fix: HGraph dirty-vector search dereferences an empty result heap

[vsag-bot]

Summary

HGraph now retains its valid entry point when an upper-layer search returns no finite candidates, preventing empty-heap dereferences.

Root Cause

Non-finite distance filtering can leave route-search result heaps empty, but HGraph unconditionally called Top() while descending graph layers.

Changes

• Guarded empty route results in SearchWithRequest, RangeSearch, and iterator KNN search.
• Added a deterministic all-NaN query regression covering upper HGraph layers.

Validation

• clang-format --dry-run --Werror src/algorithm/hgraph.cpp src/algorithm/hgraph_add_test.cpp: passed - Changed C++ files conform to formatting rules.
• cmake --build build-ai-fix --target unittests --parallel 4: passed - ASan/UBSan unit-test target built successfully.
• ASAN_OPTIONS=detect_leaks=0:halt_on_error=1 UBSAN_OPTIONS=halt_on_error=1 ./build-ai-fix/tests/unittests 'HGraph search handles an empty route result': passed - 3 assertions passed.
• ASAN_OPTIONS=detect_leaks=0:halt_on_error=0 UBSAN_OPTIONS=halt_on_error=0 ./build-ai-fix/tests/functests '(PR) HGraph Search with Dirty Vector': passed - 283 assertions passed with no sanitizer diagnostics.

Residual Risks

• A randomized pre-fix run separately exposed empty-neighbor handling during dirty-vector construction; it did not recur post-fix and is outside the reported SearchWithRequest dereference.

Base branch: 0.18

Fixes #2801

Prepared by vsag-bot after automatic effort ordering and AI repairability preflight.

[vsag-bot]

/label status/waiting-for-review
/waiting-on reviewer
/request-review @wxyucs
/request-review @inabao

[vsag-bot]

AI PR state: status/ai-working
Current owner: @vsag-bot
Reason: checks concluded failure
Head: 261072f

Automatic merging is disabled. A maintainer performs the final merge.

[mergify]

Merge Protections

🟢 Merge protection satisfied — ready to merge.

Show 1 satisfied protection

🟢 Require linked issue for feature/bug PRs

• body~=(?im)(?:^|[\s\-\*])(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s*:?\s+(?:#\d+|[\w.\-]+/[\w.\-]+#\d+|https?://github\.com/[\w.\-]+/[\w.\-]+/issues/\d+)

[LHT129]

Thanks for this fix. The change is clean and correct.

Summary of the fix:

• Three call sites in hgraph.cpp (KnnSearch, RangeSearch, SearchWithRequest) now guard result->Top() with not result->Empty() when descending route graph layers, preventing dereference of an empty result heap caused by non-finite distance filtering (e.g. all-NaN queries).
• A regression test in hgraph_add_test.cpp exercises the all-NaN query path and verifies the search returns an empty result set rather than crashing.

Review notes:

• The fix is minimal and surgical — exactly what a bug fix should be.
• When all route graph layers return empty, search_param.ep retains its initial value (entry_point_id_), which is already validated against INVALID_ENTRY_POINT before the loop. This is correct fallback behavior.
• The test case is well-scoped: deterministic, self-contained, and directly targets the reported crash path.
• No correctness, performance, or security concerns found.

[vsag-bot]

AI PR CI recovery

Item	Value
Status	rerun-requested
Head	261072f
Workflow	Asan Build & Test Parallel
Classification	unrelated_transient
Confidence	94%
Action	Requested a rerun of failed jobs

No repair is needed. The failed Aarch64 functional-test shard appears randomized/transient; rerunning the same workflow is safe and useful.

Reasoning:
The PR only changes route descent when a search result heap is empty. CI’s visible HGraph Duplicate lines are non-fatal recall warnings, while sanitizer diagnostics originate in unchanged paths. The deterministic regression, reported Duplicate test, and full randomized HGraph shard all passed locally under sanitizer instrumentation. The checkout remains unchanged and clean.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

@@            Coverage Diff             @@
##             0.18    #2802      +/-   ##
==========================================
+ Coverage   91.43%   91.53%   +0.09%     
==========================================
  Files         332      332              
  Lines       19796    19799       +3     
==========================================
+ Hits        18101    18123      +22     
+ Misses       1695     1676      -19     

Flag	Coverage Δ
cpp	91.53% <100.00%> (+0.09%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
common	86.00% <ø> (ø)
datacell	93.32% <ø> (+0.49%)	⬆️
index	91.80% <100.00%> (+0.13%)	⬆️
simd	100.00% <ø> (ø)

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ef930fb...261072f. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[wxyucs]

@vsag-bot This PR remains labeled status/ai-working, but Build with TSAN and Test Aarch64 (functests) are still failing and there has been no update since August 28. Please inspect the current failures and continue advancing the PR.