mbutrovich opened a new issue, #11825:
URL: https://github.com/apache/arrow-rs/issues/11825

   ### Describe the bug
   
   Since #10945, `take_record_batch` checks indices only through the first 
column's take, and takes the other columns unchecked 
([take.rs](https://github.com/apache/arrow-rs/blob/01a9917658fecd639991e92a5a5810be710b539c/arrow-select/src/take.rs#L1708-L1728)).
 The first column's take reads no index when its type has no width: `Null`, a 
struct with no fields, `FixedSizeList` of size 0, and `FixedSizeBinary(0)`, the 
last three without nulls. An index out of bounds then reaches the unchecked 
reads, from a safe function. No release contains #10945.
   
   ### To Reproduce
   
   ```rust
   use std::sync::Arc;
   
   use arrow_array::{ArrayRef, Int32Array, NullArray, RecordBatch};
   use arrow_schema::{DataType, Field, Schema};
   use arrow_select::take::take_record_batch;
   
   fn main() {
       // A Null column first, then an Int32 column, 2 rows each
       let schema = Arc::new(Schema::new(vec![
           Field::new("n", DataType::Null, true),
           Field::new("a", DataType::Int32, true),
       ]));
       let batch = RecordBatch::try_new(
           schema,
           vec![Arc::new(NullArray::new(2)) as ArrayRef, 
Arc::new(Int32Array::from(vec![1, 2]))],
       )
       .unwrap();
   
       // Index 2 is one past the end
       let out = take_record_batch(&batch, &Int32Array::from(vec![2])).unwrap();
       println!("{:?}", out.column(1));
       // debug: aborts with "unsafe precondition(s) violated: 
slice::get_unchecked requires that the index is within the slice"
       // release: [0], read from past the end of "a"
   }
   ```
   
   ### Expected behavior
   
   A panic, as `take` documents for an index out of bounds when bounds are not 
checked, or an error.
   
   ### Additional context
   
   #10945 also puts nulls in non-nullable columns, filed as #11824.
   
   Found with property-based tests that build arrays in every physical layout 
the Arrow format allows, on `main` at `01a991765`.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to