[C++] ComputeLogicalNullCount crashes for dictionary arrays with null value type
- Dominant language
- C++
- Stars
- 17.1k
- Forks
- 4.3k
- Avg merge
- 3d 13h
- Merged PRs (30d)
- 88
Description
### Describe the bug, including details regarding any error messages, version, and platform.
### Describe the bug, including details regarding any error messages, version, and platform
`Array::ComputeLogicalNullCount` segfaults for dictionary arrays whose value type is `null()`, even though the array passes full validation:
```c++
auto type = dictionary(int32(), null());
auto array = DictArrayFromJSON(type, R"([0, 0, null])", "[null]");
ASSERT_OK(array->ValidateFull());
array->ComputeLogicalNullCount(); // segfault
```
The values array of such a dictionary is a `NullArray`, which reports `null_count == length` without having a validity bitmap (`buffers[0]` is null). The early-out in `dict_util::LogicalNullCount` only triggers when the dictionary's null count is 0, so the per-index loop unconditionally reads the null validity-bitmap pointer:
https://github.com/apache/arrow/blob/main/cpp/src/arrow/util/dict_util.cc#L56-L59
Note that element-wise `Array::IsValid` handles the same data correctly (it falls back to `null_count == length` when there is no bitmap), so the aggregate and per-element views of logical nullness disagree.
Found while working on GH-50338 (#50347).
The crash is also reachable from the bindings through the C++ `count` kernel, which uses `ComputeLogicalNullCount` when counting nulls (e.g. `pyarrow.compute.count(arr, mode="only_null")` on such an array).
### Component(s)
C++
### Component(s)
C++
Contributor guide
Assessment
This issue has not been assessed yet.