fix(vortex-onpair): remove redundant validate_codes pre-check

OnPair's own decoder already bounds-checks every code in-loop before
copying (a near-free, predicted-never-taken branch); vortex-onpair's
validate_codes was a second full pass over the codes buffer ahead of
decode, doubling memory traffic on a hot path for no additional
soundness (out-of-range codes still surface, as a panic instead of a
VortexResult error, matching the behavior prior to the onpair 0.1.0 port).

Signed-off-by: Francesco Gargiulo <gargiulo.fr@gmail.com>

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: gargiulofrancesco

encodings/experimental/onpair/src/canonical.rs

@@ -31,7 +31,6 @@ use crate::OnPair;
 use crate::OnPairArraySlotsExt;
 use crate::decode::code_boundary_at;
 use crate::decode::collect_widened;
-use crate::decode::validate_codes;
 
 pub(super) fn canonicalize_onpair(
     array: ArrayView<'_, OnPair>,
@@ -92,9 +91,6 @@ pub(crate) fn onpair_decode_views(
     // boundaries, so an empty boundary slice is sound.
     let codes = collect_widened::<u16>(&array.codes().slice(code_start..code_end)?, ctx)?;
     let dict_offsets = collect_widened::<u32>(array.dict_offsets(), ctx)?;
-    // The codes child is file-borne: reject out-of-range codes here so the
-    // decoder's panicking bounds check never fires on corrupt data.
-    validate_codes(codes.as_slice(), dict_offsets.len().saturating_sub(1))?;
     let dict =
         CompactDictionaryView::validate(array.dict_bytes().as_slice(), dict_offsets.as_slice())
             .map_err(|e| vortex_err!(InvalidArgument: "Invalid OnPair dictionary: {e}"))?;

encodings/experimental/onpair/src/decode.rs

@@ -47,23 +47,6 @@ pub(crate) fn code_boundary_at(
         .ok_or_else(|| vortex_err!("OnPair codes_offsets[{index}] is null"))
 }
 
-/// Ensure every code indexes the dictionary (`code < num_tokens`).
-///
-/// The slot children are file-borne, so a malformed `codes` child is a
-/// recoverable error, not a bug: checking up front keeps the upstream
-/// decoder/search primitives — which back their bounds checks with panics —
-/// off file-borne data they would panic on.
-pub(crate) fn validate_codes(codes: &[u16], num_tokens: usize) -> VortexResult<()> {
-    // `fold(max)` instead of `Iterator::max`: the latter's last-max-wins
-    // semantics defeat autovectorization, turning this scan scalar.
-    let max = codes.iter().fold(0u16, |acc, &c| acc.max(c));
-    vortex_ensure!(
-        codes.is_empty() || (max as usize) < num_tokens,
-        "OnPair code {max} out of range for dictionary of {num_tokens} tokens"
-    );
-    Ok(())
-}
-
 /// A validated, materialised window over an array's `codes`: the widened
 /// per-row `codes_offsets` boundaries plus the codes they bound.
 ///
@@ -88,9 +71,10 @@ impl CodesWindow {
     }
 }
 
-/// Materialise and validate the [`CodesWindow`] for every row of `array`:
-/// offsets must be nondecreasing and end within the `codes` child, and every
-/// code must index the dictionary (see [`validate_codes`]).
+/// Materialise the [`CodesWindow`] for every row of `array`: offsets must be
+/// nondecreasing and end within the `codes` child. Codes themselves are
+/// trusted to the upstream decoder/search primitives, which bounds-check them
+/// in-loop and panic on a malformed value.
 pub(crate) fn collect_codes_window(
     array: ArrayView<'_, OnPair>,
     ctx: &mut ExecutionCtx,
@@ -116,10 +100,6 @@ pub(crate) fn collect_codes_window(
         array.codes().len()
     );
     let codes = collect_widened::<u16>(&array.codes().slice(code_start..code_end)?, ctx)?;
-    validate_codes(
-        codes.as_slice(),
-        array.dict_offsets().len().saturating_sub(1),
-    )?;
     Ok(CodesWindow {
         offsets,
         codes,

encodings/experimental/onpair/src/ops.rs

@@ -16,7 +16,6 @@ use crate::OnPair;
 use crate::OnPairArraySlotsExt;
 use crate::decode::code_boundary_at;
 use crate::decode::collect_widened;
-use crate::decode::validate_codes;
 
 impl OperationsVTable<OnPair> for OnPair {
     fn scalar_at(
@@ -35,9 +34,6 @@ impl OperationsVTable<OnPair> for OnPair {
 
         let codes = collect_widened::<u16>(&array.codes().slice(row_start..row_end)?, ctx)?;
         let dict_offsets = collect_widened::<u32>(array.dict_offsets(), ctx)?;
-        // The codes child is file-borne: reject out-of-range codes here so the
-        // decoder's panicking bounds check never fires on corrupt data.
-        validate_codes(codes.as_slice(), dict_offsets.len().saturating_sub(1))?;
         let dict =
             CompactDictionaryView::validate(array.dict_bytes().as_slice(), dict_offsets.as_slice())
                 .map_err(|e| vortex_err!(InvalidArgument: "Invalid OnPair dictionary: {e}"))?;