Skip to content

Fuzzing Crash: VortexError in array_ops #6515

@github-actions

Description

@github-actions

Fuzzing Crash Report

Analysis

Crash Location: fuzz/fuzz_targets/array_ops.rs:18:assert_array_eq

Error Message:

{: {//iiii: 42662u16, : 42662u16}, : null} != {: {//iiii: 42662u16, : 42662u16}, : {: 42662u16, : 42662u16}} at index 5, lhs is root: vortex.struct({={//iiii=u16, =u16}, ={=u16, =u16?}?}?, len=6) nbytes=343 B (100.00%)
  metadata: EmptyMetadata
  validity: vortex.bool(bool, len=6) nbytes=1 B (0.29%) [nulls=0, min=false, max=true]
    metadata: BoolMetadata { offset: 0 }
    buffer: bits host 1 B (align=1) (100.00%)
  : vortex.chunked({//iiii=u16, =u16}, len=6) nbytes=192 B (55.98%)
    metadata: EmptyMetadata
    chunk_offsets: vortex.primitive(u64, len=3) nbytes=24 B (100.00%)
      metadata: EmptyMetadata
      buffer: values host 24 B (align=8) (100.00%)
    chunks[0]: vortex.chunked({//iiii=u16, =u16}, len=5) nbytes=140 B (100.00%)
      metadata: EmptyMetadata
      chunk_offsets: vortex.primitive(u64, len=3) nbytes=24 B (100.00%)
        metadata: EmptyMetadata
        buffer: values host 24 B (align=8) (100.00%)
      chunks[0]: vortex.struct({//iiii=u16, =u16}, len=0) nbytes=48 B (100.00%)
        metadata: EmptyMetadata
        //iiii: vortex.chunked(u16, len=0) nbytes=24 B (50.00%)
          metadata: EmptyMetadata
          chunk_offsets: vortex.primitive(u64, len=3) nbytes=24 B (100.00%)
            metadata: EmptyMetadata
            buffer: values host 24 B (align=8) (100.00%)
          chunks[0]: vortex.primitive(u16, len=0) nbytes=0 B (0.00%)
            metadata: EmptyMetadata
            buffer: values host 0 B (align=2) (0.00%)
          chunks[1]: vortex.primitive(u16, len=0) nbytes=0 B (0.00%)
            metadata: EmptyMetadata
            buffer: values host 0 B (align=2) (0.00%)
        : vortex.chunked(u16, len=0) nbytes=24 B (50.00%)
          metadata: EmptyMetadata
          chunk_offsets: vortex.primitive(u64, len=3) nbytes=24 B (100.00%)
            metadata: EmptyMetadata
            buffer: values host 24 B (align=8) (100.00%)
          chunks[0]: vortex.primitive(u16, len=0) nbytes=0 B (0.00%)
            metadata: EmptyMetadata
            buffer: values host 0 B (align=2) (0.00%)
          chunks[1]: vortex.primitive(u16, len=0) nbytes=0 B (0.00%)
            metadata: EmptyMetadata
            buffer: values host 0 B (align=2) (0.00%)
      chunks[1]: vortex.struct({//iiii=u16, =u16}, len=5) nbytes=68 B (100.00%)
        metadata: EmptyMetadata
        //iiii: vortex.chunked(u16, len=5) nbytes=34 B (50.00%)
          metadata: EmptyMetadata
          chunk_offsets: vortex.primitive(u64, len=3) nbytes=24 B (100.00%)
            metadata: EmptyMetadata
            buffer: values host 24 B (align=8) (100.00%)
          chunks[0]: vortex.primitive(u16, len=5) nbytes=10 B (100.00%)
            metadata: EmptyMetadata
            buffer: values host 10 B (align=2) (100.00%)
          chunks[1]: vortex.primitive(u16, len=0) nbytes=0 B (0.00%)
            metadata: EmptyMetadata
            buffer: values host 0 B (align=2) (0.00%)
        : vortex.chunked(u16, len=5) nbytes=34 B (50.00%)
          metadata: EmptyMetadata
          chunk_offsets: vortex.primitive(u64, len=3) nbytes=24 B (100.00%)
            metadata: EmptyMetadata
            buffer: values host 24 B (align=8) (100.00%)
          chunks[0]: vortex.primitive(u16, len=2) nbytes=4 B (100.00%)
            metadata: EmptyMetadata
            buffer: values host 4 B (align=2) (100.00%)
          chunks[1]: vortex.primitive(u16, len=3) nbytes=6 B (100.00%)
            metadata: EmptyMetadata
            buffer: values host 6 B (align=2) (100.00%)
    chunks[1]: vortex.struct({//iiii=u16, =u16}, len=1) nbytes=28 B (100.00%)
      metadata: EmptyMetadata
      //iiii: vortex.primitive(u16, len=1) nbytes=2 B (7.14%)
        metadata: EmptyMetadata
        buffer: values host 2 B (align=2) (100.00%)
      : vortex.chunked(u16, len=1) nbytes=26 B (92.86%)
        metadata: EmptyMetadata
        chunk_offsets: vortex.primitive(u64, len=3) nbytes=24 B (100.00%)
          metadata: EmptyMetadata
          buffer: values host 24 B (align=8) (100.00%)
        chunks[0]: vortex.primitive(u16, len=0) nbytes=0 B (0.00%)
          metadata: EmptyMetadata
          buffer: values host 0 B (align=2) (0.00%)
        chunks[1]: vortex.primitive(u16, len=1) nbytes=2 B (100.00%)
          metadata: EmptyMetadata
          buffer: values host 2 B (align=2) (100.00%)
  : vortex.chunked({=u16, =u16?}?, len=6) nbytes=150 B (43.73%)
    metadata: EmptyMetadata
    chunk_offsets: vortex.primitive(u64, len=3) nbytes=24 B (100.00%)
      metadata: EmptyMetadata
      buffer: values host 24 B (align=8) (100.00%)
    chunks[0]: vortex.struct({=u16, =u16?}?, len=5) nbytes=20 B (100.00%) [all_valid]
      metadata: EmptyMetadata
      : vortex.primitive(u16, len=5) nbytes=10 B (50.00%)
        metadata: EmptyMetadata
        buffer: values host 10 B (align=2) (100.00%)
      : vortex.primitive(u16?, len=5) nbytes=10 B (50.00%) [all_valid]
        metadata: EmptyMetadata
        buffer: values host 10 B (align=2) (100.00%)
    chunks[1]: vortex.chunked({=u16, =u16?}?, len=1) nbytes=106 B (100.00%) [all_invalid]
      metadata: EmptyMetadata
      chunk_offsets: vortex.primitive(u64, len=3) nbytes=24 B (100.00%)
        metadata: EmptyMetadata
        buffer: values host 24 B (align=8) (100.00%)
      chunks[0]: vortex.struct({=u16, =u16?}?, len=0) nbytes=48 B (100.00%) [all_valid]
        metadata: EmptyMetadata
        : vortex.chunked(u16, len=0) nbytes=24 B (50.00%)
          metadata: EmptyMetadata
          chunk_offsets: vortex.primitive(u64, len=3) nbytes=24 B (100.00%)
            metadata: EmptyMetadata
            buffer: values host 24 B (align=8) (100.00%)
          chunks[0]: vortex.primitive(u16, len=0) nbytes=0 B (0.00%)
            metadata: EmptyMetadata
            buffer: values host 0 B (align=2) (0.00%)
          chunks[1]: vortex.primitive(u16, len=0) nbytes=0 B (0.00%)
            metadata: EmptyMetadata
            buffer: values host 0 B (align=2) (0.00%)
        : vortex.chunked(u16?, len=0) nbytes=24 B (50.00%) [all_valid]
          metadata: EmptyMetadata
          chunk_offsets: vortex.primitive(u64, len=3) nbytes=24 B (100.00%)
            metadata: EmptyMetadata
            buffer: values host 24 B (align=8) (100.00%)
          chunks[0]: vortex.primitive(u16?, len=0) nbytes=0 B (0.00%) [all_valid]
            metadata: EmptyMetadata
            buffer: values host 0 B (align=2) (0.00%)
          chunks[1]: vortex.primitive(u16?, len=0) nbytes=0 B (0.00%) [all_valid]
            metadata: EmptyMetadata
            buffer: values host 0 B (align=2) (0.00%)
      chunks[1]: vortex.struct({=u16, =u16?}?, len=1) nbytes=34 B (100.00%) [all_invalid]
        metadata: EmptyMetadata
        validity: vortex.constant(bool, len=1) nbytes=2 B (5.88%)
          metadata: EmptyMetadata
          buffer: scalar host 2 B (align=1) (100.00%)
        : vortex.primitive(u16, len=1) nbytes=2 B (5.88%)
          metadata: EmptyMetadata
          buffer: values host 2 B (align=2) (100.00%)
        : vortex.chunked(u16?, len=1) nbytes=30 B (88.24%) [all_invalid]
          metadata: EmptyMetadata
          chunk_offsets: vortex.primitive(u64, len=3) nbytes=24 B (100.00%)
            metadata: EmptyMetadata
            buffer: values host 24 B (align=8) (100.00%)
          chunks[0]: vortex.primitive(u16?, len=0) nbytes=2 B (100.00%) [all_invalid]
            metadata: EmptyMetadata
            buffer: values host 0 B (align=2) (0.00%)
            validity: vortex.constant(bool, len=0) nbytes=2 B (100.00%)
              metadata: EmptyMetadata
              buffer: scalar host 2 B (align=1) (100.00%)
          chunks[1]: vortex.primitive(u16?, len=1) nbytes=4 B (100.00%) [all_invalid]
            metadata: EmptyMetadata
            buffer: values host 2 B (align=2) (50.00%)
            validity: vortex.constant(bool, len=1) nbytes=2 B (50.00%)
              metadata: EmptyMetadata
              buffer: scalar host 2 B (align=1) (100.00%)
 rhs is root: vortex.chunked({={//iiii=u16, =u16}, ={=u16, =u16?}?}?, len=6) nbytes=265 B (100.00%)
  metadata: EmptyMetadata
  chunk_offsets: vortex.primitive(u64, len=3) nbytes=24 B (100.00%)
    metadata: EmptyMetadata
    buffer: values host 24 B (align=8) (100.00%)
  chunks[0]: vortex.mask({={//iiii=u16, =u16}, ={=u16, =u16?}?}?, len=5) nbytes=161 B (100.00%)
    metadata: 
    input: vortex.struct({={//iiii=u16, =u16}, ={=u16, =u16?}?}, len=5) nbytes=160 B (99.38%)
      metadata: EmptyMetadata
      : vortex.chunked({//iiii=u16, =u16}, len=5) nbytes=140 B (87.50%)
        metadata: EmptyMetadata
        chunk_offsets: vortex.primitive(u64, len=3) nbytes=24 B (100.00%)
          metadata: EmptyMetadata
          buffer: values host 24 B (align=8) (100.00%)
        chunks[0]: vortex.struct({//iiii=u16, =u16}, len=0) nbytes=48 B (100.00%)
          metadata: EmptyMetadata
          //iiii: vortex.chunked(u16, len=0) nbytes=24 B (50.00%)
            metadata: EmptyMetadata
            chunk_offsets: vortex.primitive(u64, len=3) nbytes=24 B (100.00%)
              metadata: EmptyMetadata
              buffer: values host 24 B (align=8) (100.00%)
            chunks[0]: vortex.primitive(u16, len=0) nbytes=0 B (0.00%)
              metadata: EmptyMetadata
              buffer: values host 0 B (align=2) (0.00%)
            chunks[1]: vortex.primitive(u16, len=0) nbytes=0 B (0.00%)
              metadata: EmptyMetadata
              buffer: values host 0 B (align=2) (0.00%)
          : vortex.chunked(u16, len=0) nbytes=24 B (50.00%)
            metadata: EmptyMetadata
            chunk_offsets: vortex.primitive(u64, len=3) nbytes=24 B (100.00%)
              metadata: EmptyMetadata
              buffer: values host 24 B (align=8) (100.00%)
            chunks[0]: vortex.primitive(u16, len=0) nbytes=0 B (0.00%)
              metadata: EmptyMetadata
              buffer: values host 0 B (align=2) (0.00%)
            chunks[1]: vortex.primitive(u16, len=0) nbytes=0 B (0.00%)
              metadata: EmptyMetadata
              buffer: values host 0 B (align=2) (0.00%)
        chunks[1]: vortex.struct({//iiii=u16, =u16}, len=5) nbytes=68 B (100.00%)
          metadata: EmptyMetadata
          //iiii: vortex.chunked(u16, len=5) nbytes=34 B (50.00%)
            metadata: EmptyMetadata
            chunk_offsets: vortex.primitive(u64, len=3) nbytes=24 B (100.00%)
              metadata: EmptyMetadata
              buffer: values host 24 B (align=8) (100.00%)
            chunks[0]: vortex.primitive(u16, len=5) nbytes=10 B (100.00%)
              metadata: EmptyMetadata
              buffer: values host 10 B (align=2) (100.00%)
            chunks[1]: vortex.primitive(u16, len=0) nbytes=0 B (0.00%)
              metadata: EmptyMetadata
              buffer: values host 0 B (align=2) (0.00%)
          : vortex.chunked(u16, len=5) nbytes=34 B (50.00%)
            metadata: EmptyMetadata
            chunk_offsets: vortex.primitive(u64, len=3) nbytes=24 B (100.00%)
              metadata: EmptyMetadata
              buffer: values host 24 B (align=8) (100.00%)
            chunks[0]: vortex.primitive(u16, len=2) nbytes=4 B (100.00%)
              metadata: EmptyMetadata
              buffer: values host 4 B (align=2) (100.00%)
            chunks[1]: vortex.primitive(u16, len=3) nbytes=6 B (100.00%)
              metadata: EmptyMetadata
              buffer: values host 6 B (align=2) (100.00%)
      : vortex.struct({=u16, =u16?}?, len=5) nbytes=20 B (12.50%) [all_valid]
        metadata: EmptyMetadata
        : vortex.primitive(u16, len=5) nbytes=10 B (50.00%)
          metadata: EmptyMetadata
          buffer: values host 10 B (align=2) (100.00%)
        : vortex.primitive(u16?, len=5) nbytes=10 B (50.00%) [all_valid]
          metadata: EmptyMetadata
          buffer: values host 10 B (align=2) (100.00%)
    mask: vortex.bool(bool, len=5) nbytes=1 B (0.62%)
      metadata: BoolMetadata { offset: 0 }
      buffer: bits host 1 B (align=1) (100.00%)
  chunks[1]: vortex.struct({={//iiii=u16, =u16}, ={=u16, =u16?}?}?, len=1) nbytes=80 B (100.00%) [all_valid]
    metadata: EmptyMetadata
    : vortex.struct({//iiii=u16, =u16}, len=1) nbytes=28 B (35.00%)
      metadata: EmptyMetadata
      //iiii: vortex.primitive(u16, len=1) nbytes=2 B (7.14%)
        metadata: EmptyMetadata
        buffer: values host 2 B (align=2) (100.00%)
      : vortex.chunked(u16, len=1) nbytes=26 B (92.86%)
        metadata: EmptyMetadata
        chunk_offsets: vortex.primitive(u64, len=3) nbytes=24 B (100.00%)
          metadata: EmptyMetadata
          buffer: values host 24 B (align=8) (100.00%)
        chunks[0]: vortex.primitive(u16, len=0) nbytes=0 B (0.00%)
          metadata: EmptyMetadata
          buffer: values host 0 B (align=2) (0.00%)
        chunks[1]: vortex.primitive(u16, len=1) nbytes=2 B (100.00%)
          metadata: EmptyMetadata
          buffer: values host 2 B (align=2) (100.00%)
    : vortex.struct({=u16, =u16?}?, len=1) nbytes=52 B (65.00%) [all_valid]
      metadata: EmptyMetadata
      : vortex.chunked(u16, len=1) nbytes=26 B (50.00%)
        metadata: EmptyMetadata
        chunk_offsets: vortex.primitive(u64, len=3) nbytes=24 B (100.00%)
          metadata: EmptyMetadata
          buffer: values host 24 B (align=8) (100.00%)
        chunks[0]: vortex.primitive(u16, len=0) nbytes=0 B (0.00%)
          metadata: EmptyMetadata
          buffer: values host 0 B (align=2) (0.00%)
        chunks[1]: vortex.primitive(u16, len=1) nbytes=2 B (100.00%)
          metadata: EmptyMetadata
          buffer: values host 2 B (align=2) (100.00%)
      : vortex.chunked(u16?, len=1) nbytes=26 B (50.00%) [all_valid]
        metadata: EmptyMetadata
        chunk_offsets: vortex.primitive(u64, len=3) nbytes=24 B (100.00%)
          metadata: EmptyMetadata
          buffer: values host 24 B (align=8) (100.00%)
        chunks[0]: vortex.cast(u16?, len=0) nbytes=0 B (0.00%)
          metadata: u16?
          input: vortex.primitive(u16, len=0) nbytes=0 B (0.00%)
            metadata: EmptyMetadata
            buffer: values host 0 B (align=2) (0.00%)
        chunks[1]: vortex.cast(u16?, len=1) nbytes=2 B (100.00%) [all_valid]
          metadata: u16?
          input: vortex.primitive(u16, len=1) nbytes=2 B (100.00%)
            metadata: EmptyMetadata
            buffer: values host 2 B (align=2) (100.00%)
 in step 0
Stack Trace
stack backtrace:
   0: __rustc::rust_begin_unwind
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/std/src/panicking.rs:689:5
   1: core::panicking::panic_fmt
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/core/src/panicking.rs:80:14
   2: panic_display<vortex_error::VortexError>
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/core/src/panicking.rs:259:5
   3: __libfuzzer_sys_run
             at ./fuzz/fuzz_targets/array_ops.rs:18:13
   4: rust_fuzzer_test_input
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/src/lib.rs:363:60
   5: {closure#0}
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/src/lib.rs:62:9
   6: do_call<libfuzzer_sys::test_input_wrap::{closure_env#0}, i32>
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/std/src/panicking.rs:581:40
   7: __rust_try
   8: catch_unwind<i32, libfuzzer_sys::test_input_wrap::{closure_env#0}>
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/std/src/panicking.rs:544:19
   9: catch_unwind<libfuzzer_sys::test_input_wrap::{closure_env#0}, i32>
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/std/src/panic.rs:359:14
  10: test_input_wrap
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/src/lib.rs:60:22
  11: _ZN6fuzzer6Fuzzer15ExecuteCallbackEPKhm
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerLoop.cpp:619:13
  12: _ZN6fuzzer6Fuzzer6RunOneEPKhmbPNS_9InputInfoEbPb
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerLoop.cpp:516:7
  13: _ZN6fuzzer6Fuzzer16MutateAndTestOneEv
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerLoop.cpp:765:19
  14: _ZN6fuzzer6Fuzzer4LoopERSt6vectorINS_9SizedFileESaIS2_EE
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerLoop.cpp:910:5
  15: _ZN6fuzzer12FuzzerDriverEPiPPPcPFiPKhmE
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerDriver.cpp:923:6
  16: main
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.10/libfuzzer/FuzzerMain.cpp:20:10
  17: <unknown>
  18: __libc_start_main
  19: _start

Summary

Reproduction

  1. Download the crash artifact:

  2. Reproduce locally:

cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-296677eb48a2e431d70c8794080bf3af89cd988e -- -rss_limit_mb=0
  1. Get full backtrace:
RUST_BACKTRACE=full cargo +nightly fuzz run -D --sanitizer=none array_ops array_ops/crash-296677eb48a2e431d70c8794080bf3af89cd988e -- -rss_limit_mb=0

Auto-created by fuzzing workflow

Metadata

Metadata

Assignees

Labels

bugA bug issuefuzzerIssues detected by the fuzzer

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions