Fuzzing Crash: Missing cast kernel from decimal to bool during scalar_at

[github-actions]

Fuzzing Crash Report

Analysis

Crash Location: vortex-array/src/compute/cast.rs:85

Error Message:

scalar_at:
  No compute kernel to cast array vortex.decimal with dtype decimal(1,-2) to bool

Stack Trace:

   3: invoke
             at ./vortex-array/src/compute/cast.rs:85:13
   4: invoke
             at ./vortex-array/src/compute/mod.rs:146:34
   5: cast
             at ./vortex-array/src/compute/cast.rs:47:10
   6: invoke
             at ./vortex-array/src/compute/cast.rs:93:12
   7: invoke
             at ./vortex-array/src/compute/mod.rs:146:34
   8: cast
             at ./vortex-array/src/compute/cast.rs:47:10
   9: execute
             at ./vortex-array/src/expr/exprs/cast.rs:102:17
  10: execute<vortex_array::expr::exprs::cast::Cast>
             at ./vortex-array/src/expr/vtable.rs:510:22
  11: execute
             at ./vortex-array/src/expr/scalar_fn.rs:133:30
  12: scalar_at
             at ./vortex-array/src/arrays/scalar_fn/vtable/operations.rs:32:38
  13: scalar_at<vortex_array::arrays::scalar_fn::vtable::ScalarFnVTable>
             at ./vortex-array/src/array/mod.rs:484:22
  14: scalar_at
             at ./vortex-array/src/array/mod.rs:208:23
  15: scalar_at
             at ./vortex-array/src/arrays/chunked/vtable/operations.rs:15:34

Root Cause: The fuzzer discovered a missing cast implementation from decimal to bool types. During a scalar_at operation on nested struct arrays containing decimal fields, the cast system attempts to convert a DecimalArray with dtype decimal(1,-2) to bool, but no compute kernel exists for this conversion.

The crash occurs when:

1. scalar_at is called on a deeply nested ChunkedArray containing StructArrays
2. One of the struct fields contains a DecimalArray with decimal(1,-2) dtype
3. The scalar_at operation requires casting the decimal value to bool type
4. The array is canonical (DecimalArray), so it attempts to find a cast kernel at vortex-array/src/compute/cast.rs:85
5. No cast kernel exists for decimal→bool, triggering the error

Array Structure:

• ChunkedArray (length 104) containing nested StructArrays
• Struct fields with deeply nested structure: Struct(Struct(Decimal, Binary), Struct(Bool, Bool))
• DecimalArray has dtype Decimal(precision=1, scale=-2, NonNullable)
• Values stored as I8 type

Debug Output

FuzzArrayAction {
    array: ChunkedArray {
        dtype: Struct(
            StructFields {
                names: FieldNames([FieldName(""), FieldName("")]),
                dtypes: [
                    FieldDType {
                        inner: Owned(
                            Struct(
                                StructFields {
                                    names: FieldNames([FieldName(""), FieldName("")]),
                                    dtypes: [
                                        FieldDType {
                                            inner: Owned(
                                                Decimal(
                                                    DecimalDType {
                                                        precision: 1,
                                                        scale: -2,
                                                    },
                                                    NonNullable,
                                                ),
                                            ),
                                        },
                                        FieldDType {
                                            inner: Owned(Binary(NonNullable)),
                                        },
                                    ],
                                },
                                NonNullable,
                            ),
                        ),
                    },
                    FieldDType {
                        inner: Owned(
                            Struct(
                                StructFields {
                                    names: FieldNames([FieldName(""), FieldName("")]),
                                    dtypes: [
                                        FieldDType {
                                            inner: Owned(Bool(NonNullable)),
                                        },
                                        FieldDType {
                                            inner: Owned(Bool(NonNullable)),
                                        },
                                    ],
                                },
                                NonNullable,
                            ),
                        ),
                    },
                ],
            },
            NonNullable,
        ),
        len: 104,
        chunks: [
            StructArray {
                len: 40,
                fields: [
                    ChunkedArray {
                        chunks: [
                            StructArray {
                                fields: [
                                    ChunkedArray {
                                        chunks: [
                                            DecimalArray {
                                                dtype: Decimal(precision=1, scale=-2, NonNullable),
                                                values_type: I8,
                                                len: 5
                                            },
                                            DecimalArray { len: 5 },
                                            DecimalArray { len: 5 }
                                        ]
                                    },
                                    ...
                                ]
                            },
                            ...
                        ]
                    },
                    ...
                ]
            },
            ...
        ],
    },
}

Summary

• Target: array_ops
• Crash File: crash-57b2f0e482cd2161b3a6e10aa01e20813055cf97
• Branch: develop
• Commit: a11336d
• Crash Artifact: https://github.com/vortex-data/vortex/actions/runs/21762638809/artifacts/5411102793

Reproduction

1. Download the crash artifact:

   • Direct download: https://github.com/vortex-data/vortex/actions/runs/21762638809/artifacts/5411102793
   • Or find array_ops-crash-artifacts at:
   • Extract the zip file

2. Reproduce locally:

# The artifact contains array_ops/crash-57b2f0e482cd2161b3a6e10aa01e20813055cf97
cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-57b2f0e482cd2161b3a6e10aa01e20813055cf97 -- -rss_limit_mb=0

3. Get full backtrace:

RUST_BACKTRACE=full cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-57b2f0e482cd2161b3a6e10aa01e20813055cf97 -- -rss_limit_mb=0

---

Auto-created by fuzzing workflow with Claude analysis

[github-actions]

Related Crash Detected

A similar crash was detected in the array_ops target.

Crash Details

Crash Location: vortex-array/src/compute/cast.rs:85

Error Message:

scalar_at:
  No compute kernel to cast array vortex.varbinview with dtype binary? to list(utf8)?

Stack Trace:

   3: invoke
             at ./vortex-array/src/compute/cast.rs:85:13
   4: invoke
             at ./vortex-array/src/compute/mod.rs:146:34
   5: cast
             at ./vortex-array/src/compute/cast.rs:47:10
   6: invoke
             at ./vortex-array/src/compute/cast.rs:93:12
   7: invoke
             at ./vortex-array/src/compute/mod.rs:146:34
   8: cast
             at ./vortex-array/src/compute/cast.rs:47:10
   9: execute
             at ./vortex-array/src/expr/exprs/cast.rs:102:17
  10: execute<vortex_array::expr::exprs::cast::Cast>
             at ./vortex-array/src/expr/vtable.rs:510:22
  11: execute
             at ./vortex-array/src/expr/scalar_fn.rs:133:30
  12: scalar_at
             at ./vortex-array/src/arrays/scalar_fn/vtable/operations.rs:32:38

Similarities to Original Issue:

• Same crash location: vortex-array/src/compute/cast.rs:85
• Same error pattern: "No compute kernel to cast array [encoding] with dtype [source] to [target]"
• Same stack trace: scalar_at → execute → cast operations
• Same context: Nested struct arrays with chunked structure

Differences:

• Original: Cast from decimal(1,-2) to bool
• This crash: Cast from binary? (VarBinViewArray) to list(utf8)?
• Note: These differences indicate the same root cause manifesting with different type combinations

Debug Output

FuzzArrayAction {
    array: ChunkedArray {
        dtype: Struct(
            StructFields {
                names: FieldNames([FieldName(""), FieldName("")]),
                dtypes: [
                    FieldDType {
                        inner: Owned(Binary(Nullable)),
                    },
                    FieldDType {
                        inner: Owned(List(Utf8(NonNullable), Nullable)),
                    },
                ],
            },
            NonNullable,
        ),
        len: 3,
        chunks: [
            StructArray {
                len: 0,
                fields: [
                    ChunkedArray {
                        dtype: Binary(Nullable),
                        chunks: [VarBinArray, VarBinArray, VarBinArray],
                    },
                    ChunkedArray {
                        dtype: List(Utf8(NonNullable), Nullable),
                        chunks: [ListViewArray, ListViewArray, ListViewArray],
                    },
                ],
            },
            StructArray {
                len: 0,
                fields: [
                    ChunkedArray {
                        dtype: Binary(Nullable),
                        chunks: [VarBinViewArray, VarBinViewArray, VarBinViewArray],
                    },
                    ChunkedArray {
                        dtype: List(Utf8(NonNullable), Nullable),
                        chunks: [ListViewArray, ListViewArray, ListViewArray],
                    },
                ],
            },
            StructArray {
                len: 3,
                fields: [
                    VarBinViewArray {
                        dtype: Binary(Nullable),
                        buffers: [Buffer(length: 43)],
                    },
                    ListViewArray {
                        dtype: List(Utf8(NonNullable), Nullable),
                        elements: VarBinViewArray { dtype: Utf8(NonNullable) },
                    },
                ],
            },
        ],
    },
    actions: [
        Filter(AllTrue(3)),
        Filter(AllTrue(3)),
    ],
}

Occurrence Details

• Crash File: crash-f18f9f2cc644b4e6eb353a79d2f9a12a9de3f13b
• Branch: develop
• Commit: a11336d
• Crash Artifact: Direct download not available (environment variable empty)

Reproduction

cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-f18f9f2cc644b4e6eb353a79d2f9a12a9de3f13b -- -rss_limit_mb=0

---

Auto-detected by fuzzing workflow with Claude analysis