Repository navigation
Closed
Labels
Description
Fuzzing Crash Report
Analysis
Crash Location: fuzz/src/array/mod.rs:587 in assert_scalar_eq (called during Sum action validation)
Error Message:
Scalar mismatch: expected decimal256(22337414285953441061567344838540486740290084953887815750718056913398681145773, precision=76, scale=75), got null in step 1
Stack Trace:
3: assert_scalar_eq
at ./fuzz/src/array/mod.rs:705:13
4: run_fuzz_action
at ./fuzz/src/array/mod.rs:587:17
5: __libfuzzer_sys_run
at ./fuzz/fuzz_targets/array_ops.rs:14:11
6: rust_fuzzer_test_input
at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.10/src/lib.rs:363:60
Root Cause:
The fuzzer discovered a bug where the sum operation on a ChunkedArray containing DecimalArrays returns a null scalar instead of the expected decimal value. The issue occurs with:
- Array type: ChunkedArray with 2 chunks of DecimalArrays
- Decimal dtype:
Decimal(precision=76, scale=75, Nullable) - Values type: I256 (decimal256)
- Operation: Sum operation (step 1)
- Expected result: decimal256(22337414285953441061567344838540486740290084953887815750718056913398681145773, precision=76, scale=75)
- Actual result: null
The ChunkedArray contains:
- First chunk: DecimalArray with 4 elements (I256 values, AllValid)
- Second chunk: DecimalArray with 3 elements (I256 values, AllValid)
All values are valid (no nulls), so the sum operation should return a valid decimal value. However, the sum operation is incorrectly returning null, suggesting a bug in either:
- The sum implementation for DecimalArray
- The sum implementation for ChunkedArray when dealing with decimal chunks
- Scalar value construction or type handling for large decimal256 values
- Overflow or precision handling during decimal summation
Debug Output
Output of `std::fmt::Debug`:
FuzzArrayAction {
array: ChunkedArray {
dtype: Decimal(
DecimalDType {
precision: 76,
scale: 75,
},
Nullable,
),
len: 7,
chunk_offsets: PrimitiveArray {
dtype: Primitive(
U64,
NonNullable,
),
buffer: Buffer<u8> {
length: 24,
alignment: Alignment(
8,
),
as_slice: [0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, ...],
},
validity: NonNullable,
stats_set: ArrayStats {
inner: RwLock {
data: StatsSet {
values: [],
},
},
},
},
chunks: [
DecimalArray {
dtype: Decimal(
DecimalDType {
precision: 76,
scale: 75,
},
Nullable,
),
values: Buffer<u8> {
length: 128,
alignment: Alignment(
16,
),
as_slice: [3, 0, 0, 0, 0, 0, 0, 0, 0, 144, 236, 228, 101, 118, 200, 187, ...],
},
values_type: I256,
validity: AllValid,
stats_set: ArrayStats {
inner: RwLock {
data: StatsSet {
values: [],
},
},
},
},
DecimalArray {
dtype: Decimal(
DecimalDType {
precision: 76,
scale: 75,
},
Nullable,
),
values: Buffer<u8> {
length: 96,
alignment: Alignment(
16,
),
as_slice: [77, 71, 71, 71, 178, 71, 71, 255, 255, 79, 152, 30, 160, 222, 241, 221, ...],
},
values_type: I256,
validity: AllValid,
stats_set: ArrayStats {
inner: RwLock {
data: StatsSet {
values: [],
},
},
},
},
],
stats_set: ArrayStats {
inner: RwLock {
data: StatsSet {
values: [],
},
},
},
},
actions: [
(
Sum,
Scalar(
Scalar {
dtype: Decimal(
DecimalDType {
precision: 76,
scale: 75,
},
Nullable,
),
value: ScalarValue(
Decimal(
I256(
i256(
22337414285953441061567344838540486740290084953887815750718056913398681145773,
),
),
),
),
},
),
),
(
Sum,
Scalar(
Scalar {
dtype: Decimal(
DecimalDType {
precision: 76,
scale: 75,
},
Nullable,
),
value: ScalarValue(
Decimal(
I256(
i256(
22337414285953441061567344838540486740290084953887815750718056913398681145773,
),
),
),
),
},
),
),
(
Sum,
Scalar(
Scalar {
dtype: Decimal(
DecimalDType {
precision: 76,
scale: 75,
},
Nullable,
),
value: ScalarValue(
Decimal(
I256(
i256(
22337414285953441061567344838540486740290084953887815750718056913398681145773,
),
),
),
),
},
),
),
(
Sum,
Scalar(
Scalar {
dtype: Decimal(
DecimalDType {
precision: 76,
scale: 75,
},
Nullable,
),
value: ScalarValue(
Decimal(
I256(
i256(
22337414285953441061567344838540486740290084953887815750718056913398681145773,
),
),
),
),
},
),
),
],
}
Summary
- Target:
array_ops - Crash File:
crash-8e17520b7a4059d336d944b96e615c0028bdc415 - Branch: develop
- Commit: 265f29a
- Crash Artifact: (artifact URL not available)
Reproduction
-
Download the crash artifact (if available)
-
Reproduce locally:
# The artifact contains array_ops/crash-8e17520b7a4059d336d944b96e615c0028bdc415
cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-8e17520b7a4059d336d944b96e615c0028bdc415 -- -rss_limit_mb=0- Get full backtrace:
RUST_BACKTRACE=full cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-8e17520b7a4059d336d944b96e615c0028bdc415 -- -rss_limit_mb=0Auto-created by fuzzing workflow with Claude analysis
Activity
github-actions commentedon Dec 22, 2025
Related Crash Detected
A similar crash was detected in the
array_opstarget.Crash Details
Crash Location:
fuzz/src/array/mod.rs:587inassert_scalar_eq(called during Sum action validation)Error Message:
Stack Trace:
Similarities to Original Issue:
fuzz/src/array/mod.rs:587inassert_scalar_eqDifferences:
Debug Output
Occurrence Details
crash-c6fd16b0c85012370d501e9aaea9db730cb873fbReproduction
Auto-detected by fuzzing workflow with Claude analysis
github-actions commentedon Dec 22, 2025
Related Crash Detected
A similar crash was detected in the
array_opstarget.Crash Details
Crash Location:
fuzz/src/array/mod.rs:705inassert_scalar_eqError Message:
Stack Trace:
Similarities to Original Issue:
fuzz/src/array/mod.rs:587callingassert_scalar_eq)Decimal(precision=76, scale=75, Nullable)with I256 valuesDifferences:
20838483337615333622867048918413809811831720253113501127311878661340024727345vs22337414285953441061567344838540486740290084953887815750718056913398681145773Debug Output
Occurrence Details
crash-3f1561ed9ad830675dcde992e392e1ff19934e38Reproduction
Auto-detected by fuzzing workflow with Claude analysis
github-actions commentedon Dec 25, 2025
Related Crash Detected
A similar crash was detected in the
array_opstarget.Crash Details
Crash Location:
fuzz/src/array/mod.rs:assert_scalar_eq(called fromfuzz/src/array/mod.rs:600during Sum action validation)Error Message:
Stack Trace:
Similarities to Original Issue:
fuzz/src/array/mod.rs:assert_scalar_eqDecimal(precision=76, scale=75, Nullable)Differences:
Note: These differences appear superficial - the root cause is identical: sum operation incorrectly returning null for valid decimal ChunkedArrays.
Debug Output
Occurrence Details
crash-0bac3630a917c5455df15725244ebb0f5ed8c36dReproduction
Auto-detected by fuzzing workflow with Claude analysis
github-actions commentedon Dec 27, 2025
Related Crash Detected
A similar crash was detected in the
array_opstarget.Crash Details
Crash Location:
fuzz/fuzz_targets/array_ops.rs:18→fuzz/src/array/mod.rs:721inassert_scalar_eqError Message:
Stack Trace:
Similarities to Original Issue:
Differences:
The sequence is:
Debug Output
Occurrence Details
crash-654fe1bfa35b9e071b0b031bd7e9d729e02d2414Reproduction
Auto-detected by fuzzing workflow with Claude analysis
github-actions commentedon Dec 28, 2025
Related Crash Detected
A similar crash was detected in the
array_opstarget.Crash Details
Crash Location:
fuzz/src/array/mod.rs:assert_scalar_eq(called during Sum action validation)Error Message:
Stack Trace:
Similarities to Original Issue:
fuzz/src/array/mod.rs:assert_scalar_eqAllValidvalidity (no nulls in input)Differences:
Debug Output
Occurrence Details
crash-0e0c3b32724807d4ec9bab609793285630887210Reproduction
Auto-detected by fuzzing workflow with Claude analysis
github-actions commentedon Dec 28, 2025
Related Crash Detected
A similar crash was detected in the
array_opstarget.Crash Details
Crash Location:
fuzz/src/array/mod.rs:721:13inassert_scalar_eq(called during Sum action validation)Error Message:
Stack Trace:
Similarities to Original Issue:
assert_scalar_eqinfuzz/src/array/mod.rsDecimal(precision=76, scale=75, Nullable)Differences:
Note: These differences indicate the same root cause manifesting differently. The mask operation in step 1 doesn't affect the underlying bug - the sum operation still incorrectly returns null for valid decimal arrays.
Debug Output
Occurrence Details
crash-6e35d1932d046c46dbad153517e50bceb7b2c53fReproduction
Auto-detected by fuzzing workflow with Claude analysis
github-actions commentedon Dec 28, 2025
Related Crash Detected
A similar crash was detected in the `array_ops` target.
Crash Details
Crash Location: `fuzz/fuzz_targets/array_ops.rs:18` → `fuzz/src/array/mod.rs:assert_scalar_eq`
Error Message:
```
Scalar mismatch: expected decimal256(10335731459288881875449326843340756734051447447459996202947475384727173595149, precision=76, scale=75), got null in step 2
```
Stack Trace:
```
3: assert_scalar_eq
at ./fuzz/src/array/mod.rs:721:13
4: run_fuzz_action
at ./fuzz/src/array/mod.rs:600:17
5: __libfuzzer_sys_run
at ./fuzz/fuzz_targets/array_ops.rs:14:11
```
Similarities to Original Issue:
Differences:
Debug Output
```
FuzzArrayAction {
array: ChunkedArray {
dtype: Decimal(
DecimalDType {
precision: 76,
scale: 75,
},
Nullable,
),
len: 12,
chunk_offsets: PrimitiveArray {
dtype: Primitive(
U64,
NonNullable,
),
buffer: Buffer {
length: 24,
alignment: Alignment(
8,
),
as_slice: [0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, ...],
},
validity: NonNullable,
stats_set: ArrayStats {
inner: RwLock {
data: StatsSet {
values: [],
},
},
},
},
chunks: [
DecimalArray {
dtype: Decimal(
DecimalDType {
precision: 76,
scale: 75,
},
Nullable,
),
values: Buffer {
length: 128,
alignment: Alignment(
16,
),
as_slice: [3, 0, 0, 0, 0, 0, 0, 0, 0, 144, 236, 228, 101, 118, 200, 187, ...],
},
values_type: I256,
validity: AllValid,
stats_set: ArrayStats {
inner: RwLock {
data: StatsSet {
values: [],
},
},
},
},
DecimalArray {
dtype: Decimal(
DecimalDType {
precision: 76,
scale: 75,
},
Nullable,
),
values: Buffer {
length: 256,
alignment: Alignment(
16,
),
as_slice: [1, 0, 0, 0, 0, 0, 0, 0, 0, 208, 64, 171, 43, 14, 159, 225, ...],
},
values_type: I256,
validity: AllValid,
stats_set: ArrayStats {
inner: RwLock {
data: StatsSet {
values: [],
},
},
},
},
],
stats_set: ArrayStats {
inner: RwLock {
data: StatsSet {
values: [],
},
},
},
},
actions: [
(
Mask(
Values(
MaskValues {
buffer: BitBuffer {
buffer: Buffer {
length: 2,
alignment: Alignment(
1,
),
as_slice: [248, 15],
},
offset: 0,
len: 12,
},
indices: OnceLock(
,
),
slices: OnceLock(
,
),
true_count: 9,
density: 0.75,
},
),
),
Array(
DecimalArray {
dtype: Decimal(
DecimalDType {
precision: 76,
scale: 75,
},
Nullable,
),
values: Buffer {
length: 384,
alignment: Alignment(
16,
),
as_slice: [3, 0, 0, 0, 0, 0, 0, 0, 0, 144, 236, 228, 101, 118, 200, 187, ...],
},
values_type: I256,
validity: Array(
BoolArray {
dtype: Bool(
NonNullable,
),
bits: BitBuffer {
buffer: Buffer {
length: 2,
alignment: Alignment(
1,
),
as_slice: [7, 240],
},
offset: 0,
len: 12,
},
validity: NonNullable,
stats_set: ArrayStats {
inner: RwLock {
data: StatsSet {
values: [
(
Sum,
Exact(
ScalarValue(
Primitive(
U64(
3,
),
),
),
),
),
],
},
},
},
},
),
stats_set: ArrayStats {
inner: RwLock {
data: StatsSet {
values: [],
},
},
},
},
),
),
(
Sum,
Scalar(
Scalar {
dtype: Decimal(
DecimalDType {
precision: 76,
scale: 75,
},
Nullable,
),
value: ScalarValue(
Decimal(
I256(
i256(
10335731459288881875449326843340756734051447447459996202947475384727173595149,
),
),
),
),
},
),
),
(
Sum,
Scalar(
Scalar {
dtype: Decimal(
DecimalDType {
precision: 76,
scale: 75,
},
Nullable,
),
value: ScalarValue(
Decimal(
I256(
i256(
10335731459288881875449326843340756734051447447459996202947475384727173595149,
),
),
),
),
},
),
),
(
Sum,
Scalar(
Scalar {
dtype: Decimal(
DecimalDType {
precision: 76,
scale: 75,
},
Nullable,
),
value: ScalarValue(
Decimal(
I256(
i256(
10335731459288881875449326843340756734051447447459996202947475384727173595149,
),
),
),
),
},
),
),
],
}
```
Occurrence Details
Reproduction
```bash
cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-96f6272afa3073215ceed0026466efed91cc2fec -- -rss_limit_mb=0
```
Auto-detected by fuzzing workflow with Claude analysis
github-actions commentedon Dec 29, 2025
Related Crash Detected
A similar crash was detected in the
array_opstarget.Crash Details
Crash Location:
fuzz/src/array/mod.rs:assert_scalar_eq(called fromrun_fuzz_actionat line 600)Error Message:
Stack Trace:
Similarities to Original Issue:
Decimal(precision=76, scale=75, Nullable)with I256 valuesassert_scalar_eqinfuzz/src/array/mod.rsDifferences:
Debug Output
Occurrence Details
crash-0da036cfc5fd676adfb7b171288653ccfe781dc6Reproduction
Auto-detected by fuzzing workflow with Claude analysis
github-actions commentedon Dec 29, 2025
Related Crash Detected
A similar crash was detected in the
array_opstarget.Crash Details
Crash Location:
fuzz/src/array/mod.rs:721:assert_scalar_eqError Message:
Stack Trace:
Similarities to Original Issue:
assert_scalar_eqinfuzz/src/array/mod.rsDifferences:
Debug Output
Occurrence Details
crash-175c32694c2bf3490a0b357fbe3dadfc5d567e52Reproduction
Auto-detected by fuzzing workflow with Claude analysis
github-actions commentedon Dec 29, 2025
Related Crash Detected
A similar crash was detected in the
array_opstarget.Crash Details
Crash Location:
fuzz/src/array/mod.rs:assert_scalar_eqError Message:
Stack Trace:
Similarities to Original Issue:
fuzz/src/array/mod.rs:assert_scalar_eqDecimal(precision=76, scale=75, Nullable)with I256 valuesDifferences:
Debug Output
Occurrence Details
crash-2d3cc1cd14e9fdcf087af7a7e4f7ab95cf2ba52dReproduction
Auto-detected by fuzzing workflow with Claude analysis
github-actions commentedon Dec 30, 2025
Related Crash Detected
A similar crash was detected in the
array_opstarget.Crash Details
Crash Location:
fuzz/fuzz_targets/array_ops.rs:18inassert_scalar_eqError Message:
Stack Trace:
Similarities to Original Issue:
assert_scalar_eqduring Sum operation validationDifferences:
These differences indicate the same root cause manifesting in different scenarios. The bug appears to be in the Sum operation implementation for ChunkedArray containing DecimalArrays with I256 values, not dependent on the specific values or array size.
Debug Output
Occurrence Details
crash-f7fea21f29de6d3578bd8247fa99ad1f58eab795Reproduction
Auto-detected by fuzzing workflow with Claude analysis
github-actions commentedon Dec 30, 2025
Related Crash Detected
A similar crash was detected in the
array_opstarget.Crash Details
Crash Location:
fuzz/src/array/mod.rs:assert_scalar_eq(called fromrun_fuzz_action)Error Message:
Stack Trace:
Similarities to Original Issue:
Differences:
These differences suggest the same underlying bug manifests in multiple scenarios - both when summing an unmodified ChunkedArray and when summing after masking operations.
Debug Output
Occurrence Details
crash-34f54e50add1794aeae110af0dd1fc72ad012a2eReproduction
Auto-detected by fuzzing workflow with Claude analysis
github-actions commentedon Dec 31, 2025
Related Crash Detected
A similar crash was detected in the
array_opstarget.Crash Details
Crash Location:
fuzz/src/array/mod.rs:assert_scalar_eq(line 721)Error Message:
Stack Trace:
Similarities to Original Issue:
fuzz/src/array/mod.rs:assert_scalar_eqDecimal(precision=76, scale=75, Nullable)with I256 valuesAllValidvalidity (no nulls in input data)Differences:
Note: These differences may indicate the same root cause manifesting differently. The key similarity is that Sum on valid DecimalArray data returns null unexpectedly.
Debug Output
Occurrence Details
crash-681f572977a7ca9368045bcb7a1e1da09f744650Reproduction
Auto-detected by fuzzing workflow with Claude analysis
github-actions commentedon Dec 31, 2025
Related Crash Detected
A similar crash was detected in the
array_opstarget.Crash Details
Crash Location:
fuzz/fuzz_targets/array_ops.rs:18(viaassert_scalar_eqinfuzz/src/array/mod.rs)Error Message:
Stack Trace:
Similarities to Original Issue:
Decimal(precision=76, scale=75, Nullable)array_ops.rs→run_fuzz_action→assert_scalar_eqDifferences:
Debug Output
Occurrence Details
crash-d2b866e252abf09101a67a3ed4133c6e621fbc85Reproduction
Auto-detected by fuzzing workflow with Claude analysis
github-actions commentedon Jan 1, 2026
Related Crash Detected
A similar crash was detected in the
array_opstarget.Crash Details
Crash Location:
fuzz/src/array/mod.rs:assert_scalar_eqError Message:
Stack Trace:
Similarities to Original Issue:
fuzz/src/array/mod.rs:assert_scalar_eqDecimal(precision=76, scale=75, Nullable)Differences:
Debug Output
Occurrence Details
crash-ca569401090e92561b5889ecdf02f71c0226bdfdReproduction
Auto-detected by fuzzing workflow with Claude analysis
github-actions commentedon Jan 1, 2026
Related Crash Detected
A similar crash was detected in the
array_opstarget.Crash Details
Crash Location:
fuzz/src/array/mod.rs:assert_scalar_eqError Message:
Stack Trace:
Similarities to Original Issue:
fuzz/src/array/mod.rs:assert_scalar_eqDifferences:
This appears to be another instance of the same bug where Sum operations on ChunkedArray containing DecimalArrays with I256 values incorrectly return null. Based on issue #5811's analysis, this may be due to i256 overflow during summation, where the implementation correctly returns null on overflow but the fuzzer expects a wrapped/computed value.
Debug Output
Occurrence Details
crash-577fa3dfc7d49419c7393b754beab4246482a3eeReproduction
Auto-detected by fuzzing workflow with Claude analysis
github-actions commentedon Jan 2, 2026
Related Crash Detected
A similar crash was detected in the
array_opstarget.Crash Details
Crash Location:
fuzz/src/array/mod.rs:assert_scalar_eq(viafuzz/fuzz_targets/array_ops.rs:18)Error Message:
Stack Trace:
Similarities to Original Issue:
Differences:
Debug Output
Occurrence Details
crash-b81f7911ebda9dcfb5073d2a9ebd06374e8c7503Reproduction
Auto-detected by fuzzing workflow with Claude analysis
github-actions commentedon Jan 3, 2026
Related Crash Detected
A similar crash was detected in the
array_opstarget.Crash Details
Crash Location:
fuzz/fuzz_targets/array_ops.rs:18→fuzz/src/array/mod.rs:600(assert_scalar_eqduring Sum action)Error Message:
Stack Trace:
Similarities to Original Issue:
Differences:
Debug Output
Occurrence Details
crash-b6cb3f5813ba435b245c5da03b3a85e034f128f3Reproduction
Auto-detected by fuzzing workflow with Claude analysis
github-actions commentedon Jan 4, 2026
Related Crash Detected
A similar crash was detected in the
array_opstarget.Crash Details
Crash Location:
fuzz/src/array/mod.rs:assert_scalar_eq(line 721)Error Message:
Stack Trace:
Similarities to Original Issue:
fuzz/src/array/mod.rs:assert_scalar_eqDifferences:
These differences are expected from fuzzing different inputs, but the root cause is clearly the same: sum operation on valid ChunkedArray with DecimalArray chunks incorrectly returns null instead of the computed sum.
Debug Output
Occurrence Details
crash-fbe0a2d61ecaa6f02662f1022dc48dfd003ce83fReproduction
Auto-detected by fuzzing workflow with Claude analysis