Fuzzing Crash: Mask operation returns wrong dtype for nested struct with F16 fields

[github-actions]

Fuzzing Crash Report

Analysis

Crash Location: vortex-array/src/compute/mask.rs:74 in the mask function

Error Message:

mask operation should succeed in fuzz test:
  Internal error: compute function mask returned a result of type {={}?, ={=f16?, =f16?}?}? but expected {={}?, ={=f16, =f16?}?}?
vortex.filter

Stack Trace:

   3: invoke
             at ./vortex-array/src/compute/mod.rs:149:13
   4: mask
             at ./vortex-array/src/compute/mask.rs:74:10
   5: run_fuzz_action
             at ./fuzz/src/array/mod.rs:640:33

Root Cause: The mask operation is incorrectly changing the nullability of nested struct fields.

The expected dtype is:

{={}?, ={=f16, =f16?}?}?

(Note: first F16 field is NonNullable)

But the mask function returns:

{={}?, ={=f16?, =f16?}?}?

(Note: first F16 field has been changed to Nullable)

The issue occurs when applying a mask operation to a deeply nested ChunkedArray containing StructArrays with F16 primitive fields. The mask operation is incorrectly propagating nullable to a field that should remain NonNullable (the first F16 field in the nested struct).

Array Structure:

• ChunkedArray (length 110) with dtype: Struct(Nullable) containing 2 fields
• Field 0: Empty struct Struct([], Nullable)
• Field 1: Nested struct with 2 F16 fields
  • Field 1.0: F16(NonNullable) - This field's nullability is being incorrectly changed
  • Field 1.1: F16(Nullable)
• All chunks have length 0 (empty arrays)

This is a type system invariant violation in the mask compute kernel where field-level nullability is not being preserved correctly during mask operations on nested structs.

Debug Output

FuzzArrayAction {
    array: ChunkedArray {
        dtype: Struct(
            StructFields {
                names: FieldNames(
                    [
                        FieldName(
                            "",
                        ),
                        FieldName(
                            "",
                        ),
                    ],
                ),
                dtypes: [
                    FieldDType {
                        inner: Owned(
                            Struct(
                                StructFields {
                                    names: FieldNames(
                                        [],
                                    ),
                                    dtypes: [],
                                },
                                Nullable,
                            ),
                        ),
                    },
                    FieldDType {
                        inner: Owned(
                            Struct(
                                StructFields {
                                    names: FieldNames(
                                        [
                                            FieldName(
                                                "",
                                            ),
                                            FieldName(
                                                "",
                                            ),
                                        ],
                                    ),
                                    dtypes: [
                                        FieldDType {
                                            inner: Owned(
                                                Primitive(
                                                    F16,
                                                    NonNullable,
                                                ),
                                            ),
                                        },
                                        FieldDType {
                                            inner: Owned(
                                                Primitive(
                                                    F16,
                                                    Nullable,
                                                ),
                                            ),
                                        },
                                    ],
                                },
                                Nullable,
                            ),
                        ),
                    },
                ],
            },
            Nullable,
        ),
        len: 110,
        chunks: [ ... ]
    },
    actions: [
        Mask( ... )
    ]
}

Summary

• Target: array_ops
• Crash File: crash-91c42bf26db89bb4ebb2b47177872c96a8f50e5b
• Branch: develop
• Commit: a11336d
• Crash Artifact: https://github.com/vortex-data/vortex/actions/runs/21835882062/artifacts/5438014732

Reproduction

1. Download the crash artifact:

   • Direct download: https://github.com/vortex-data/vortex/actions/runs/21835882062/artifacts/5438014732
   • Or find array_ops-crash-artifacts at: https://github.com/vortex-data/vortex/actions/runs/21835882062
   • Extract the zip file

2. Reproduce locally:

# The artifact contains array_ops/crash-91c42bf26db89bb4ebb2b47177872c96a8f50e5b
cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-91c42bf26db89bb4ebb2b47177872c96a8f50e5b -- -rss_limit_mb=0

3. Get full backtrace:

RUST_BACKTRACE=full cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-91c42bf26db89bb4ebb2b47177872c96a8f50e5b -- -rss_limit_mb=0

---

Auto-created by fuzzing workflow with Claude analysis

[github-actions]

Related Crash Detected

A similar crash was detected in the array_ops target.

Crash Details

Crash Location: vortex-array/src/compute/mask.rs:74 in the mask function and vortex-array/src/compute/mod.rs:149 in the invoke function

Error Message:

mask operation should succeed in fuzz test:
  Internal error: compute function mask returned a result of type {={;\u{16}vortex.list*=i64?, =i64?}?, ={\rkkkkkkkooooo\u{16}oooooooooooooooooo=i64?, =i64?}?}? but expected {={;\u{16}vortex.list*=i64?, =i64?}, ={\rkkkkkkkooooo\u{16}oooooooooooooooooo=i64?, =i64?}?}?
vortex.filter

Stack Trace:

   3: invoke
             at ./vortex-array/src/compute/mod.rs:149:13
   4: mask
             at ./vortex-array/src/compute/mask.rs:74:10
   5: run_fuzz_action
             at ./fuzz/src/array/mod.rs:640:33

Similarities to Original Issue:

• Same crash location (vortex-array/src/compute/mask.rs:74 and mod.rs:149)
• Same error pattern: mask operation incorrectly changes nullability of nested struct fields
• Same root cause: a field that should be NonNullable (=i64? → expected =i64?, but the first nested field is {;\u{16}vortex.list*=i64?, =i64?} NonNullable → becomes {;\u{16}vortex.list*=i64?, =i64?}? Nullable)
• Both involve nested ChunkedArrays containing StructArrays

Differences:

• This crash uses I64 primitive fields instead of F16 fields
• Different field names and nesting structure
• Length is 39 instead of 110
• Note: These differences may indicate the same root cause manifesting differently with different primitive types

Debug Output

FuzzArrayAction {
    array: ChunkedArray {
        dtype: Struct(
            StructFields {
                names: FieldNames(
                    [
                        FieldName(
                            "",
                        ),
                        FieldName(
                            "",
                        ),
                    ],
                ),
                dtypes: [
                    FieldDType {
                        inner: Owned(
                            Struct(
                                StructFields {
                                    names: FieldNames(
                                        [
                                            FieldName(
                                                ";\u{16}vortex.list*",
                                            ),
                                            FieldName(
                                                "",
                                            ),
                                        ],
                                    ),
                                    dtypes: [
                                        FieldDType {
                                            inner: Owned(
                                                Primitive(
                                                    I64,
                                                    Nullable,
                                                ),
                                            ),
                                        },
                                        FieldDType {
                                            inner: Owned(
                                                Primitive(
                                                    I64,
                                                    Nullable,
                                                ),
                                            ),
                                        },
                                    ],
                                },
                                NonNullable,
                            ),
                        ),
                    },
                    FieldDType {
                        inner: Owned(
                            Struct(
                                StructFields {
                                    names: FieldNames(
                                        [
                                            FieldName(
                                                "\rkkkkkkkooooo\u{16}oooooooooooooooooo",
                                            ),
                                            FieldName(
                                                "",
                                            ),
                                        ],
                                    ),
                                    dtypes: [
                                        FieldDType {
                                            inner: Owned(
                                                Primitive(
                                                    I64,
                                                    Nullable,
                                                ),
                                            ),
                                        },
                                        FieldDType {
                                            inner: Owned(
                                                Primitive(
                                                    I64,
                                                    Nullable,
                                                ),
                                            ),
                                        },
                                    ],
                                },
                                Nullable,
                            ),
                        ),
                    },
                ],
            },
            Nullable,
        ),
        len: 39,
        chunks: [...]
    },
    actions: [
        Mask(...)
    ]
}

Occurrence Details

• Crash File: crash-588a62d6ff91e07544f5f0aab7e8662927e08794
• Branch: develop
• Commit: a11336d
• Crash Artifact: https://github.com/vortex-data/vortex/actions/runs/21779878724/artifacts/5416924066

Reproduction

cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-588a62d6ff91e07544f5f0aab7e8662927e08794 -- -rss_limit_mb=0

---

Auto-detected by fuzzing workflow with Claude analysis

[github-actions]

Related Crash Detected

A similar crash was detected in the array_ops target.

Crash Details

Crash Location: vortex-array/src/compute/mask.rs:74 in the mask function

Error Message:

mask operation should succeed in fuzz test:
  Internal error: compute function mask returned a result of type {==(\u{4}={}?, =list(f16)?}? but expected {==(\u{4}={}, =list(f16)}?
vortex.filter

Stack Trace:

   3: invoke
             at ./vortex-array/src/compute/mod.rs:149:13
   4: mask
             at ./vortex-array/src/compute/mask.rs:74:10
   5: run_fuzz_action
             at ./fuzz/src/array/mod.rs:640:33
   6: __libfuzzer_sys_run
             at ./fuzz/fuzz_targets/array_ops.rs:14:11

Similarities to Original Issue:

• Exact same crash location: vortex-array/src/compute/mask.rs:74
• Same error pattern: mask operation returning wrong dtype for nested struct fields
• Same root cause: mask operation incorrectly changing field nullability from NonNullable to Nullable
• Same component: mask compute kernel with nested structs

Differences:

• Original issue: First F16 field in nested struct changed from NonNullable to Nullable
• This crash: Both an empty struct field AND a list(F16) field changed from NonNullable to Nullable
• Different array structure (216 elements vs 110 in original), but both are ChunkedArrays with nested StructArrays

These differences suggest the same root cause manifesting differently - the mask operation is systematically breaking field-level nullability preservation across multiple field types.

Debug Output

FuzzArrayAction {
    array: ChunkedArray {
        dtype: Struct(
            StructFields {
                names: FieldNames(
                    [
                        FieldName(
                            "==(\u{4}",
                        ),
                        FieldName(
                            "",
                        ),
                    ],
                ),
                dtypes: [
                    FieldDType {
                        inner: Owned(
                            Struct(
                                StructFields {
                                    names: FieldNames(
                                        [],
                                    ),
                                    dtypes: [],
                                },
                                NonNullable,  // <-- This field should stay NonNullable
                            ),
                        ),
                    },
                    FieldDType {
                        inner: Owned(
                            List(
                                Primitive(
                                    F16,
                                    NonNullable,
                                ),
                                NonNullable,  // <-- This field should also stay NonNullable
                            ),
                        ),
                    },
                ],
            },
            NonNullable,
        ),
        len: 216,
        chunk_offsets: PrimitiveArray { ... },
        chunks: [
            StructArray {
                len: 12,
                dtype: Struct( ... same nested structure with NonNullable fields ... ),
                fields: [
                    ChunkedArray { dtype: Struct([], NonNullable), len: 12, ... },
                    ChunkedArray { dtype: List(F16, NonNullable), len: 12, ... }
                ],
                ...
            },
            StructArray {
                len: 204,
                ...
            }
        ],
        ...
    },
    actions: [
        (
            Filter(
                Values(
                    MaskValues { ... }
                )
            ),
            ...
        )
    ]
}

Occurrence Details

• Crash File: crash-06bf74ab0294b1f4149c348094d9eec9716a5a54
• Branch: develop
• Commit: a11336d
• Crash Artifact: https://github.com/vortex-data/vortex/actions/runs/21843449733/artifacts/5443054788

Reproduction

cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-06bf74ab0294b1f4149c348094d9eec9716a5a54 -- -rss_limit_mb=0

---

Auto-detected by fuzzing workflow with Claude analysis

[github-actions]

Related Crash Detected

A similar crash was detected in the array_ops target.

Crash Details

Crash Location: vortex-array/src/compute/mask.rs:74 in the mask function

Error Message:

mask operation should succeed in fuzz test:
  Internal error: compute function mask returned a result of type {={\u{2}\u{2}\u{2}\u{2}\u{2}\u{2}\u{2}\u{2}\u{2}\u{2}\`=decimal(3,-74)?, =decimal(3,-74)?}?, =decimal(3,-74)?}? but expected {={\u{2}\u{2}\u{2}\u{2}\u{2}\u{2}\u{2}\u{2}\u{2}\u{2}\`=decimal(3,-74), =decimal(3,-74)}, =decimal(3,-74)}?
vortex.filter

Stack Trace:

   3: invoke
             at ./vortex-array/src/compute/mod.rs:149:13
   4: mask
             at ./vortex-array/src/compute/mask.rs:74:10
   5: run_fuzz_action
             at ./fuzz/src/array/mod.rs:640:33

Similarities to Original Issue:

• Same crash location: vortex-array/src/compute/mask.rs:74
• Same root cause: mask operation incorrectly changing nullability of nested struct fields
• Same error pattern: "compute function mask returned a result of type X but expected Y"
• Both involve nested structs where field-level nullability is not preserved

Differences:

• Original issue: F16 primitive fields in nested structs
• This crash: Decimal fields in nested structs
• Note: These differences indicate the same root cause manifesting with different data types

The mask compute kernel is incorrectly propagating nullable to fields that should remain NonNullable during mask operations on nested struct arrays, regardless of the field type (F16, Decimal, etc.).

Debug Output

FuzzArrayAction {
    array: ChunkedArray {
        dtype: Struct(
            StructFields {
                names: FieldNames(
                    [
                        FieldName(
                            "",
                        ),
                        FieldName(
                            "",
                        ),
                    ],
                ),
                dtypes: [
                    FieldDType {
                        inner: Owned(
                            Struct(
                                StructFields {
                                    names: FieldNames(
                                        [
                                            FieldName(
                                                "\u{2}\u{2}\u{2}\u{2}\u{2}\u{2}\u{2}\u{2}\u{2}\u{2}\`",
                                            ),
                                            FieldName(
                                                "",
                                            ),
                                        ],
                                    ),
                                    dtypes: [
                                        FieldDType {
                                            inner: Owned(
                                                Decimal(
                                                    DecimalDType {
                                                        precision: 3,
                                                        scale: -74,
                                                    },
                                                    NonNullable,
                                                ),
                                            ),
                                        },
                                        FieldDType {
                                            inner: Owned(
                                                Decimal(
                                                    DecimalDType {
                                                        precision: 3,
                                                        scale: -74,
                                                    },
                                                    NonNullable,
                                                ),
                                            ),
                                        },
                                    ],
                                },
                                NonNullable,
                            ),
                        ),
                    },
                    FieldDType {
                        inner: Owned(
                            Decimal(
                                DecimalDType {
                                    precision: 3,
                                    scale: -74,
                                },
                                NonNullable,
                            ),
                        ),
                    },
                ],
            },
            NonNullable,
        ),
        len: 15,
        ...
    },
    actions: [
        Mask(...)
    ]
}

Occurrence Details

• Crash File: crash-06f9fcab070686522747c648aef13da132c9c312
• Branch: develop
• Commit: a11336d
• Crash Artifact: https://github.com/vortex-data/vortex/actions/runs/21894690088/artifacts/5455128184

Reproduction

cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-06f9fcab070686522747c648aef13da132c9c312 -- -rss_limit_mb=0

---

Auto-detected by fuzzing workflow with Claude analysis

[github-actions]

Related Crash Detected

A similar crash was detected in the array_ops target.

Crash Details

Crash Location: vortex-array/src/compute/mask.rs:74 in the mask function, called from fuzz/src/array/mod.rs:640-641

Error Message:

mask operation should succeed in fuzz test:
  Internal error: compute function mask returned a result of type {==(=utf8?, =utf8?}? but expected {==(=utf8, =utf8}?
vortex.filter

Stack Trace:

   3: invoke
             at ./vortex-array/src/compute/mod.rs:149:13
   4: mask
             at ./vortex-array/src/compute/mask.rs:74:10
   5: run_fuzz_action
             at ./fuzz/src/array/mod.rs:640:33
   6: __libfuzzer_sys_run
             at ./fuzz/fuzz_targets/array_ops.rs:14:11

Similarities to Original Issue:

• Same crash location (vortex-array/src/compute/mask.rs:74 and fuzz/src/array/mod.rs:640)
• Same error pattern: "mask operation should succeed in fuzz test: Internal error: compute function mask returned a result of type X but expected Y"
• Same root cause: Mask operation incorrectly changing nullability of nested struct fields from NonNullable to Nullable
• Same type system invariant violation in mask compute kernel for nested structs

Differences:

• Original issue (Fuzzing Crash: Mask operation returns wrong dtype for nested struct with F16 fields #6351): F16 primitive fields in nested struct
• This crash: UTF-8 (VarBinView) fields in nested struct
• Different struct field names ("==("" and ""` vs empty strings)
• Different array lengths (246 vs 110)
• Note: These differences indicate the same root cause manifesting with different field types

Array Structure from Current Crash:

• ChunkedArray (length 246) with dtype: Struct(NonNullable) containing 2 fields
• Field 0: Utf8(NonNullable) - This field's nullability is being incorrectly changed to Nullable
• Field 1: Utf8(NonNullable) - This field's nullability is being incorrectly changed to Nullable
• Contains multiple StructArray chunks with VarBinViewArray fields
• Mask operation applied via Compress(Compact) action

Debug Output

FuzzArrayAction {
    array: ChunkedArray {
        dtype: Struct(
            StructFields {
                names: FieldNames(
                    [
                        FieldName(
                            "==(" ,
                        ),
                        FieldName(
                            "",
                        ),
                    ],
                ),
                dtypes: [
                    FieldDType {
                        inner: Owned(
                            Utf8(
                                NonNullable,
                            ),
                        ),
                    },
                    FieldDType {
                        inner: Owned(
                            Utf8(
                                NonNullable,
                            ),
                        ),
                    },
                ],
            },
            NonNullable,
        ),
        len: 246,
        chunks: [
            StructArray {
                len: 3,
                fields: [
                    VarBinArray { dtype: Utf8(NonNullable), ... },
                    VarBinViewArray { dtype: Utf8(NonNullable), ... },
                ],
                validity: Array(
                    BoolArray {
                        dtype: Bool(NonNullable),
                        bits: BitBuffer { ... },
                    },
                ),
            },
            StructArray {
                len: 200,
                fields: [
                    VarBinViewArray { dtype: Utf8(NonNullable), ... },
                    VarBinViewArray { dtype: Utf8(NonNullable), ... },
                ],
                validity: Array(BoolArray { ... }),
            },
            ...
        ],
    },
    actions: [
        (
            Compress(Compact),
            Array(StructArray { ... }),
        ),
    ],
}

Occurrence Details

• Crash File: crash-a3efd2be2a05cc369820dd8438b48ab18bf22228
• Branch: develop
• Commit: a11336d
• Crash Artifact: https://github.com/vortex-data/vortex/actions/runs/21894652928/artifacts/5455049060

Reproduction

cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-a3efd2be2a05cc369820dd8438b48ab18bf22228 -- -rss_limit_mb=0

---

Auto-detected by fuzzing workflow with Claude analysis