Fuzzing Crash: VortexError in array_ops

[github-actions]

Fuzzing Crash Report

Analysis

Crash Location: vortex-array/src/scalar_fn/fns/cast/mod.rs:120:execute

Error Message:

Compact compress should succeed in fuzz test:
  Other error: No CastKernel to cast canonical array vortex.varbinview from binary? to list(utf8)

Stack Trace

stack backtrace:
   0: __rustc::rust_begin_unwind
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/std/src/panicking.rs:689:5
   1: core::panicking::panic_fmt
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/core/src/panicking.rs:80:14
   2: panic_display<vortex_error::VortexError>
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/core/src/panicking.rs:259:5
   3: {closure#1}<alloc::sync::Arc<dyn vortex_array::array::DynArray, alloc::alloc::Global>, vortex_error::VortexError>
             at ./vortex-error/src/lib.rs:500:9
   4: unwrap_or_else<alloc::sync::Arc<dyn vortex_array::array::DynArray, alloc::alloc::Global>, vortex_error::VortexError, vortex_error::{impl#11}::vortex_expect::{closure_env#1}<alloc::sync::Arc<dyn vortex_array::array::DynArray, alloc::alloc::Global>, vortex_error::VortexError>>
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/core/src/result.rs:1622:23
   5: vortex_expect<alloc::sync::Arc<dyn vortex_array::array::DynArray, alloc::alloc::Global>, vortex_error::VortexError>
             at ./vortex-error/src/lib.rs:340:14
   6: compress_array
             at ./fuzz/src/array/mod.rs:536:14
   7: run_fuzz_action
             at ./fuzz/src/array/mod.rs:577:33
   8: __libfuzzer_sys_run
             at ./fuzz/fuzz_targets/array_ops.rs:30:11
   9: rust_fuzzer_test_input
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/src/lib.rs:363:60
  10: {closure#0}
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/src/lib.rs:62:9
  11: do_call<libfuzzer_sys::test_input_wrap::{closure_env#0}, i32>
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/std/src/panicking.rs:581:40
  12: __rust_try
  13: catch_unwind<i32, libfuzzer_sys::test_input_wrap::{closure_env#0}>
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/std/src/panicking.rs:544:19
  14: catch_unwind<libfuzzer_sys::test_input_wrap::{closure_env#0}, i32>
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/std/src/panic.rs:359:14
  15: test_input_wrap
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/src/lib.rs:60:22
  16: _ZN6fuzzer6Fuzzer15ExecuteCallbackEPKhm
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerLoop.cpp:619:13
  17: _ZN6fuzzer10RunOneTestEPNS_6FuzzerEPKcm
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerDriver.cpp:335:6
  18: _ZN6fuzzer12FuzzerDriverEPiPPPcPFiPKhmE
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerDriver.cpp:871:9
  19: main
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerMain.cpp:20:10
   ... (3 more frames truncated)

Root Cause Analysis

The crash is a missing CastKernel error at vortex-array/src/scalar_fn/fns/cast/mod.rs:120, triggered when the fuzzer attempts to cast a VarBinView array with dtype binary? (nullable binary) to list(utf8). The root cause is that the cast dispatch logic does not have a registered kernel for converting between varbinview/binary and list(utf8) types, which is an unsupported type coercion that the fuzzer discovered. The fix should either register a CastKernel that handles this conversion path, or the fuzz harness in fuzz/src/array/mod.rs:536 (compress_array) should filter out invalid cast combinations before calling cast, since casting binary to list(utf8) is not a semantically meaningful operation.

Summary

• Target: array_ops
• Crash File: crash-b3936af8072883a97cc9de1076ebd49745c3294b
• Branch: ji/fuzzer-jobs
• Commit: 9ba126a
• Crash Artifact: https://github.com/vortex-data/vortex/actions/runs/22957623873/artifacts/5872386973

Reproduction

1. Download the crash artifact:

   • Direct download: https://github.com/vortex-data/vortex/actions/runs/22957623873/artifacts/5872386973
   • Extract the zip file

2. Reproduce locally:

cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-b3936af8072883a97cc9de1076ebd49745c3294b -- -rss_limit_mb=0

3. Get full backtrace:

RUST_BACKTRACE=full cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-b3936af8072883a97cc9de1076ebd49745c3294b -- -rss_limit_mb=0

---

Auto-created by fuzzing workflow

[connortsui20]

This might be the struct not handling duplicate field names issue again: #6010 and #6900

[github-actions]

Seen 2 times

[connortsui20]

I am somehow unable to reproduce this locally on develop

[robert3005]

I think adding FSL changed the seed generation logic which might make some issues no longer reproducible via the previous seeds

[robert3005]

basically seeds are valid as long as the sample generation logic stays the same

[connortsui20]

Should we close these and let the fuzzer find them again? I will pin to the previous commit regardless

[connortsui20]

So yeah this is exactly the issue in #6900, and it's even worse because these are the field names:

[vortex-btrblocks/src/canonical_compressor.rs:234:17] struct_array.names().iter().collect::<Vec<_>>() = [
    FieldName(
        "",
    ),
    FieldName(
        "",
    ),
]

This is pretty insane to me.

I'm going to close this in favor of #6900