apache / apache/arrow

[C++] ComputeLogicalNullCount crashes for dictionary arrays with null value type

Open
#50,699 1 comment 0 reactions 1 assignee Claimed by @goel-skd View on GitHub
Component: C++ Type: bug
Dominant language
C++
Stars
17.1k
Forks
4.3k
Avg merge
3d 13h
Merged PRs (30d)
88

Description

### Describe the bug, including details regarding any error messages, version, and platform.

### Describe the bug, including details regarding any error messages, version, and platform

`Array::ComputeLogicalNullCount` segfaults for dictionary arrays whose value type is `null()`, even though the array passes full validation:

```c++
auto type = dictionary(int32(), null());
auto array = DictArrayFromJSON(type, R"([0, 0, null])", "[null]");
ASSERT_OK(array->ValidateFull());
array->ComputeLogicalNullCount(); // segfault
```

The values array of such a dictionary is a `NullArray`, which reports `null_count == length` without having a validity bitmap (`buffers[0]` is null). The early-out in `dict_util::LogicalNullCount` only triggers when the dictionary's null count is 0, so the per-index loop unconditionally reads the null validity-bitmap pointer:

https://github.com/apache/arrow/blob/main/cpp/src/arrow/util/dict_util.cc#L56-L59

Note that element-wise `Array::IsValid` handles the same data correctly (it falls back to `null_count == length` when there is no bitmap), so the aggregate and per-element views of logical nullness disagree.

Found while working on GH-50338 (#50347).

The crash is also reachable from the bindings through the C++ `count` kernel, which uses `ComputeLogicalNullCount` when counting nulls (e.g. `pyarrow.compute.count(arr, mode="only_null")` on such an array).

### Component(s)

C++

### Component(s)

C++

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.