`Sparse` canonicalization panics on an out-of-bounds patch index (`BitBufferMut::set`)

[lorenzhs]

What happened?

Another fuzzer panic:

thread 'tokio-rt-worker' (568293) panicked at .../vortex-buffer/src/bit/buf_mut.rs:352:9:
index 402653634 exceeds len 1024
stack backtrace:
   0: __rustc::rust_begin_unwind
   1: core::panicking::panic_fmt
   2: vortex_array::arrays::bool::patch::<impl vortex_array::array::typed::Array<vortex_array::arrays::bool::vtable::Bool>>::patch
   3: vortex_array::validity::Validity::patch
   4: vortex_array::arrays::primitive::array::patch::<impl vortex_array::array::typed::Array<vortex_array::arrays::primitive::vtable::Primitive>>::patch
   5: vortex_sparse::canonical::execute_sparse_primitives
   6: vortex_sparse::canonical::execute_sparse
   7: <vortex_sparse::Sparse as vortex_array::array::vtable::VTable>::execute
   8: <vortex_array::array::typed::ArrayData<V> as vortex_array::array::DynArrayData>::execute_unchecked
   9: <vortex_array::canonical::Canonical as vortex_array::executor::Executable>::execute
  10: vortex_array::canonical::<impl vortex_array::executor::Executable for vortex_array::array::typed::Array<vortex_array::arrays::primitive::vtable::Primitive>>::execute
  11: vortex_arrow::executor::primitive::to_arrow_primitive
  12: vortex_arrow::executor::execute_arrow_naive
  13: vortex_arrow::session::ArrowSession::execute_arrow
  14: vortex_arrow::executor::struct_::create_from_fields
  15: vortex_arrow::executor::struct_::to_arrow_struct
  16: vortex_arrow::executor::execute_arrow_naive
  17: vortex_arrow::session::ArrowSession::execute_arrow
  18: vortex_layout::scan::scan_builder::ScanBuilder<A>::map::{{closure}}
  19: vortex_layout::scan::tasks::split_exec::{{closure}}
  20: <tracing::instrument::Instrumented<T> as core::future::future::Future>::poll
  21: tokio::runtime::task::raw::poll
  22: tokio::runtime::scheduler::multi_thread::worker::Context::run_task
  23: tokio::runtime::scheduler::multi_thread::worker::run
  24: tokio::runtime::task::raw::poll

Steps to reproduce

This one's a bit big to base64-dump it here (34kB / 46kB once base64'd), so I uploaded it to https://4z2.de/fuzz3.vortex instead. sha256sum is 25bbe98c74680e7fcd9387f8b13da7b69737edd6dd8bf390de58c082585b62bf. Just run vx query --sql 'select * from data' fuzz3.vortex on it (or use duckdb)

Environment

develop as of 3975895

Additional context

No response

[lorenzhs]

This is triggerable via a few different paths, there's also this one: http://4z2.de/fuzz3b.vortex (sha256sum: ac4adab47dc37636b6f6e57e2c1849c923cff4e57ffd12e7c135e887aca8b4ea)

thread 'tokio-rt-worker' (583267) panicked at .../vortex-array/src/arrays/primitive/array/patch.rs:129:9:
index out of bounds: the len is 1024 but the index is 288230376151712349
stack backtrace:
   0: __rustc::rust_begin_unwind
   1: core::panicking::panic_fmt
   2: core::panicking::panic_bounds_check
   3: vortex_alp::alp::decompress::decompress_chunked_core
   4: <vortex_alp::alp::array::ALP as vortex_array::array::vtable::VTable>::execute
   5: <vortex_array::array::typed::ArrayData<V> as vortex_array::array::DynArrayData>::execute_unchecked
   6: <vortex_array::canonical::Canonical as vortex_array::executor::Executable>::execute
   7: vortex_array::canonical::<impl vortex_array::executor::Executable for vortex_array::array::typed::Array<vortex_array::arrays::primitive::vtable::Primitive>>::execute
   8: vortex_arrow::executor::primitive::to_arrow_primitive
   9: vortex_arrow::executor::execute_arrow_naive
  10: vortex_arrow::session::ArrowSession::execute_arrow
  11: vortex_arrow::executor::struct_::create_from_fields
  12: vortex_arrow::executor::struct_::to_arrow_struct
  13: vortex_arrow::executor::execute_arrow_naive
  14: vortex_arrow::session::ArrowSession::execute_arrow
  15: vortex_layout::scan::scan_builder::ScanBuilder<A>::map::{{closure}}
  16: vortex_layout::scan::tasks::split_exec::{{closure}}
  17: <tracing::instrument::Instrumented<T> as core::future::future::Future>::poll
  18: tokio::runtime::task::raw::poll
  19: tokio::runtime::scheduler::multi_thread::worker::Context::run_task
  20: tokio::runtime::scheduler::multi_thread::worker::run
  21: tokio::runtime::task::raw::poll