Fuzzing Crash: VortexError in array_ops

[github-actions]

Fuzzing Crash Report

Analysis

Crash Location: vortex-array/src/scalar_fn/fns/cast/mod.rs:120:execute

Error Message:

BtrBlocksCompressor compress should succeed in fuzz test:
  Other error: No CastKernel to cast canonical array vortex.varbinview from utf8 to {=utf8?}?

Stack Trace

stack backtrace:
   0: __rustc::rust_begin_unwind
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/std/src/panicking.rs:689:5
   1: core::panicking::panic_fmt
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/core/src/panicking.rs:80:14
   2: panic_display<vortex_error::VortexError>
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/core/src/panicking.rs:259:5
   3: {closure#1}<alloc::sync::Arc<dyn vortex_array::array::DynArray, alloc::alloc::Global>, vortex_error::VortexError>
             at ./vortex-error/src/lib.rs:500:9
   4: unwrap_or_else<alloc::sync::Arc<dyn vortex_array::array::DynArray, alloc::alloc::Global>, vortex_error::VortexError, vortex_error::{impl#11}::vortex_expect::{closure_env#1}<alloc::sync::Arc<dyn vortex_array::array::DynArray, alloc::alloc::Global>, vortex_error::VortexError>>
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/core/src/result.rs:1622:23
   5: vortex_expect<alloc::sync::Arc<dyn vortex_array::array::DynArray, alloc::alloc::Global>, vortex_error::VortexError>
             at ./vortex-error/src/lib.rs:340:14
   6: compress_array
             at ./fuzz/src/array/mod.rs:539:14
   7: run_fuzz_action
             at ./fuzz/src/array/mod.rs:582:33
   8: __libfuzzer_sys_run
             at ./fuzz/fuzz_targets/array_ops.rs:30:11
   9: rust_fuzzer_test_input
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/src/lib.rs:363:60
  10: {closure#0}
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/src/lib.rs:62:9
  11: do_call<libfuzzer_sys::test_input_wrap::{closure_env#0}, i32>
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/std/src/panicking.rs:581:40
  12: __rust_try
  13: catch_unwind<i32, libfuzzer_sys::test_input_wrap::{closure_env#0}>
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/std/src/panicking.rs:544:19
  14: catch_unwind<libfuzzer_sys::test_input_wrap::{closure_env#0}, i32>
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/std/src/panic.rs:359:14
  15: test_input_wrap
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/src/lib.rs:60:22
  16: _ZN6fuzzer6Fuzzer15ExecuteCallbackEPKhm
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerLoop.cpp:619:13
  17: _ZN6fuzzer10RunOneTestEPNS_6FuzzerEPKcm
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerDriver.cpp:335:6
  18: _ZN6fuzzer12FuzzerDriverEPiPPPcPFiPKhmE
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerDriver.cpp:871:9
  19: main
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerMain.cpp:20:10
   ... (3 more frames truncated)

Root Cause Analysis

The crash is a VortexError panic in the cast kernel at vortex-array/src/scalar_fn/fns/cast/mod.rs:120, triggered during BtrBlocks compression in the fuzz test. The error occurs because there is no CastKernel registered to cast a canonical vortex.varbinview array from utf8 to a nullable utf8 type ({=utf8?}?), meaning the cast dispatch table lacks an entry for this specific encoding-to-nullable-type combination. The fix should either register a CastKernel implementation for varbinview that handles casting to nullable utf8, or ensure the array is first canonicalized to a supported encoding (e.g., VarBin or arrow-backed StringArray) before the cast is attempted. Alternatively, the fuzz harness at fuzz/src/array/mod.rs:539 could gracefully handle this missing-kernel error instead of panicking via vortex_expect.

Summary

• Target: array_ops
• Crash File: crash-7f300b4b89abd7850f4bd5e9e2a9b262faea8135
• Branch: develop
• Commit: 91bc940
• Crash Artifact: https://github.com/vortex-data/vortex/actions/runs/23068637779/artifacts/5918363532

Reproduce

cargo +nightly fuzz run -D --sanitizer=none array_ops ./fuzz/artifacts/array_ops/crash-7f300b4b89abd7850f4bd5e9e2a9b262faea8135 -- -rss_limit_mb=0

First-time setup: download and extract the crash artifact

1. Download the crash artifact:

   • Direct download: https://github.com/vortex-data/vortex/actions/runs/23068637779/artifacts/5918363532
   • Extract the zip file (unzip)
     • The path should look like /path/to/array_ops/crash-7f300b4b89abd7850f4bd5e9e2a9b262faea8135
     • You can create a ./fuzz/artifacts directory that will be git-ignored in the vortex repo
     • Full path would be ./fuzz/artifacts/array_ops/crash-7f300b4b89abd7850f4bd5e9e2a9b262faea8135

2. Assuming you download the zipfile to ~/Downloads, and your working directory is the repository root:

mkdir -p ./fuzz/artifacts
mv ~/Downloads/array_ops-crash-artifacts.zip ./fuzz/artifacts/
unzip ./fuzz/artifacts/array_ops-crash-artifacts.zip -d ./fuzz/artifacts/
rm ./fuzz/artifacts/array_ops-crash-artifacts.zip

3. Get a backtrace:

RUST_BACKTRACE=1 cargo +nightly fuzz run -D --sanitizer=none array_ops ./fuzz/artifacts/array_ops/crash-7f300b4b89abd7850f4bd5e9e2a9b262faea8135 -- -rss_limit_mb=0

RUST_BACKTRACE=full cargo +nightly fuzz run -D --sanitizer=none array_ops ./fuzz/artifacts/array_ops/crash-7f300b4b89abd7850f4bd5e9e2a9b262faea8135 -- -rss_limit_mb=0

---

Auto-created by fuzzing workflow

[connortsui20]

again, almost certainly #6900

[connortsui20]

Yep:

field name: FieldName(""), type: Utf8(NonNullable)
field name: FieldName(""), type: Struct(StructFields { names: FieldNames([FieldName("")]), dtypes: [FieldDType { inner: Owned(Utf8(Nullable)) }] }, Nullable)

Closing in favor of #6900