Sparse multi-valued SortedNumericDocValues#rangeIntoBitSet (default codec), called after advanceExact(d) returned false, judges doc d by a neighbouring document's values (or throws ArrayIndexOutOfBoundsException)
Finding LFV-415Area: codecs / doc values (Lucene90 sparse multi-valued sorted-numeric rangeIntoBitSet)Priority: lowImpact: silent wrong resultsNovelty: known upstream
AI-assisted finding, confirmed by automated checks, not yet triaged by a human Lucene committer. This site files nothing upstream.
What it shows
On a default-codec index with docs {0: [1,3], 1: no value, 2: [5,7]} in a multi-valued numeric doc-values field, you call advanceExact(1) on the field's SortedNumericDocValues (it returns false) and then rangeIntoBitSet(1, 3, 1, 3, bits, 0) on the same iterator. You expect no bit, because neither doc 1 nor doc 2 has a value in [1, 3], and that is what the method's documented per-document default returns from the same state. Instead the codec's override evaluates doc 1 with doc 0's values and marks it (in a DENSE block it uses the next valued document's values), and when no earlier document has values ({0: no value, 1: [1,3], 2: [5,7]}, advanceExact(0) then rangeIntoBitSet(0, 3, 1, 3, ...)) it throws ArrayIndexOutOfBoundsException: Index -1.
Expected vs actual
- Expected: You expect no bit, because neither doc 1 nor doc 2 has a value in [1, 3], and that is what the method's documented per-document default returns from the same state.
- Actual: The codec's override evaluates doc 1 with doc 0's values and marks it (in a DENSE block it uses the next valued document's values), and when no earlier document has values ({0: no value, 1: [1,3], 2: [5,7]}, advanceExact(0) then rangeIntoBitSet(0, 3, 1, 3, ...)) it throws ArrayIndexOutOfBoundsException: Index -1.
Files
Run it
- Tested on Lucene main e1faeba08bde (2026-11-02): still reproduces.
- Tested on Lucene main ea57360912ed (2026-10-24): reproduced.
- How to read the outcome: a failing test is the finding reproducing (the failure message states expected against actual).
- Seeds: a rerun with the same seed replays the same random choices. Assertions off (-da -dsa -Dtests.asserts=false) is the production-like setting.
# Lucene checkout at the tested commit, built with: ./gradlew --no-daemon assemble (JDK 25)
LUCENE=/path/to/lucene; V=12.0.0-SNAPSHOT
CP=$LUCENE/lucene/core/build/libs/lucene-core-$V.jar
CP=$CP:$LUCENE/lucene/codecs/build/libs/lucene-codecs-$V.jar
CP=$CP:$LUCENE/lucene/test-framework/build/libs/lucene-test-framework-$V.jar
CP=$CP:randomizedtesting-runner-2.9.2.jar:junit-4.13.2.jar:hamcrest-3.0.jar # test-framework dependencies (Maven Central)
CP=$CP:junit-platform-console-standalone-6.1.3.jar # JUnit Platform console launcher (Maven Central)
javac -d classes -cp "$CP" $(find src -name '*.java')
# run 1: assertions on, seed DEADBEEF
java -ea -esa --add-modules jdk.incubator.vector --enable-native-access=ALL-UNNAMED -Dtests.seed=DEADBEEF \
-cp "classes:$CP" org.junit.platform.console.ConsoleLauncher \
execute --select-class org.apache.lucene.index.TestSparseSortedNumericRangeAfterAdvanceExactGradle alternative: copy the test into the matching module's src/test/ tree of the checkout and run ./gradlew -p lucene/<module> test --tests <class> -Ptests.seed=<seed> (add -Ptests.asserts=false for a run without assertions).
Formal models and scripts this finding's part of the hunt used: dv-norms-cursor-coherence
Feedback
Open an issue in lucene-ai-bug-hunt. Please do not open issues or pull requests in apache/lucene about this finding unless a Lucene committer agrees it should be filed.
Snapshot of 2026-11-03. AI-assisted; not yet triaged by a human Lucene committer. Feedback: open an issue in lucene-ai-bug-hunt.