Fuzzing Crash: Sum operation on chunked decimal array returns null instead of expected value

[github-actions]

Fuzzing Crash Report

Analysis

Crash Location: fuzz/src/array/mod.rs:721 in assert_scalar_eq function (called from run_fuzz_action at line 600)

Error Message:

Scalar mismatch: expected decimal256(21158192219502898184827793276925111097118417895871292770301872181674435414613, precision=76, scale=75), got null in step 1

Stack Trace:

#0 assert_scalar_eq at ./fuzz/src/array/mod.rs:721:13
#1 run_fuzz_action at ./fuzz/src/array/mod.rs:600:17
#2 __libfuzzer_sys_run at ./fuzz/fuzz_targets/array_ops.rs:14:11

Root Cause: The sum operation is being performed on a ChunkedArray containing decimal values with precision=76 and scale=75. The fuzzer expects the sum to return the decimal value 21158192219502898184827793276925111097118417895871292770301872181674435414613, but the actual result is null.

This indicates a bug in the sum aggregation logic for chunked decimal arrays where:

• The array contains two chunks of DecimalArray, both with valid decimal values (validity: AllValid)
• The first chunk has 4 elements, the second chunk has 3 elements (total 7 elements)
• Despite having valid values, the sum operation returns null instead of computing the actual sum

Debug Output

FuzzArrayAction {
    array: ChunkedArray {
        dtype: Decimal(
            DecimalDType {
                precision: 76,
                scale: 75,
            },
            Nullable,
        ),
        len: 7,
        chunk_offsets: PrimitiveArray {
            dtype: Primitive(
                U64,
                NonNullable,
            ),
            buffer: Buffer<u8> {
                length: 24,
                alignment: Alignment(
                    8,
                ),
                as_slice: [0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, ...],
            },
            validity: NonNullable,
            stats_set: ArrayStats {
                inner: RwLock {
                    data: StatsSet {
                        values: [],
                    },
                },
            },
        },
        chunks: [
            DecimalArray {
                dtype: Decimal(
                    DecimalDType {
                        precision: 76,
                        scale: 75,
                    },
                    Nullable,
                ),
                values: Buffer<u8> {
                    length: 128,
                    alignment: Alignment(
                        16,
                    ),
                    as_slice: [1, 0, 0, 0, 0, 0, 0, 0, 0, 208, 64, 171, 43, 14, 159, 191, ...],
                },
                values_type: I256,
                validity: AllValid,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [],
                        },
                    },
                },
            },
            DecimalArray {
                dtype: Decimal(
                    DecimalDType {
                        precision: 76,
                        scale: 75,
                    },
                    Nullable,
                ),
                values: Buffer<u8> {
                    length: 96,
                    alignment: Alignment(
                        16,
                    ),
                    as_slice: [5, 0, 0, 0, 0, 0, 0, 0, 0, 80, 152, 30, 160, 222, 241, 221, ...],
                },
                values_type: I256,
                validity: AllValid,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [],
                        },
                    },
                },
            },
        ],
        stats_set: ArrayStats {
            inner: RwLock {
                data: StatsSet {
                    values: [],
                },
            },
        },
    },
    actions: [
        (
            Sum,
            Scalar(
                Scalar {
                    dtype: Decimal(
                        DecimalDType {
                            precision: 76,
                            scale: 75,
                        },
                        Nullable,
                    ),
                    value: ScalarValue(
                        Decimal(
                            I256(
                                i256(
                                    21158192219502898184827793276925111097118417895871292770301872181674435414613,
                                ),
                            ),
                        ),
                    ),
                },
            ),
        ),
        (
            Sum,
            Scalar(
                Scalar {
                    dtype: Decimal(
                        DecimalDType {
                            precision: 76,
                            scale: 75,
                        },
                        Nullable,
                    ),
                    value: ScalarValue(
                        Decimal(
                            I256(
                                i256(
                                    21158192219502898184827793276925111097118417895871292770301872181674435414613,
                                ),
                            ),
                        ),
                    ),
                },
            ),
        ),
    ],
}

Summary

• Target: array_ops
• Crash File: crash-0c4be7951d94bef1a37810859f98f640d9e2858e
• Branch: develop
• Commit: 750a1c3
• Crash Artifact: https://github.com/vortex-data/vortex/actions/runs/20851488762/artifacts/5075912079

Reproduction

1. Download the crash artifact:

   • Direct download: https://github.com/vortex-data/vortex/actions/runs/20851488762/artifacts/5075912079
   • Or find operations-fuzzing-crash-artifacts at the workflow run
   • Extract the zip file

2. Reproduce locally:

# The artifact contains array_ops/crash-0c4be7951d94bef1a37810859f98f640d9e2858e
cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-0c4be7951d94bef1a37810859f98f640d9e2858e -- -rss_limit_mb=0

3. Get full backtrace:

RUST_BACKTRACE=full cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-0c4be7951d94bef1a37810859f98f640d9e2858e -- -rss_limit_mb=0

---

Auto-created by fuzzing workflow with Claude analysis

[github-actions]

Related Crash Detected

A similar crash was detected in the array_ops target.

Crash Details

Crash Location: fuzz/src/array/mod.rs:721 in assert_scalar_eq function

Error Message:

Scalar mismatch: expected decimal256(10335731459288881875449326843340756734051447436922650588550318484785828200461, precision=76, scale=75), got null in step 2

Stack Trace:

#0 assert_scalar_eq at ./fuzz/src/array/mod.rs:721:13
#1 run_fuzz_action at ./fuzz/src/array/mod.rs:600:17
#2 __libfuzzer_sys_run at ./fuzz/fuzz_targets/array_ops.rs:14:11

Similarities to Original Issue:

• Exact same crash location (fuzz/src/array/mod.rs:721 in assert_scalar_eq)
• Same error pattern: Sum operation returns null instead of expected decimal256 value
• Same data type: Decimal with precision=76, scale=75, Nullable
• Same root cause: Sum aggregation on ChunkedArray containing DecimalArray chunks fails to compute the sum and returns null

Differences:

• This crash occurs at step 2 instead of step 1
• The array has 12 elements (chunks of 4 and 8) which is first masked to 9 elements, then Sum is performed
• The original issue had 7 elements (chunks of 4 and 3) with direct Sum operation
• Note: These differences may indicate the same root cause manifesting differently - the sum operation failing on chunked decimal arrays, regardless of whether masking is applied first

Debug Output

FuzzArrayAction {
    array: ChunkedArray {
        dtype: Decimal(
            DecimalDType {
                precision: 76,
                scale: 75,
            },
            Nullable,
        ),
        len: 12,
        chunk_offsets: PrimitiveArray {
            dtype: Primitive(
                U64,
                NonNullable,
            ),
            buffer: Buffer<u8> {
                length: 24,
                alignment: Alignment(
                    8,
                ),
                as_slice: [0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, ...],
            },
            validity: NonNullable,
            stats_set: ArrayStats {
                inner: RwLock {
                    data: StatsSet {
                        values: [],
                    },
                },
            },
        },
        chunks: [
            DecimalArray {
                dtype: Decimal(
                    DecimalDType {
                        precision: 76,
                        scale: 75,
                    },
                    Nullable,
                ),
                values: Buffer<u8> {
                    length: 128,
                    alignment: Alignment(
                        16,
                    ),
                    as_slice: [3, 0, 0, 0, 0, 0, 0, 0, 0, 144, 236, 228, 101, 118, 200, 187, ...],
                },
                values_type: I256,
                validity: AllValid,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [],
                        },
                    },
                },
            },
            DecimalArray {
                dtype: Decimal(
                    DecimalDType {
                        precision: 76,
                        scale: 75,
                    },
                    Nullable,
                ),
                values: Buffer<u8> {
                    length: 256,
                    alignment: Alignment(
                        16,
                    ),
                    as_slice: [1, 0, 0, 0, 0, 0, 0, 0, 0, 208, 64, 171, 43, 14, 231, 224, ...],
                },
                values_type: I256,
                validity: AllValid,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [],
                        },
                    },
                },
            },
        ],
        stats_set: ArrayStats {
            inner: RwLock {
                data: StatsSet {
                    values: [],
                },
            },
        },
    },
    actions: [
        (
            Mask(
                Values(
                    MaskValues {
                        buffer: BitBuffer {
                            buffer: Buffer<u8> {
                                length: 2,
                                alignment: Alignment(
                                    1,
                                ),
                                as_slice: [248, 15],
                            },
                            offset: 0,
                            len: 12,
                        },
                        indices: OnceLock(
                            <uninit>,
                        ),
                        slices: OnceLock(
                            <uninit>,
                        ),
                        true_count: 9,
                        density: 0.75,
                    },
                ),
            ),
            Array(
                DecimalArray {
                    dtype: Decimal(
                        DecimalDType {
                            precision: 76,
                            scale: 75,
                        },
                        Nullable,
                    ),
                    values: Buffer<u8> {
                        length: 384,
                        alignment: Alignment(
                            16,
                        ),
                        as_slice: [3, 0, 0, 0, 0, 0, 0, 0, 0, 144, 236, 228, 101, 118, 200, 187, ...],
                    },
                    values_type: I256,
                    validity: Array(
                        BoolArray {
                            dtype: Bool(
                                NonNullable,
                            ),
                            bits: BitBuffer {
                                buffer: Buffer<u8> {
                                    length: 2,
                                    alignment: Alignment(
                                        1,
                                    ),
                                    as_slice: [7, 240],
                                },
                                offset: 0,
                                len: 12,
                            },
                            stats_set: ArrayStats {
                                inner: RwLock {
                                    data: StatsSet {
                                        values: [],
                                    },
                                },
                            },
                        },
                    ),
                    stats_set: ArrayStats {
                        inner: RwLock {
                            data: StatsSet {
                                values: [],
                            },
                        },
                    },
                },
            ),
        ),
        (
            Sum,
            Scalar(
                Scalar {
                    dtype: Decimal(
                        DecimalDType {
                            precision: 76,
                            scale: 75,
                        },
                        Nullable,
                    ),
                    value: ScalarValue(
                        Decimal(
                            I256(
                                i256(
                                    10335731459288881875449326843340756734051447436922650588550318484785828200461,
                                ),
                            ),
                        ),
                    ),
                },
            ),
        ),
    ],
}

Occurrence Details

• Crash File: crash-eb1654e2ceefb4939866208df67a2abbd668bdb3
• Branch: develop
• Commit: 4b9fc90dfc2c93afdcee8b0f0e6ca86f9f10aa36
• Crash Artifact: https://github.com/vortex-data/vortex/actions/runs/12965768803/artifacts/2412892734

Reproduction

cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-eb1654e2ceefb4939866208df67a2abbd668bdb3 -- -rss_limit_mb=0

---

Auto-detected by fuzzing workflow with Claude analysis

[github-actions]

Related Crash Detected

A similar crash was detected in the array_ops target.

Crash Details

Crash Location: fuzz/src/array/mod.rs:assert_scalar_eq (line 721)

Error Message:

Scalar mismatch: expected decimal256(12644199416214749861976158928731488213134602233624266938936763854067268495057, precision=76, scale=75), got null in step 1

Stack Trace:

#3 assert_scalar_eq
      at ./fuzz/src/array/mod.rs:721:13
#4 run_fuzz_action
      at ./fuzz/src/array/mod.rs:600:17
#5 __libfuzzer_sys_run
      at ./fuzz/fuzz_targets/array_ops.rs:14:11

Similarities to Original Issue:

• Identical crash location: fuzz/src/array/mod.rs:721 in assert_scalar_eq
• Same error pattern: Sum operation on ChunkedArray with decimal values returns null instead of expected value
• Same decimal configuration: precision=76, scale=75, I256 values
• Same array structure: ChunkedArray containing DecimalArray chunks with AllValid validity
• Both crashes occur at step 1 of the Sum operation

Differences:

• Array length: 12 elements (vs 7 in original) with chunk offsets [0, 4] (first chunk has 4 elements)
• Different expected sum value: 12644199416214749861976158928731488213134602233624266938936763854067268495057
• The fuzzer performs 4 Sum operations in sequence (all expecting the same result)

Note: These differences are superficial - the root cause appears identical: Sum operation on chunked decimal arrays incorrectly returns null instead of the computed sum.

Debug Output

FuzzArrayAction {
    array: ChunkedArray {
        dtype: Decimal(
            DecimalDType {
                precision: 76,
                scale: 75,
            },
            Nullable,
        ),
        len: 12,
        chunk_offsets: PrimitiveArray {
            dtype: Primitive(
                U64,
                NonNullable,
            ),
            buffer: Buffer<u8> {
                length: 24,
                alignment: Alignment(
                    8,
                ),
                as_slice: [0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, ...],
            },
            validity: NonNullable,
            stats_set: ArrayStats {
                inner: RwLock {
                    data: StatsSet {
                        values: [],
                    },
                },
            },
        },
        chunks: [
            DecimalArray {
                dtype: Decimal(
                    DecimalDType {
                        precision: 76,
                        scale: 75,
                    },
                    Nullable,
                ),
                values: Buffer<u8> {
                    length: 128,
                    alignment: Alignment(
                        16,
                    ),
                    as_slice: [3, 0, 0, 0, 0, 0, 0, 0, 0, 144, 236, 228, 101, 118, 200, 187, ...],
                },
                values_type: I256,
                validity: AllValid,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [],
                        },
                    },
                },
            },
            DecimalArray {
                dtype: Decimal(
                    DecimalDType {
                        precision: 76,
                        scale: 75,
                    },
                    Nullable,
                ),
                values: Buffer<u8> {
                    length: 256,
                    alignment: Alignment(
                        16,
                    ),
                    as_slice: [213, 211, 211, 211, 211, 211, 211, 211, 41, 163, 20, 127, 255, 225, 114, 109, ...],
                },
                values_type: I256,
                validity: AllValid,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [],
                        },
                    },
                },
            },
        ],
        stats_set: ArrayStats {
            inner: RwLock {
                data: StatsSet {
                    values: [],
                },
            },
        },
    },
    actions: [
        (
            Sum,
            Scalar(
                Scalar {
                    dtype: Decimal(
                        DecimalDType {
                            precision: 76,
                            scale: 75,
                        },
                        Nullable,
                    ),
                    value: ScalarValue(
                        Decimal(
                            I256(
                                i256(
                                    12644199416214749861976158928731488213134602233624266938936763854067268495057,
                                ),
                            ),
                        ),
                    ),
                },
            ),
        ),
        (
            Sum,
            Scalar(
                Scalar {
                    dtype: Decimal(
                        DecimalDType {
                            precision: 76,
                            scale: 75,
                        },
                        Nullable,
                    ),
                    value: ScalarValue(
                        Decimal(
                            I256(
                                i256(
                                    12644199416214749861976158928731488213134602233624266938936763854067268495057,
                                ),
                            ),
                        ),
                    ),
                },
            ),
        ),
        (
            Sum,
            Scalar(
                Scalar {
                    dtype: Decimal(
                        DecimalDType {
                            precision: 76,
                            scale: 75,
                        },
                        Nullable,
                    ),
                    value: ScalarValue(
                        Decimal(
                            I256(
                                i256(
                                    12644199416214749861976158928731488213134602233624266938936763854067268495057,
                                ),
                            ),
                        ),
                    ),
                },
            ),
        ),
        (
            Sum,
            Scalar(
                Scalar {
                    dtype: Decimal(
                        DecimalDType {
                            precision: 76,
                            scale: 75,
                        },
                        Nullable,
                    ),
                    value: ScalarValue(
                        Decimal(
                            I256(
                                i256(
                                    12644199416214749861976158928731488213134602233624266938936763854067268495057,
                                ),
                            ),
                        ),
                    ),
                },
            ),
        ),
    ],
}

Occurrence Details

• Crash File: crash-8b013380564c231c688f9ea9fbec9d61d30dcd5e
• Branch: develop
• Commit: 9d4fcc7
• Crash Artifact: https://github.com/vortex-data/vortex/actions/runs/20875367804/artifacts/5084450047

Reproduction

cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-8b013380564c231c688f9ea9fbec9d61d30dcd5e -- -rss_limit_mb=0

---

Auto-detected by fuzzing workflow with Claude analysis

[github-actions]

Related Crash Detected

A similar crash was detected in the array_ops target.

Crash Details

Crash Location: fuzz/src/array/mod.rs:721 in assert_scalar_eq function (called from run_fuzz_action at line 600)

Error Message:

Scalar mismatch: expected decimal256(16127820696605077299020311852024276062375147459561382483815817499835753776986, precision=76, scale=75), got null in step 2

Stack Trace:

#0 std::backtrace_rs::backtrace::libunwind::trace
#1 std::backtrace_rs::backtrace::trace_unsynchronized
#2 <std::backtrace::Backtrace>::create
#3 assert_scalar_eq at ./fuzz/src/array/mod.rs:721:13
#4 run_fuzz_action at ./fuzz/src/array/mod.rs:600:17
#5 __libfuzzer_sys_run at ./fuzz/fuzz_targets/array_ops.rs:14:11
#6 rust_fuzzer_test_input

Similarities to Original Issue:

• Same crash location (fuzz/src/array/mod.rs:721 in assert_scalar_eq)
• Same error pattern: sum operation on ChunkedArray with DecimalArray returns null instead of expected decimal value
• Same data types: Decimal(precision=76, scale=75, Nullable) with I256 values
• Same array structure: ChunkedArray with 2 DecimalArray chunks, all values valid (validity: AllValid)
• Both involve multiple Sum operations in sequence

Differences:

• This crash occurs at step 2 (after Mask operation + Sum), original at step 1
• Array length: 12 elements (4 + 8) vs original 7 elements (4 + 3)
• Different expected sum value (but same pattern of null result)
• Includes a Mask operation before the Sum operations

Note: The fact that both crashes happen after multiple operations suggests this may be related to state accumulation or how sum handles already-transformed arrays.

Debug Output

FuzzArrayAction {
    array: ChunkedArray {
        dtype: Decimal(
            DecimalDType {
                precision: 76,
                scale: 75,
            },
            Nullable,
        ),
        len: 12,
        chunk_offsets: PrimitiveArray {
            dtype: Primitive(
                U64,
                NonNullable,
            ),
            buffer: Buffer<u8> {
                length: 24,
                alignment: Alignment(
                    8,
                ),
                as_slice: [0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, ...],
            },
            validity: NonNullable,
            stats_set: ArrayStats {
                inner: RwLock {
                    data: StatsSet {
                        values: [],
                    },
                },
            },
        },
        chunks: [
            DecimalArray {
                dtype: Decimal(
                    DecimalDType {
                        precision: 76,
                        scale: 75,
                    },
                    Nullable,
                ),
                values: Buffer<u8> {
                    length: 128,
                    alignment: Alignment(
                        16,
                    ),
                    as_slice: [3, 0, 0, 0, 0, 0, 0, 0, 0, 144, 236, 228, 101, 118, 200, 187, ...],
                },
                values_type: I256,
                validity: AllValid,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [],
                        },
                    },
                },
            },
            DecimalArray {
                dtype: Decimal(
                    DecimalDType {
                        precision: 76,
                        scale: 75,
                    },
                    Nullable,
                ),
                values: Buffer<u8> {
                    length: 256,
                    alignment: Alignment(
                        16,
                    ),
                    as_slice: [1, 0, 0, 0, 0, 0, 0, 0, 0, 208, 64, 171, 43, 14, 159, 225, ...],
                },
                values_type: I256,
                validity: AllValid,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [],
                        },
                    },
                },
            },
        ],
        stats_set: ArrayStats {
            inner: RwLock {
                data: StatsSet {
                    values: [],
                },
            },
        },
    },
    actions: [
        (
            Mask(
                Values(
                    MaskValues {
                        buffer: BitBuffer {
                            buffer: Buffer<u8> {
                                length: 2,
                                alignment: Alignment(
                                    1,
                                ),
                                as_slice: [240, 15],
                            },
                            offset: 0,
                            len: 12,
                        },
                        indices: OnceLock(
                            <uninit>,
                        ),
                        slices: OnceLock(
                            <uninit>,
                        ),
                        true_count: 8,
                        density: 0.6666666666666666,
                    },
                ),
            ),
            Array(
                DecimalArray {
                    dtype: Decimal(
                        DecimalDType {
                            precision: 76,
                            scale: 75,
                        },
                        Nullable,
                    ),
                    values: Buffer<u8> {
                        length: 384,
                        alignment: Alignment(
                            16,
                        ),
                        as_slice: [3, 0, 0, 0, 0, 0, 0, 0, 0, 144, 236, 228, 101, 118, 200, 187, ...],
                    },
                    values_type: I256,
                    validity: Array(
                        BoolArray {
                            dtype: Bool(
                                NonNullable,
                            ),
                            bits: BitBuffer {
                                buffer: Buffer<u8> {
                                    length: 2,
                                    alignment: Alignment(
                                        1,
                                    ),
                                    as_slice: [15, 240],
                                },
                                offset: 0,
                                len: 12,
                            },
                            validity: NonNullable,
                            stats_set: ArrayStats {
                                inner: RwLock {
                                    data: StatsSet {
                                        values: [
                                            (
                                                Sum,
                                                Exact(
                                                    ScalarValue(
                                                        Primitive(
                                                            U64(
                                                                4,
                                                            ),
                                                        ),
                                                    ),
                                                ),
                                            ),
                                        ],
                                    },
                                },
                            },
                        },
                    ),
                    stats_set: ArrayStats {
                        inner: RwLock {
                            data: StatsSet {
                                values: [],
                            },
                        },
                    },
                },
            ),
        ),
        (
            Sum,
            Scalar(
                Scalar {
                    dtype: Decimal(
                        DecimalDType {
                            precision: 76,
                            scale: 75,
                        },
                        Nullable,
                    ),
                    value: ScalarValue(
                        Decimal(
                            I256(
                                i256(
                                    16127820696605077299020311852024276062375147459561382483815817499835753776986,
                                ),
                            ),
                        ),
                    ),
                },
            ),
        ),
        (
            Sum,
            Scalar(
                Scalar {
                    dtype: Decimal(
                        DecimalDType {
                            precision: 76,
                            scale: 75,
                        },
                        Nullable,
                    ),
                    value: ScalarValue(
                        Decimal(
                            I256(
                                i256(
                                    16127820696605077299020311852024276062375147459561382483815817499835753776986,
                                ),
                            ),
                        ),
                    ),
                },
            ),
        ),
    ],
}

Occurrence Details

• Crash File: crash-432af296336ab0594a5cea72e9ab6b9cb079e7ab
• Branch: develop
• Commit: 2b2ad23fbcb8f696a09a4f82e8e6a9d5e72d89cc
• Crash Artifact: https://github.com/vortex-data/vortex/actions/runs/12732866618/artifacts/2341802639

Reproduction

cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-432af296336ab0594a5cea72e9ab6b9cb079e7ab -- -rss_limit_mb=0

---

Auto-detected by fuzzing workflow with Claude analysis

[connortsui20]

Closing in favor of #5820

[github-actions]

Related Crash Detected - Possible Regression

A similar crash was detected in the array_ops target. This appears to be a regression of this issue, as the crash pattern is nearly identical.

Crash Details

Crash Location: fuzz/fuzz_targets/array_ops.rs:18:13

Error Message:

Scalar mismatch: expected decimal256(10538366268315177759644080670811911435429419019970338296986726131696979592946, precision=76, scale=75), got null in step 1

Stack Trace:

   0: std::backtrace_rs::backtrace::libunwind::trace
   1: std::backtrace_rs::backtrace::trace_unsynchronized
   2: <std::backtrace::Backtrace>::create
   ...
  15: core::panicking::panic_fmt
  16: panic_display<vortex_error::VortexError>
  17: array_ops::_::__libfuzzer_sys_run at fuzz/fuzz_targets/array_ops.rs:18:13

Similarities to Original Issue:

• Same operation: Sum on ChunkedArray with DecimalArray chunks
• Same data type: Decimal(precision=76, scale=75, Nullable) with I256 storage
• Same error pattern: Expected decimal256 value, got null
• Same array structure: ChunkedArray with 2 chunks (4 + 8 elements = 12 total)
• All values have AllValid validity

Differences:

• Different decimal value expected (but same precision/scale)
• Array has 12 elements vs 7 in original
• This crash occurred on 2026-01-17, 2 days after this issue was closed

Note: This strongly suggests a regression - the fix applied for this issue may have been incomplete or was reverted.

Debug Output

FuzzArrayAction {
    array: ChunkedArray {
        dtype: Decimal(
            DecimalDType {
                precision: 76,
                scale: 75,
            },
            Nullable,
        ),
        len: 12,
        chunk_offsets: PrimitiveArray {
            dtype: Primitive(
                U64,
                NonNullable,
            ),
            buffer: BufferHandle(
                Host(
                    Buffer<u8> {
                        length: 24,
                        alignment: Alignment(
                            8,
                        ),
                        as_slice: [0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, ...],
                    },
                ),
            ),
            validity: NonNullable,
        },
        chunks: [
            DecimalArray {
                dtype: Decimal(
                    DecimalDType {
                        precision: 76,
                        scale: 75,
                    },
                    Nullable,
                ),
                values: Buffer<u8> {
                    length: 128,
                    alignment: Alignment(
                        16,
                    ),
                    as_slice: [3, 0, 0, 0, 0, 0, 0, 0, 0, 144, 236, 228, 101, 118, 200, 187, ...],
                },
                values_type: I256,
                validity: AllValid,
            },
            DecimalArray {
                dtype: Decimal(
                    DecimalDType {
                        precision: 76,
                        scale: 75,
                    },
                    Nullable,
                ),
                values: Buffer<u8> {
                    length: 256,
                    alignment: Alignment(
                        16,
                    ),
                    as_slice: [213, 211, 211, 211, 211, 211, 41, 85, 85, 211, 19, 127, 255, 225, 114, 109, ...],
                },
                values_type: I256,
                validity: AllValid,
            },
        ],
    },
    actions: [
        (
            Sum,
            Scalar(expected decimal256 value),
        ),
        (
            Sum,
            Scalar(expected decimal256 value),
        ),
        (
            Sum,
            Scalar(expected decimal256 value),
        ),
    ],
}

Occurrence Details

• Crash File: crash-783207690819c013031d68778dbf3e170af93878
• Branch: develop
• Commit: fa5eeda
• Crash Artifact: Artifact URL not available

Reproduction

cargo +nightly fuzz run -D --sanitizer=none array_ops fuzz/artifacts/array_ops/crash-783207690819c013031d68778dbf3e170af93878 -- -rss_limit_mb=0

---

Auto-detected by fuzzing workflow with Claude analysis