Fuzzing Crash: AssertionFailed in file_io

[github-actions]

Fuzzing Crash Report

Analysis

Crash Location: fuzz/fuzz_targets/file_io.rs:95:__libfuzzer_sys_run

Error Message:

assertion `left == right` failed: Length was not preserved expected 73 actual 74.
  left: 73
 right: 74

Stack Trace

stack backtrace:
   0: __rustc::rust_begin_unwind
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/std/src/panicking.rs:689:5
   1: core::panicking::panic_fmt
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/core/src/panicking.rs:80:14
   2: core::panicking::assert_failed_inner
   3: core::panicking::assert_failed::<usize, usize>
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/core/src/panicking.rs:394:5
   4: __libfuzzer_sys_run
             at ./fuzz/fuzz_targets/file_io.rs:95:5
   5: rust_fuzzer_test_input
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/src/lib.rs:363:60
   6: {closure#0}
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/src/lib.rs:62:9
   7: do_call<libfuzzer_sys::test_input_wrap::{closure_env#0}, i32>
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/std/src/panicking.rs:581:40
   8: __rust_try
   9: catch_unwind<i32, libfuzzer_sys::test_input_wrap::{closure_env#0}>
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/std/src/panicking.rs:544:19
  10: catch_unwind<libfuzzer_sys::test_input_wrap::{closure_env#0}, i32>
             at /rustc/db3e99bbab28c6ca778b13222becdea54533d908/library/std/src/panic.rs:359:14
  11: test_input_wrap
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/src/lib.rs:60:22
  12: _ZN6fuzzer6Fuzzer15ExecuteCallbackEPKhm
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerLoop.cpp:619:13
  13: _ZN6fuzzer6Fuzzer6RunOneEPKhmbPNS_9InputInfoEbPb
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerLoop.cpp:516:7
  14: _ZN6fuzzer6Fuzzer25ReadAndExecuteSeedCorporaERSt6vectorINS_9SizedFileESaIS2_EE
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerLoop.cpp:834:7
  15: _ZN6fuzzer6Fuzzer4LoopERSt6vectorINS_9SizedFileESaIS2_EE
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerLoop.cpp:872:3
  16: _ZN6fuzzer12FuzzerDriverEPiPPPcPFiPKhmE
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerDriver.cpp:923:6
  17: main
             at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/libfuzzer-sys-0.4.12/libfuzzer/FuzzerMain.cpp:20:10
  18: <unknown>
  19: __libc_start_main
  20: _start

Root Cause Analysis

The crash is an assertion failure in the file_io fuzz target (file_io.rs:95) where the array length after a write-read roundtrip does not match the original: expected 73 rows but got 74. The input is a ChunkedArray of Structs with nested ChunkedArray fields, nullable F32 columns, and a filter expression (gte on an F32 field) combined with a projection selecting a single field — this combination likely causes an off-by-one error in row count computation during filtered reads, where the filter predicate boundary interacts incorrectly with chunk boundaries in the nested struct layout. The fix should investigate how filtered scan results are accumulated across chunks in the layout reader, particularly when a filter pushdown crosses chunk boundaries in a chunked/nested struct array, as the extra row suggests an inclusive-vs-exclusive boundary bug in the chunk-level row range computation.

Summary

• Target: file_io
• Crash File: crash-176043a5dfdc3857e16c8a9852f0aae79cd43f77
• Branch: ct/fuzzer-report-template
• Commit: 09dfb09
• Crash Artifact: https://github.com/vortex-data/vortex/actions/runs/22959766498/artifacts/5873557056

Reproduction

1. Download the crash artifact:

   • Direct download: https://github.com/vortex-data/vortex/actions/runs/22959766498/artifacts/5873557056
   • Extract the zip file (unzip)
     • The path should look like /path/to/file_io/crash-176043a5dfdc3857e16c8a9852f0aae79cd43f77
     • You can create a ./fuzz/artifacts directory that will be git-ignored in the vortex repo
     • Full path would be ./fuzz/artifacts/file_io/crash-176043a5dfdc3857e16c8a9852f0aae79cd43f77

2. Reproduce locally:

cargo +nightly fuzz run -D --sanitizer=none file_io /path/to/crash_file -- -rss_limit_mb=0

3. Get a backtrace:

RUST_BACKTRACE=1 cargo +nightly fuzz run -D --sanitizer=none file_io /path/to/crash_file -- -rss_limit_mb=0

RUST_BACKTRACE=full cargo +nightly fuzz run -D --sanitizer=none file_io /path/to/crash_file -- -rss_limit_mb=0

Workflow Example

Assuming you download the zipfile to ~/Downloads, and your working directory is the repository
root, you can follow these steps:

# Create the artifacts directory if you haven't already.
mkdir -p ./fuzz/artifacts

# Move the zipfile.
mv ~/Downloads/file_io-crash-artifacts.zip ./fuzz/artifacts/

# Unzip the zipfile.
unzip ./fuzz/artifacts/file_io-crash-artifacts.zip -d ./fuzz/artifacts/

# You can remove the zipfile now if you want to.
rm ./fuzz/artifacts/file_io-crash-artifacts.zip

You can now reproduce with:

cargo +nightly fuzz run -D --sanitizer=none file_io ./fuzz/artifacts/file_io/crash-176043a5dfdc3857e16c8a9852f0aae79cd43f77 -- -rss_limit_mb=0

If you want a backtrace:

RUST_BACKTRACE=1 cargo +nightly fuzz run -D --sanitizer=none file_io ./fuzz/artifacts/file_io/crash-176043a5dfdc3857e16c8a9852f0aae79cd43f77 -- -rss_limit_mb=0

RUST_BACKTRACE=full cargo +nightly fuzz run -D --sanitizer=none file_io ./fuzz/artifacts/file_io/crash-176043a5dfdc3857e16c8a9852f0aae79cd43f77 -- -rss_limit_mb=0

---

Auto-created by fuzzing workflow

[github-actions]

Debug Output

FuzzFileAction {
    array: ChunkedArray {
        dtype: Struct(
            StructFields {
                names: FieldNames(
                    [
                        FieldName(
                            "La",
                        ),
                        FieldName(
                            "",
                        ),
                    ],
                ),
                dtypes: [
                    FieldDType {
                        inner: Owned(
                            Struct(
                                StructFields {
                                    names: FieldNames(
                                        [],
                                    ),
                                    dtypes: [],
                                },
                                NonNullable,
                            ),
                        ),
                    },
                    FieldDType {
                        inner: Owned(
                            Primitive(
                                F32,
                                Nullable,
                            ),
                        ),
                    },
                ],
            },
            NonNullable,
        ),
        len: 321,
        chunk_offsets: PrimitiveArray {
            dtype: Primitive(
                U64,
                NonNullable,
            ),
            buffer: BufferHandle(
                Host(
                    Buffer<u8> {
                        length: 32,
                        alignment: Alignment(
                            8,
                        ),
                        as_slice: [0, 0, 0, 0, 0, 0, 0, 0, 150, 0, 0, 0, 0, 0, 0, 0, ...],
                    },
                ),
            ),
            validity: NonNullable,
            stats_set: ArrayStats {
                inner: RwLock {
                    data: StatsSet {
                        values: [],
                    },
                },
            },
        },
        chunks: [
            StructArray {
                len: 150,
                dtype: Struct(
                    StructFields {
                        names: FieldNames(
                            [
                                FieldName(
                                    "La",
                                ),
                                FieldName(
                                    "",
                                ),
                            ],
                        ),
                        dtypes: [
                            FieldDType {
                                inner: Owned(
                                    Struct(
                                        StructFields {
                                            names: FieldNames(
                                                [],
                                            ),
                                            dtypes: [],
                                        },
                                        NonNullable,
                                    ),
                                ),
                            },
                            FieldDType {
                                inner: Owned(
                                    Primitive(
                                        F32,
                                        Nullable,
                                    ),
                                ),
                            },
                        ],
                    },
                    NonNullable,
                ),
                fields: [
                    ChunkedArray {
                        dtype: Struct(
                            StructFields {
                                names: FieldNames(
                                    [],
                                ),
                                dtypes: [],
                            },
                            NonNullable,
                        ),
                        len: 150,
                        chunk_offsets: PrimitiveArray {
                            dtype: Primitive(
                                U64,
                                NonNullable,
                            ),
                            buffer: BufferHandle(
                                Host(
                                    Buffer<u8> {
                                        length: 24,
                                        alignment: Alignment(
                                            8,
                                        ),
                                        as_slice: [0, 0, 0, 0, 0, 0, 0, 0, 97, 0, 0, 0, 0, 0, 0, 0, ...],
                                    },
                                ),
                            ),
                            validity: NonNullable,
                            stats_set: ArrayStats {
                                inner: RwLock {
                                    data: StatsSet {
                                        values: [],
                                    },
                                },
                            },
                        },
                        chunks: [
                            StructArray {
                                len: 97,
                                dtype: Struct(
                                    StructFields {
                                        names: FieldNames(
                                            [],
                                        ),
                                        dtypes: [],
                                    },
                                    NonNullable,
                                ),
                                fields: [],
                                validity: NonNullable,
                                stats_set: ArrayStats {
                                    inner: RwLock {
                                        data: StatsSet {
                                            values: [],
                                        },
                                    },
                                },
                            },
                            StructArray {
                                len: 53,
                                dtype: Struct(
                                    StructFields {
                                        names: FieldNames(
                                            [],
                                        ),
                                        dtypes: [],
                                    },
                                    NonNullable,
                                ),
                                fields: [],
                                validity: NonNullable,
                                stats_set: ArrayStats {
                                    inner: RwLock {
                                        data: StatsSet {
                                            values: [],
                                        },
                                    },
                                },
                            },
                        ],
                        stats_set: ArrayStats {
                            inner: RwLock {
                                data: StatsSet {
                                    values: [],
                                },
                            },
                        },
                    },
                    PrimitiveArray {
                        dtype: Primitive(
                            F32,
                            Nullable,
                        ),
                        buffer: BufferHandle(
                            Host(
                                Buffer<u8> {
                                    length: 600,
                                    alignment: Alignment(
                                        4,
                                    ),
                                    as_slice: [255, 255, 255, 255, 255, 255, 194, 42, 0, 8, 207, 151, 194, 255, 205, 76, ...],
                                },
                            ),
                        ),
                        validity: AllInvalid,
                        stats_set: ArrayStats {
                            inner: RwLock {
                                data: StatsSet {
                                    values: [],
                                },
                            },
                        },
                    },
                ],
                validity: NonNullable,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [],
                        },
                    },
                },
            },
            StructArray {
                len: 49,
                dtype: Struct(
                    StructFields {
                        names: FieldNames(
                            [
                                FieldName(
                                    "La",
                                ),
                                FieldName(
                                    "",
                                ),
                            ],
                        ),
                        dtypes: [
                            FieldDType {
                                inner: Owned(
                                    Struct(
                                        StructFields {
                                            names: FieldNames(
                                                [],
                                            ),
                                            dtypes: [],
                                        },
                                        NonNullable,
                                    ),
                                ),
                            },
                            FieldDType {
                                inner: Owned(
                                    Primitive(
                                        F32,
                                        Nullable,
                                    ),
                                ),
                            },
                        ],
                    },
                    NonNullable,
                ),
                fields: [
                    StructArray {
                        len: 49,
                        dtype: Struct(
                            StructFields {
                                names: FieldNames(
                                    [],
                                ),
                                dtypes: [],
                            },
                            NonNullable,
                        ),
                        fields: [],
                        validity: NonNullable,
                        stats_set: ArrayStats {
                            inner: RwLock {
                                data: StatsSet {
                                    values: [],
                                },
                            },
                        },
                    },
                    ChunkedArray {
                        dtype: Primitive(
                            F32,
                            Nullable,
                        ),
                        len: 49,
                        chunk_offsets: PrimitiveArray {
                            dtype: Primitive(
                                U64,
                                NonNullable,
                            ),
                            buffer: BufferHandle(
                                Host(
                                    Buffer<u8> {
                                        length: 24,
                                        alignment: Alignment(
                                            8,
                                        ),
                                        as_slice: [0, 0, 0, 0, 0, 0, 0, 0, 24, 0, 0, 0, 0, 0, 0, 0, ...],
                                    },
                                ),
                            ),
                            validity: NonNullable,
                            stats_set: ArrayStats {
                                inner: RwLock {
                                    data: StatsSet {
                                        values: [],
                                    },
                                },
                            },
                        },
                        chunks: [
                            PrimitiveArray {
                                dtype: Primitive(
                                    F32,
                                    Nullable,
                                ),
                                buffer: BufferHandle(
                                    Host(
                                        Buffer<u8> {
                                            length: 96,
                                            alignment: Alignment(
                                                4,
                                            ),
                                            as_slice: [49, 49, 49, 50, 108, 97, 110, 101, 115, 46, 102, 111, 114, 205, 205, 79, ...],
                                        },
                                    ),
                                ),
                                validity: SomeValid([false, false, true, false, false, true, true, true, false, true, true, false, true, false, false, true]),
                                stats_set: ArrayStats {
                                    inner: RwLock {
                                        data: StatsSet {
                                            values: [],
                                        },
                                    },
                                },
                            },
                            PrimitiveArray {
                                dtype: Primitive(
                                    F32,
                                    Nullable,
                                ),
                                buffer: BufferHandle(
                                    Host(
                                        Buffer<u8> {
                                            length: 100,
                                            alignment: Alignment(
                                                4,
                                            ),
                                            as_slice: [59, 48, 205, 57, 243, 243, 243, 243, 243, 243, 243, 243, 243, 243, 243, 243, ...],
                                        },
                                    ),
                                ),
                                validity: AllInvalid,
                                stats_set: ArrayStats {
                                    inner: RwLock {
                                        data: StatsSet {
                                            values: [],
                                        },
                                    },
                                },
                            },
                        ],
                        stats_set: ArrayStats {
                            inner: RwLock {
                                data: StatsSet {
                                    values: [],
                                },
                            },
                        },
                    },
                ],
                validity: NonNullable,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [],
                        },
                    },
                },
            },
            StructArray {
                len: 122,
                dtype: Struct(
                    StructFields {
                        names: FieldNames(
                            [
                                FieldName(
                                    "La",
                                ),
                                FieldName(
                                    "",
                                ),
                            ],
                        ),
                        dtypes: [
                            FieldDType {
                                inner: Owned(
                                    Struct(
                                        StructFields {
                                            names: FieldNames(
                                                [],
                                            ),
                                            dtypes: [],
                                        },
                                        NonNullable,
                                    ),
                                ),
                            },
                            FieldDType {
                                inner: Owned(
                                    Primitive(
                                        F32,
                                        Nullable,
                                    ),
                                ),
                            },
                        ],
                    },
                    NonNullable,
                ),
                fields: [
                    ChunkedArray {
                        dtype: Struct(
                            StructFields {
                                names: FieldNames(
                                    [],
                                ),
                                dtypes: [],
                            },
                            NonNullable,
                        ),
                        len: 122,
                        chunk_offsets: PrimitiveArray {
                            dtype: Primitive(
                                U64,
                                NonNullable,
                            ),
                            buffer: BufferHandle(
                                Host(
                                    Buffer<u8> {
                                        length: 24,
                                        alignment: Alignment(
                                            8,
                                        ),
                                        as_slice: [0, 0, 0, 0, 0, 0, 0, 0, 61, 0, 0, 0, 0, 0, 0, 0, ...],
                                    },
                                ),
                            ),
                            validity: NonNullable,
                            stats_set: ArrayStats {
                                inner: RwLock {
                                    data: StatsSet {
                                        values: [],
                                    },
                                },
                            },
                        },
                        chunks: [
                            StructArray {
                                len: 61,
                                dtype: Struct(
                                    StructFields {
                                        names: FieldNames(
                                            [],
                                        ),
                                        dtypes: [],
                                    },
                                    NonNullable,
                                ),
                                fields: [],
                                validity: NonNullable,
                                stats_set: ArrayStats {
                                    inner: RwLock {
                                        data: StatsSet {
                                            values: [],
                                        },
                                    },
                                },
                            },
                            StructArray {
                                len: 61,
                                dtype: Struct(
                                    StructFields {
                                        names: FieldNames(
                                            [],
                                        ),
                                        dtypes: [],
                                    },
                                    NonNullable,
                                ),
                                fields: [],
                                validity: NonNullable,
                                stats_set: ArrayStats {
                                    inner: RwLock {
                                        data: StatsSet {
                                            values: [],
                                        },
                                    },
                                },
                            },
                        ],
                        stats_set: ArrayStats {
                            inner: RwLock {
                                data: StatsSet {
                                    values: [],
                                },
                            },
                        },
                    },
                    ChunkedArray {
                        dtype: Primitive(
                            F32,
                            Nullable,
                        ),
                        len: 122,
                        chunk_offsets: PrimitiveArray {
                            dtype: Primitive(
                                U64,
                                NonNullable,
                            ),
                            buffer: BufferHandle(
                                Host(
                                    Buffer<u8> {
                                        length: 24,
                                        alignment: Alignment(
                                            8,
                                        ),
                                        as_slice: [0, 0, 0, 0, 0, 0, 0, 0, 61, 0, 0, 0, 0, 0, 0, 0, ...],
                                    },
                                ),
                            ),
                            validity: NonNullable,
                            stats_set: ArrayStats {
                                inner: RwLock {
                                    data: StatsSet {
                                        values: [],
                                    },
                                },
                            },
                        },
                        chunks: [
                            PrimitiveArray {
                                dtype: Primitive(
                                    F32,
                                    Nullable,
                                ),
                                buffer: BufferHandle(
                                    Host(
                                        Buffer<u8> {
                                            length: 244,
                                            alignment: Alignment(
                                                4,
                                            ),
                                            as_slice: [61, 61, 61, 61, 61, 61, 61, 61, 61, 61, 61, 61, 61, 20, 124, 114, ...],
                                        },
                                    ),
                                ),
                                validity: AllInvalid,
                                stats_set: ArrayStats {
                                    inner: RwLock {
                                        data: StatsSet {
                                            values: [],
                                        },
                                    },
                                },
                            },
                            PrimitiveArray {
                                dtype: Primitive(
                                    F32,
                                    Nullable,
                                ),
                                buffer: BufferHandle(
                                    Host(
                                        Buffer<u8> {
                                            length: 244,
                                            alignment: Alignment(
                                                4,
                                            ),
                                            as_slice: [194, 255, 205, 76, 97, 194, 42, 253, 255, 255, 63, 194, 255, 205, 194, 205, ...],
                                        },
                                    ),
                                ),
                                validity: AllValid,
                                stats_set: ArrayStats {
                                    inner: RwLock {
                                        data: StatsSet {
                                            values: [],
                                        },
                                    },
                                },
                            },
                        ],
                        stats_set: ArrayStats {
                            inner: RwLock {
                                data: StatsSet {
                                    values: [],
                                },
                            },
                        },
                    },
                ],
                validity: NonNullable,
                stats_set: ArrayStats {
                    inner: RwLock {
                        data: StatsSet {
                            values: [],
                        },
                    },
                },
            },
        ],
        stats_set: ArrayStats {
            inner: RwLock {
                data: StatsSet {
                    values: [],
                },
            },
        },
    },
    projection_expr: Some(
        Expression {
            scalar_fn: ScalarFnRef {
                vtable: "vortex.pack",
                options: PackOptions {
                    names: FieldNames(
                        [
                            FieldName(
                                "",
                            ),
                        ],
                    ),
                    nullability: Nullable,
                },
            },
            children: [
                Expression {
                    scalar_fn: ScalarFnRef {
                        vtable: "vortex.get_item",
                        options: FieldName(
                            "",
                        ),
                    },
                    children: [
                        Expression {
                            scalar_fn: ScalarFnRef {
                                vtable: "vortex.root",
                                options: EmptyOptions,
                            },
                            children: [],
                        },
                    ],
                },
            ],
        },
    ),
    filter_expr: Some(
        Expression {
            scalar_fn: ScalarFnRef {
                vtable: "vortex.binary",
                options: Gte,
            },
            children: [
                Expression {
                    scalar_fn: ScalarFnRef {
                        vtable: "vortex.get_item",
                        options: FieldName(
                            "",
                        ),
                    },
                    children: [
                        Expression {
                            scalar_fn: ScalarFnRef {
                                vtable: "vortex.root",
                                options: EmptyOptions,
                            },
                            children: [],
                        },
                    ],
                },
                Expression {
                    scalar_fn: ScalarFnRef {
                        vtable: "vortex.literal",
                        options: Scalar {
                            dtype: Primitive(
                                F32,
                                Nullable,
                            ),
                            value: Some(
                                Primitive(
                                    F32(
                                        -3.8655884e31,
                                    ),
                                ),
                            ),
                        },
                    },
                    children: [],
                },
            ],
        },
    ),
    compressor_strategy: Default,
}

[github-actions]

Seen 4 times

[github-actions]

Crash No Longer Reproduces

This crash was retested against the latest main branch and the fuzzer completed successfully (exit code 0).

The underlying bug appears to have been fixed. Closing this issue.

If the crash reappears, the fuzzer will automatically open a new issue.

---

Auto-checked by weekly fuzzer issue cleanup

[connortsui20]

reopenign this since the fuzzer behavior was changed recently, so it cant repro anymore (#6925)

[github-actions]

Crash No Longer Reproduces

This crash was retested against the latest main branch and the fuzzer completed successfully (exit code 0).

The underlying bug appears to have been fixed. Closing this issue.

If the crash reappears, the fuzzer will automatically open a new issue.

---

Auto-checked by weekly fuzzer issue cleanup

[connortsui20]

So this is funny (not really), turns out that this is actually the exact same issue as #6895, which I fixed in #6940.

Couldn't tell that it was the same because I was checked out to the previous commit 22ebbbe (right before #6925) and so I didn't have my own fix 😭.

Cherry picking 4b7207e resolves this crash.

Closing as resolved. cc @robert3005 in case you want to take a look and see if there anything else with binary op that is relevant here.