,
	                    ),
	                    value: ScalarValue(
	                        Decimal(
	                            I256(
	                                i256(
	                                    27693971604943987757262947649678417179695216937688450016519895924314886270445,
	                                ),
	                            ),
	                        ),
	                    ),
	                },
	            ),
	        ),
	        (
	            Sum,
	            Scalar(
	                Scalar {
	                    dtype: Decimal(
	                        DecimalDType {
	                            precision: 76,
	                            scale: 75,
	                        },
	                        Nullable,
	                    ),
	                    value: ScalarValue(
	                        Decimal(
	                            I256(
	                                i256(
	                                    27693971604943987757262947649678417179695216937688450016519895924314886270445,
	                                ),
	                            ),
	                        ),
	                    ),
	                },
	            ),
	        ),
	    ],
	}

Occurrence Details

• Crash File: crash-c6fd16b0c85012370d501e9aaea9db730cb873fb
• Branch: develop
• Commit: 265f29a
• Crash Artifact: (artifact URL not available)

Reproduction

cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-c6fd16b0c85012370d501e9aaea9db730cb873fb -- -rss_limit_mb=0

---

Auto-detected by fuzzing workflow with Claude analysis

[github-actions]

Related Crash Detected

A similar crash was detected in the array_ops target.

Crash Details

Crash Location: fuzz/src/array/mod.rs:705 in assert_scalar_eq

Error Message:

Scalar mismatch: expected decimal256(20838483337615333622867048918413809811831720253113501127311878661340024727345, precision=76, scale=75), got null in step 1

Stack Trace:

   3: assert_scalar_eq
             at ./fuzz/src/array/mod.rs:705:13
   4: run_fuzz_action
             at ./fuzz/src/array/mod.rs:587:17
   5: __libfuzzer_sys_run
             at ./fuzz/fuzz_targets/array_ops.rs:14:11
   6: rust_fuzzer_test_input
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.10/src/lib.rs:363:60

Similarities to Original Issue:

• Same crash location (fuzz/src/array/mod.rs:587 calling assert_scalar_eq)
• Same error pattern: Sum returns null instead of expected decimal256 value
• Same array structure: ChunkedArray with 7 elements across 2 chunks (4 + 3 elements)
• Same decimal type: Decimal(precision=76, scale=75, Nullable) with I256 values
• Same validity: AllValid for both chunks (no null values)
• Same operation sequence: Sum operation in step 1

Differences:

• Different decimal value: 20838483337615333622867048918413809811831720253113501127311878661340024727345 vs 22337414285953441061567344838540486740290084953887815750718056913398681145773
• Different input buffers (different underlying decimal values in chunks)
• Note: These differences indicate the same root cause manifesting with different input data

Debug Output

Output of `std::fmt::Debug`:

	FuzzArrayAction {
	    array: ChunkedArray {
	        dtype: Decimal(
	            DecimalDType {
	                precision: 76,
	                scale: 75,
	            },
	            Nullable,
	        ),
	        len: 7,
	        chunk_offsets: PrimitiveArray {
	            dtype: Primitive(
	                U64,
	                NonNullable,
	            ),
	            buffer: Buffer<u8> {
	                length: 24,
	                alignment: Alignment(
	                    8,
	                ),
	                as_slice: [0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, ...],
	            },
	            validity: NonNullable,
	            stats_set: ArrayStats {
	                inner: RwLock {
	                    data: StatsSet {
	                        values: [],
	                    },
	                },
	            },
	        },
	        chunks: [
	            DecimalArray {
	                dtype: Decimal(
	                    DecimalDType {
	                        precision: 76,
	                        scale: 75,
	                    },
	                    Nullable,
	                ),
	                values: Buffer<u8> {
	                    length: 128,
	                    alignment: Alignment(
	                        16,
	                    ),
	                    as_slice: [73, 69, 69, 65, 71, 255, 255, 1, 97, 143, 236, 228, 101, 118, 200, 187, ...],
	                },
	                values_type: I256,
	                validity: AllValid,
	                stats_set: ArrayStats {
	                    inner: RwLock {
	                        data: StatsSet {
	                            values: [],
	                        },
	                    },
	                },
	            },
	            DecimalArray {
	                dtype: Decimal(
	                    DecimalDType {
	                        precision: 76,
	                        scale: 75,
	                    },
	                    Nullable,
	                ),
	                values: Buffer<u8> {
	                    length: 96,
	                    alignment: Alignment(
	                        16,
	                    ),
	                    as_slice: [5, 0, 0, 0, 0, 0, 0, 0, 0, 80, 152, 30, 160, 222, 241, 221, ...],
	                },
	                values_type: I256,
	                validity: AllValid,
	                stats_set: ArrayStats {
	                    inner: RwLock {
	                        data: StatsSet {
	                            values: [],
	                        },
	                    },
	                },
	            },
	        ],
	        stats_set: ArrayStats {
	            inner: RwLock {
	                data: StatsSet {
	                    values: [],
	                },
	            },
	        },
	    },
	    actions: [
	        (
	            Sum,
	            Scalar(
	                Scalar {
	                    dtype: Decimal(
	                        DecimalDType {
	                            precision: 76,
	                            scale: 75,
	                        },
	                        Nullable,
	                    ),
	                    value: ScalarValue(
	                        Decimal(
	                            I256(
	                                i256(
	                                    20838483337615333622867048918413809811831720253113501127311878661340024727345,
	                                ),
	                            ),
	                        ),
	                    ),
	                },
	            ),
	        ),
	        (
	            Sum,
	            Scalar(
	                Scalar {
	                    dtype: Decimal(
	                        DecimalDType {
	                            precision: 76,
	                            scale: 75,
	                        },
	                        Nullable,
	                    ),
	                    value: ScalarValue(
	                        Decimal(
	                            I256(
	                                i256(
	                                    20838483337615333622867048918413809811831720253113501127311878661340024727345,
	                                ),
	                            ),
	                        ),
	                    ),
	                },
	            ),
	        ),
	        (
	            Sum,
	            Scalar(
	                Scalar {
	                    dtype: Decimal(
	                        DecimalDType {
	                            precision: 76,
	                            scale: 75,
	                        },
	                        Nullable,
	                    ),
	                    value: ScalarValue(
	                        Decimal(
	                            I256(
	                                i256(
	                                    20838483337615333622867048918413809811831720253113501127311878661340024727345,
	                                ),
	                            ),
	                        ),
	                    ),
	                },
	            ),
	        ),
	        (
	            Sum,
	            Scalar(
	                Scalar {
	                    dtype: Decimal(
	                        DecimalDType {
	                            precision: 76,
	                            scale: 75,
	                        },
	                        Nullable,
	                    ),
	                    value: ScalarValue(
	                        Decimal(
	                            I256(
	                                i256(
	                                    20838483337615333622867048918413809811831720253113501127311878661340024727345,
	                                ),
	                            ),
	                        ),
	                    ),
	                },
	            ),
	        ),
	    ],
	}

Occurrence Details

• Crash File: crash-3f1561ed9ad830675dcde992e392e1ff19934e38
• Branch: develop
• Commit: 265f29a
• Crash Artifact: https://github.com/vortex-data/vortex/actions/runs/12448349321/artifacts/2489076668

Reproduction

cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-3f1561ed9ad830675dcde992e392e1ff19934e38 -- -rss_limit_mb=0

---

Auto-detected by fuzzing workflow with Claude analysis