goel-skd opened a new issue, #50699: URL: https://github.com/apache/arrow/issues/50699
### Describe the bug, including details regarding any error messages, version, and platform. ### Describe the bug, including details regarding any error messages, version, and platform `Array::ComputeLogicalNullCount` segfaults for dictionary arrays whose value type is `null()`, even though the array passes full validation: ```c++ auto type = dictionary(int32(), null()); auto array = DictArrayFromJSON(type, R"([0, 0, null])", "[null]"); ASSERT_OK(array->ValidateFull()); array->ComputeLogicalNullCount(); // segfault ``` The values array of such a dictionary is a `NullArray`, which reports `null_count == length` without having a validity bitmap (`buffers[0]` is null). The early-out in `dict_util::LogicalNullCount` only triggers when the dictionary's null count is 0, so the per-index loop unconditionally reads the null validity-bitmap pointer: https://github.com/apache/arrow/blob/main/cpp/src/arrow/util/dict_util.cc#L56-L59 Note that element-wise `Array::IsValid` handles the same data correctly (it falls back to `null_count == length` when there is no bitmap), so the aggregate and per-element views of logical nullness disagree. Found while working on GH-50338 (#50347). The crash is also reachable from the bindings through the C++ `count` kernel, which uses `ComputeLogicalNullCount` when counting nulls (e.g. `pyarrow.compute.count(arr, mode="only_null")` on such an array). ### Component(s) C++ ### Component(s) C++ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
