Repository: duckdb/duckdb (language: python)

Issue:
FATAL Error: 'Operation requires a flat vector but a non-flat vector was encountered' on CASE conditional expression
### What happens?

The latest versions of the DuckDB (latest main: v1.1.4-dev2317 a4963a5aea and released version: v1.1.3 19864453f7) crash when running the following SQL statement:

```sql
SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ 'any_string' IN ? : ] THEN TRUE END ;
```

Here is the stack frame that triggers the Internal Error: 

```
#0  duckdb::InternalException::InternalException (this=0xaaaaea5738f0, msg="Operation requires a flat vector but a non-flat vector was encountered")
    at /home/duckdb/duckdb/src/common/exception.cpp:333
#1  0x0000aaaadb9cd190 in duckdb::FlatVector::VerifyFlatVector (vector=...) at /usr/include/c++/9/ext/new_allocator.h:80
#2  0x0000aaaadc1792b4 in duckdb::FlatVector::Validity (vector=...) at ../../src/include/duckdb/common/types/vector.hpp:361
#3  duckdb::VectorStringToMap::StringToNestedTypeCastLoop (source_data=source_data@entry=0xaaaaea550280, source_mask=..., result=..., result_mask=..., count=count@entry=1, 
    parameters=..., sel=sel@entry=0x0) at /home/duckdb/duckdb/src/function/cast/string_cast.cpp:345
#4  0x0000aaaadc216dec in duckdb::StringToNestedTypeCast<duckdb::VectorStringToMap> (count=<optimized out>, parameters=..., result=..., source=...)
    at ../../src/include/duckdb/common/types/vector.hpp:362
#5  duckdb::StringToNestedTypeCast<duckdb::VectorStringToMap> (source=..., result=..., count=<optimized out>, parameters=...)
    at /home/duckdb/duckdb/src/function/cast/string_cast.cpp:440
#6  0x0000aaaadbb54350 in duckdb::ExpressionExecutor::Execute (this=this@entry=0xffffe54a2a60, expr=..., state=state@entry=0xaaaaea54b980, sel=sel@entry=0x0, 
    count=count@entry=1, result=...) at /home/duckdb/duckdb/src/execution/expression_executor/execute_cast.cpp:42
#7  0x0000aaaadbc83f48 in duckdb::ExpressionExecutor::Execute (this=this@entry=0xffffe54a2a60, expr=..., state=0xaaaaea54b980, sel=sel@entry=0x0, count=count@entry=1, 
    result=...) at /home/duckdb/duckdb/src/execution/expression_executor.cpp:205
#8  0x0000aaaadbb567f4 in duckdb::ExpressionExecutor::Select (this=0xffffe54a2a60, expr=..., state=<optimized out>, sel=0x0, count=1, true_sel=0xaaaaea530380, 
    false_sel=0xaaaaea530398) at /usr/include/c++/9/bits/unique_ptr.h:360
#9  0x0000aaaadbc849c0 in duckdb::ExpressionExecutor::Select (false_sel=0xaaaaea530380, true_sel=0xaaaaea530380, count=1, sel=0x0, state=<optimized out>, expr=..., 
    this=0xffffe54a2a60) at ../../src/include/duckdb/parser/base_expression.hpp:98
#10 duckdb::ExpressionExecutor::Select (this=this@entry=0xffffe54a2a60, expr=..., state=<optimized out>, sel=sel@entry=0x0, count=count@entry=1, 
    true_sel=true_sel@entry=0xaaaaea530380, false_sel=false_sel@entry=0xaaaaea530398) at /home/duckdb/duckdb/src/execution/expression_executor.cpp:231
#11 0x0000aaaadbb57224 in duckdb::ExpressionExecutor::Execute (this=this@entry=0xffffe54a2a60, expr=..., state_p=state_p@entry=0xaaaaea5302d0, sel=sel@entry=0x0, 
    count=count@entry=1, result=...) at ../../src/include/duckdb/common/unique_ptr.hpp:20
#12 0x0000aaaadbc83fa8 in duckdb::ExpressionExecutor::Execute (this=0xffffe54a2a60, expr=..., state=0xaaaaea5302d0, sel=sel@entry=0x0, count=1, result=...)
    at /home/duckdb/duckdb/src/execution/expression_executor.cpp:202
#13 0x0000aaaadbc89518 in duckdb::ExpressionExecutor::ExecuteExpression (this=this@entry=0xffffe54a2a60, expr_idx=expr_idx@entry=0, result=...)
    at ../../src/include/duckdb/common/types/data_chunk.hpp:54
#14 0x0000aaaadbc896bc in duckdb::ExpressionExecutor::ExecuteExpression (this=this@entry=0xffffe54a2a60, result=...)
    at /home/duckdb/duckdb/src/execution/expression_executor.cpp:96
#15 0x0000aaaadbc89750 in duckdb::ExpressionExecutor::EvaluateScalar (context=..., expr=..., allow_unfoldable=allow_unfoldable@entry=false)
    at /home/duckdb/duckdb/src/execution/expression_executor.cpp:112
#16 0x0000aaaadbc899c8 in duckdb::ExpressionExecutor::TryEvaluateScalar (context=..., expr=..., result=...) at /home/duckdb/duckdb/src/execution/expression_executor.cpp:122
#17 0x0000aaaadbf5f2fc in duckdb::ConstantFoldingRule::Apply (this=0xaaaaea2f66c0, op=..., bindings=..., changes_made=<optimized out>, is_root=<optimized out>)
    at /home/duckdb/duckdb/src/optimizer/rule/constant_folding.cpp:36
#18 0x0000aaaadbf6ec40 in duckdb::ExpressionRewriter::ApplyRules (op=..., rules=..., expr=..., changes_made=@0xffffe54a2da7: false, is_root=is_root@entry=true)
    at /home/duckdb/duckdb/src/optimizer/expression_rewriter.cpp:20
#19 0x0000aaaadbf6f0a8 in duckdb::ExpressionRewriter::VisitExpression (this=0xffffe54a32f8, expression=0xaaaaea52eec0) at /usr/include/c++/9/bits/move.h:74
#20 0x0000aaaadc0657b8 in std::function<void (duckdb::unique_ptr<duckdb::Expression, std::default_delete<duckdb::Expression>, true>*)>::operator()(duckdb::unique_ptr<duckdb::Expression, std::default_delete<duckdb::Expression>, true>*) const (__args#0=<optimized out>, this=0xffffe54a2ed8) at /usr/include/c++/9/bits/std_function.h:683
#21 duckdb::LogicalOperatorVisitor::EnumerateExpressions(duckdb::LogicalOperator&, std::function<void (duckdb::unique_ptr<duckdb::Expression, std::default_delete<duckdb::Expression>, true>*)> const&) (op=..., callback=...) at /home/duckdb/duckdb/src/planner/logical_operator_visitor.cpp:175
#22 0x0000aaaadc065b7c in duckdb::LogicalOperatorVisitor::VisitOperatorExpressions (this=this@entry=0xffffe54a32f8, op=...) at /usr/include/c++/9/new:174
#23 0x0000aaaadbf6b8c8 in duckdb::ExpressionRewriter::VisitOperator (this=0xffffe54a32f8, op=...) at /home/duckdb/duckdb/src/optimizer/expression_rewriter.cpp:68
#24 0x0000aaaadc07341c in duckdb::LogicalOperatorVisitor::VisitOperatorChildren (op=..., this=0xffffe54a32f8) at ../../src/include/duckdb/common/unique_ptr.hpp:20
#25 duckdb::LogicalOperatorVisitor::VisitOperatorChildren (this=this@entry=0xffffe54a32f8, op=...) at /home/duckdb/duckdb/src/planner/logical_operator_visitor.cpp:14
#26 0x0000aaaadbf6b788 in duckdb::ExpressionRewriter::VisitOperator (this=0xffffe54a32f8, op=...) at /home/duckdb/duckdb/src/optimizer/expression_rewriter.cpp:60
#27 0x0000aaaadbf6ba34 in duckdb::Optimizer::<lambda()>::operator() (__closure=<optimized out>) at ../../src/include/duckdb/common/unique_ptr.hpp:20
#28 std::_Function_handler<void(), duckdb::Optimizer::RunBuiltInOptimizers()::<lambda()> >::_M_invoke(const std::_Any_data &) (__functor=...)
    at /usr/include/c++/9/bits/std_function.h:300
#29 0x0000aaaadbf6c624 in std::function<void ()>::operator()() const (this=0xffffe54a31a8) at /usr/include/c++/9/bits/std_function.h:683
#30 duckdb::Optimizer::RunOptimizer(duckdb::OptimizerType, std::function<void ()> const&) (callback=..., type=duckdb::OptimizerType::EXPRESSION_REWRITER, 
    this=0xffffe54a32e8) at /home/duckdb/duckdb/src/optimizer/optimizer.cpp:80
#31 duckdb::Optimizer::RunOptimizer(duckdb::OptimizerType, std::function<void ()> const&) (this=0xffffe54a32e8, type=duckdb::OptimizerType::EXPRESSION_REWRITER, 
    callback=...) at /home/duckdb/duckdb/src/optimizer/optimizer.cpp:73
#32 0x0000aaaadbf6dc78 in duckdb::Optimizer::RunBuiltInOptimizers (this=this@entry=0xffffe54a32e8) at /usr/include/c++/9/new:174
#33 0x0000aaaadbf6e6b0 in duckdb::Optimizer::Optimize (this=this@entry=0xffffe54a32e8, plan_p=...) at /home/duckdb/duckdb/src/optimizer/optimizer.cpp:253
#34 0x0000aaaadbd75a50 in duckdb::ClientContext::CreatePreparedStatementInternal (this=this@entry=0xaaaaea3954e0, lock=..., 
    query="SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ 'any_string' IN ? : ] THEN TRUE END ;", statement=..., values=values@entry=...) at /usr/include/c++/9/bits/move.h:74
#35 0x0000aaaadbd76108 in duckdb::ClientContext::CreatePreparedStatement (this=this@entry=0xaaaaea3954e0, lock=..., 
    query="SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ 'any_string' IN ? : ] THEN TRUE END ;", statement=..., values=..., 
    mode=mode@entry=duckdb::PreparedStatementMode::PREPARE_ONLY) at /usr/include/c++/9/bits/move.h:74
#36 0x0000aaaadbd76550 in duckdb::ClientContext::RebindPreparedStatement (this=this@entry=0xaaaaea3954e0, lock=..., 
    query="SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ 'any_string' IN ? : ] THEN TRUE END ;", prepared=..., parameters=...) at /usr/include/c++/9/bits/unique_ptr.h:360
#37 0x0000aaaadbd777b8 in duckdb::ClientContext::PendingPreparedStatement (this=this@entry=0xaaaaea3954e0, lock=..., 
    query="SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ 'any_string' IN ? : ] THEN TRUE END ;", prepared=..., parameters=...)
    at /home/duckdb/duckdb/src/main/client_context.cpp:544
#38 0x0000aaaadbd7802c in duckdb::ClientContext::PendingStatementOrPreparedStatement (this=this@entry=0xaaaaea3954e0, lock=..., 
    query="SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ 'any_string' IN ? : ] THEN TRUE END ;", statement=..., prepared=..., parameters=...)
    at /usr/include/c++/9/ext/atomicity.h:96
#39 0x0000aaaadbd79400 in duckdb::ClientContext::PendingStatementOrPreparedStatementInternal (this=this@entry=0xaaaaea3954e0, lock=..., 
    query="SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ 'any_string' IN ? : ] THEN TRUE END ;", statement=..., prepared=..., parameters=...)
    at /usr/include/c++/9/bits/move.h:74
#40 0x0000aaaadbd79724 in duckdb::ClientContext::PendingQueryPreparedInternal (this=this@entry=0xaaaaea3954e0, lock=..., 
    query="SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ 'any_string' IN ? : ] THEN TRUE END ;", prepared=..., parameters=...) at /usr/include/c++/9/tuple:918
#41 0x0000aaaadbd79864 in duckdb::ClientContext::PendingQuery (this=this@entry=0xaaaaea3954e0, 
    query="SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ 'any_string' IN ? : ] THEN TRUE END ;", prepared=..., parameters=...)
    at ../../src/include/duckdb/common/unique_ptr.hpp:20
#42 0x0000aaaadbd79a80 in duckdb::PreparedStatement::PendingQuery (this=this@entry=0xaaaaea379bf0, named_values=std::unordered_map with 1 element = {...}, 
    allow_stream_result=allow_stream_result@entry=false) at ../../src/include/duckdb/common/shared_ptr_ipp.hpp:204
#43 0x0000aaaadbd79fa4 in duckdb::PreparedStatement::PendingQuery (this=0xaaaaea379bf0, values=..., allow_stream_result=allow_stream_result@entry=false)
    at /home/duckdb/duckdb/src/main/prepared_statement.cpp:94
#44 0x0000aaaadbd7a210 in duckdb::PreparedStatement::Execute (this=<optimized out>, values=..., allow_stream_result=allow_stream_result@entry=false)
    at /home/duckdb/duckdb/src/main/prepared_statement.cpp:81
#45 0x0000aaaadb8a55fc in duckdb_shell_sqlite3_print_duckbox (pStmt=0xaaaaea52ac70, max_rows=40, max_width=0, null_value=0xffffe54a4948 "NULL", columnar=0, 
    thousand_separator=0 '\000', decimal_separator=0 '\000', result_renderer=0xffffe54a4530) at ../../src/include/duckdb/common/unique_ptr.hpp:39
#46 0x0000aaaadb895dfc in duckdb_shell::ShellState::ExecutePreparedStatement (this=0xffffe54a4840, pStmt=0xaaaaea52ac70) at /usr/include/c++/9/bits/basic_string.h:2304
#47 0x0000aaaadb896384 in duckdb_shell::ShellState::ExecuteSQL (this=0xffffe54a4840, 
    zSql=0xaaaaea2f2f10 "SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ 'any_string' IN ? : ] THEN TRUE END ;", pzErrMsg=0xffffe54a4660) at ../../tools/shell/shell.cpp:1788
#48 0x0000aaaadb896c74 in duckdb_shell::ShellState::RunOneSqlLine (this=0xffffe54a4840, 
    zSql=0xaaaaea2f2f10 "SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ 'any_string' IN ? : ] THEN TRUE END ;") at ../../tools/shell/shell.cpp:4318
#49 0x0000aaaadb897298 in duckdb_shell::ShellState::ProcessInput (this=0xffffe54a4840) at ../../tools/shell/shell.cpp:4433
#50 0x0000aaaadb87bd9c in main (argc=<optimized out>, argv=0xffffe54a4b28) at ../../tools/shell/shell.cpp:5032
```

### To Reproduce

1. Clone the DuckDB Git from the official repo.
2. Checkout to the latest main (v1.1.4-dev2317 a4963a5aea).
3. Compile the DuckDB binary by using `CORE_EXTENSIONS='autocomplete;httpfs;icu;parquet;json' GEN=ninja make debug`.
4. Run the compiled DuckDB and input the following SQL:

```sql
SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ 'any_string' IN ? : ] THEN TRUE END ;
```

### OS:

Ubuntu 24.04.01 LTS (x86-64 & aarch64)

### DuckDB Version:

v1.1.3 19864453f7 and v1.1.4-dev2317 a4963a5aea

### DuckDB Client:

cli

### Hardware:

_No response_

### Full Name:

Yu Liang

### Affiliation:

The Pennsylvania State University

### What is the latest build you tested with? If possible, we recommend testing with the latest nightly build.

I have tested with a stable release

### Did you include all relevant data sets for reproducing the issue?

Yes

### Did you include all code required to reproduce the issue?

- [X] Yes, I have

### Did you include all relevant configuration (e.g., CPU architecture, Python version, Linux distribution) to reproduce the issue?

- [X] Yes, I have
FATAL Error: 'Operation requires a flat vector but a non-flat vector was encountered' on CASE conditional expression
### What happens?

The latest versions of the DuckDB (latest main: v1.1.4-dev2317 a4963a5aea and released version: v1.1.3 19864453f7) crash when running the following SQL statement:

```sql
SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ 'any_string' IN ? : ] THEN TRUE END ;
```

Here is the stack frame that triggers the Internal Error: 

```
#0  duckdb::InternalException::InternalException (this=0xaaaaea5738f0, msg="Operation requires a flat vector but a non-flat vector was encountered")
    at /home/duckdb/duckdb/src/common/exception.cpp:333
#1  0x0000aaaadb9cd190 in duckdb::FlatVector::VerifyFlatVector (vector=...) at /usr/include/c++/9/ext/new_allocator.h:80
#2  0x0000aaaadc1792b4 in duckdb::FlatVector::Validity (vector=...) at ../../src/include/duckdb/common/types/vector.hpp:361
#3  duckdb::VectorStringToMap::StringToNestedTypeCastLoop (source_data=source_data@entry=0xaaaaea550280, source_mask=..., result=..., result_mask=..., count=count@entry=1, 
    parameters=..., sel=sel@entry=0x0) at /home/duckdb/duckdb/src/function/cast/string_cast.cpp:345
#4  0x0000aaaadc216dec in duckdb::StringToNestedTypeCast<duckdb::VectorStringToMap> (count=<optimized out>, parameters=..., result=..., source=...)
    at ../../src/include/duckdb/common/types/vector.hpp:362
#5  duckdb::StringToNestedTypeCast<duckdb::VectorStringToMap> (source=..., result=..., count=<optimized out>, parameters=...)
    at /home/duckdb/duckdb/src/function/cast/string_cast.cpp:440
#6  0x0000aaaadbb54350 in duckdb::ExpressionExecutor::Execute (this=this@entry=0xffffe54a2a60, expr=..., state=state@entry=0xaaaaea54b980, sel=sel@entry=0x0, 
    count=count@entry=1, result=...) at /home/duckdb/duckdb/src/execution/expression_executor/execute_cast.cpp:42
#7  0x0000aaaadbc83f48 in duckdb::ExpressionExecutor::Execute (this=this@entry=0xffffe54a2a60, expr=..., state=0xaaaaea54b980, sel=sel@entry=0x0, count=count@entry=1, 
    result=...) at /home/duckdb/duckdb/src/execution/expression_executor.cpp:205
#8  0x0000aaaadbb567f4 in duckdb::ExpressionExecutor::Select (this=0xffffe54a2a60, expr=..., state=<optimized out>, sel=0x0, count=1, true_sel=0xaaaaea530380, 
    false_sel=0xaaaaea530398) at /usr/include/c++/9/bits/unique_ptr.h:360
#9  0x0000aaaadbc849c0 in duckdb::ExpressionExecutor::Select (false_sel=0xaaaaea530380, true_sel=0xaaaaea530380, count=1, sel=0x0, state=<optimized out>, expr=..., 
    this=0xffffe54a2a60) at ../../src/include/duckdb/parser/base_expression.hpp:98
#10 duckdb::ExpressionExecutor::Select (this=this@entry=0xffffe54a2a60, expr=..., state=<optimized out>, sel=sel@entry=0x0, count=count@entry=1, 
    true_sel=true_sel@entry=0xaaaaea530380, false_sel=false_sel@entry=0xaaaaea530398) at /home/duckdb/duckdb/src/execution/expression_executor.cpp:231
#11 0x0000aaaadbb57224 in duckdb::ExpressionExecutor::Execute (this=this@entry=0xffffe54a2a60, expr=..., state_p=state_p@entry=0xaaaaea5302d0, sel=sel@entry=0x0, 
    count=count@entry=1, result=...) at ../../src/include/duckdb/common/unique_ptr.hpp:20
#12 0x0000aaaadbc83fa8 in duckdb::ExpressionExecutor::Execute (this=0xffffe54a2a60, expr=..., state=0xaaaaea5302d0, sel=sel@entry=0x0, count=1, result=...)
    at /home/duckdb/duckdb/src/execution/expression_executor.cpp:202
#13 0x0000aaaadbc89518 in duckdb::ExpressionExecutor::ExecuteExpression (this=this@entry=0xffffe54a2a60, expr_idx=expr_idx@entry=0, result=...)
    at ../../src/include/duckdb/common/types/data_chunk.hpp:54
#14 0x0000aaaadbc896bc in duckdb::ExpressionExecutor::ExecuteExpression (this=this@entry=0xffffe54a2a60, result=...)
    at /home/duckdb/duckdb/src/execution/expression_executor.cpp:96
#15 0x0000aaaadbc89750 in duckdb::ExpressionExecutor::EvaluateScalar (context=..., expr=..., allow_unfoldable=allow_unfoldable@entry=false)
    at /home/duckdb/duckdb/src/execution/expression_executor.cpp:112
#16 0x0000aaaadbc899c8 in duckdb::ExpressionExecutor::TryEvaluateScalar (context=..., expr=..., result=...) at /home/duckdb/duckdb/src/execution/expression_executor.cpp:122
#17 0x0000aaaadbf5f2fc in duckdb::ConstantFoldingRule::Apply (this=0xaaaaea2f66c0, op=..., bindings=..., changes_made=<optimized out>, is_root=<optimized out>)
    at /home/duckdb/duckdb/src/optimizer/rule/constant_folding.cpp:36
#18 0x0000aaaadbf6ec40 in duckdb::ExpressionRewriter::ApplyRules (op=..., rules=..., expr=..., changes_made=@0xffffe54a2da7: false, is_root=is_root@entry=true)
    at /home/duckdb/duckdb/src/optimizer/expression_rewriter.cpp:20
#19 0x0000aaaadbf6f0a8 in duckdb::ExpressionRewriter::VisitExpression (this=0xffffe54a32f8, expression=0xaaaaea52eec0) at /usr/include/c++/9/bits/move.h:74
#20 0x0000aaaadc0657b8 in std::function<void (duckdb::unique_ptr<duckdb::Expression, std::default_delete<duckdb::Expression>, true>*)>::operator()(duckdb::unique_ptr<duckdb::Expression, std::default_delete<duckdb::Expression>, true>*) const (__args#0=<optimized out>, this=0xffffe54a2ed8) at /usr/include/c++/9/bits/std_function.h:683
#21 duckdb::LogicalOperatorVisitor::EnumerateExpressions(duckdb::LogicalOperator&, std::function<void (duckdb::unique_ptr<duckdb::Expression, std::default_delete<duckdb::Expression>, true>*)> const&) (op=..., callback=...) at /home/duckdb/duckdb/src/planner/logical_operator_visitor.cpp:175
#22 0x0000aaaadc065b7c in duckdb::LogicalOperatorVisitor::VisitOperatorExpressions (this=this@entry=0xffffe54a32f8, op=...) at /usr/include/c++/9/new:174
#23 0x0000aaaadbf6b8c8 in duckdb::ExpressionRewriter::VisitOperator (this=0xffffe54a32f8, op=...) at /home/duckdb/duckdb/src/optimizer/expression_rewriter.cpp:68
#24 0x0000aaaadc07341c in duckdb::LogicalOperatorVisitor::VisitOperatorChildren (op=..., this=0xffffe54a32f8) at ../../src/include/duckdb/common/unique_ptr.hpp:20
#25 duckdb::LogicalOperatorVisitor::VisitOperatorChildren (this=this@entry=0xffffe54a32f8, op=...) at /home/duckdb/duckdb/src/planner/logical_operator_visitor.cpp:14
#26 0x0000aaaadbf6b788 in duckdb::ExpressionRewriter::VisitOperator (this=0xffffe54a32f8, op=...) at /home/duckdb/duckdb/src/optimizer/expression_rewriter.cpp:60
#27 0x0000aaaadbf6ba34 in duckdb::Optimizer::<lambda()>::operator() (__closure=<optimized out>) at ../../src/include/duckdb/common/unique_ptr.hpp:20
#28 std::_Function_handler<void(), duckdb::Optimizer::RunBuiltInOptimizers()::<lambda()> >::_M_invoke(const std::_Any_data &) (__functor=...)
    at /usr/include/c++/9/bits/std_function.h:300
#29 0x0000aaaadbf6c624 in std::function<void ()>::operator()() const (this=0xffffe54a31a8) at /usr/include/c++/9/bits/std_function.h:683
#30 duckdb::Optimizer::RunOptimizer(duckdb::OptimizerType, std::function<void ()> const&) (callback=..., type=duckdb::OptimizerType::EXPRESSION_REWRITER, 
    this=0xffffe54a32e8) at /home/duckdb/duckdb/src/optimizer/optimizer.cpp:80
#31 duckdb::Optimizer::RunOptimizer(duckdb::OptimizerType, std::function<void ()> const&) (this=0xffffe54a32e8, type=duckdb::OptimizerType::EXPRESSION_REWRITER, 
    callback=...) at /home/duckdb/duckdb/src/optimizer/optimizer.cpp:73
#32 0x0000aaaadbf6dc78 in duckdb::Optimizer::RunBuiltInOptimizers (this=this@entry=0xffffe54a32e8) at /usr/include/c++/9/new:174
#33 0x0000aaaadbf6e6b0 in duckdb::Optimizer::Optimize (this=this@entry=0xffffe54a32e8, plan_p=...) at /home/duckdb/duckdb/src/optimizer/optimizer.cpp:253
#34 0x0000aaaadbd75a50 in duckdb::ClientContext::CreatePreparedStatementInternal (this=this@entry=0xaaaaea3954e0, lock=..., 
    query="SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ 'any_string' IN ? : ] THEN TRUE END ;", statement=..., values=values@entry=...) at /usr/include/c++/9/bits/move.h:74
#35 0x0000aaaadbd76108 in duckdb::ClientContext::CreatePreparedStatement (this=this@entry=0xaaaaea3954e0, lock=..., 
    query="SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ 'any_string' IN ? : ] THEN TRUE END ;", statement=..., values=..., 
    mode=mode@entry=duckdb::PreparedStatementMode::PREPARE_ONLY) at /usr/include/c++/9/bits/move.h:74
#36 0x0000aaaadbd76550 in duckdb::ClientContext::RebindPreparedStatement (this=this@entry=0xaaaaea3954e0, lock=..., 
    query="SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ 'any_string' IN ? : ] THEN TRUE END ;", prepared=..., parameters=...) at /usr/include/c++/9/bits/unique_ptr.h:360
#37 0x0000aaaadbd777b8 in duckdb::ClientContext::PendingPreparedStatement (this=this@entry=0xaaaaea3954e0, lock=..., 
    query="SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ 'any_string' IN ? : ] THEN TRUE END ;", prepared=..., parameters=...)
    at /home/duckdb/duckdb/src/main/client_context.cpp:544
#38 0x0000aaaadbd7802c in duckdb::ClientContext::PendingStatementOrPreparedStatement (this=this@entry=0xaaaaea3954e0, lock=..., 
    query="SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ 'any_string' IN ? : ] THEN TRUE END ;", statement=..., prepared=..., parameters=...)
    at /usr/include/c++/9/ext/atomicity.h:96
#39 0x0000aaaadbd79400 in duckdb::ClientContext::PendingStatementOrPreparedStatementInternal (this=this@entry=0xaaaaea3954e0, lock=..., 
    query="SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ 'any_string' IN ? : ] THEN TRUE END ;", statement=..., prepared=..., parameters=...)
    at /usr/include/c++/9/bits/move.h:74
#40 0x0000aaaadbd79724 in duckdb::ClientContext::PendingQueryPreparedInternal (this=this@entry=0xaaaaea3954e0, lock=..., 
    query="SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ 'any_string' IN ? : ] THEN TRUE END ;", prepared=..., parameters=...) at /usr/include/c++/9/tuple:918
#41 0x0000aaaadbd79864 in duckdb::ClientContext::PendingQuery (this=this@entry=0xaaaaea3954e0, 
    query="SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ 'any_string' IN ? : ] THEN TRUE END ;", prepared=..., parameters=...)
    at ../../src/include/duckdb/common/unique_ptr.hpp:20
#42 0x0000aaaadbd79a80 in duckdb::PreparedStatement::PendingQuery (this=this@entry=0xaaaaea379bf0, named_values=std::unordered_map with 1 element = {...}, 
    allow_stream_result=allow_stream_result@entry=false) at ../../src/include/duckdb/common/shared_ptr_ipp.hpp:204
#43 0x0000aaaadbd79fa4 in duckdb::PreparedStatement::PendingQuery (this=0xaaaaea379bf0, values=..., allow_stream_result=allow_stream_result@entry=false)
    at /home/duckdb/duckdb/src/main/prepared_statement.cpp:94
#44 0x0000aaaadbd7a210 in duckdb::PreparedStatement::Execute (this=<optimized out>, values=..., allow_stream_result=allow_stream_result@entry=false)
    at /home/duckdb/duckdb/src/main/prepared_statement.cpp:81
#45 0x0000aaaadb8a55fc in duckdb_shell_sqlite3_print_duckbox (pStmt=0xaaaaea52ac70, max_rows=40, max_width=0, null_value=0xffffe54a4948 "NULL", columnar=0, 
    thousand_separator=0 '\000', decimal_separator=0 '\000', result_renderer=0xffffe54a4530) at ../../src/include/duckdb/common/unique_ptr.hpp:39
#46 0x0000aaaadb895dfc in duckdb_shell::ShellState::ExecutePreparedStatement (this=0xffffe54a4840, pStmt=0xaaaaea52ac70) at /usr/include/c++/9/bits/basic_string.h:2304
#47 0x0000aaaadb896384 in duckdb_shell::ShellState::ExecuteSQL (this=0xffffe54a4840, 
    zSql=0xaaaaea2f2f10 "SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ 'any_string' IN ? : ] THEN TRUE END ;", pzErrMsg=0xffffe54a4660) at ../../tools/shell/shell.cpp:1788
#48 0x0000aaaadb896c74 in duckdb_shell::ShellState::RunOneSqlLine (this=0xffffe54a4840, 
    zSql=0xaaaaea2f2f10 "SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ 'any_string' IN ? : ] THEN TRUE END ;") at ../../tools/shell/shell.cpp:4318
#49 0x0000aaaadb897298 in duckdb_shell::ShellState::ProcessInput (this=0xffffe54a4840) at ../../tools/shell/shell.cpp:4433
#50 0x0000aaaadb87bd9c in main (argc=<optimized out>, argv=0xffffe54a4b28) at ../../tools/shell/shell.cpp:5032
```

### To Reproduce

1. Clone the DuckDB Git from the official repo.
2. Checkout to the latest main (v1.1.4-dev2317 a4963a5aea).
3. Compile the DuckDB binary by using `CORE_EXTENSIONS='autocomplete;httpfs;icu;parquet;json' GEN=ninja make debug`.
4. Run the compiled DuckDB and input the following SQL:

```sql
SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ 'any_string' IN ? : ] THEN TRUE END ;
```

### OS:

Ubuntu 24.04.01 LTS (x86-64 & aarch64)

### DuckDB Version:

v1.1.3 19864453f7 and v1.1.4-dev2317 a4963a5aea

### DuckDB Client:

cli

### Hardware:

_No response_

### Full Name:

Yu Liang

### Affiliation:

The Pennsylvania State University

### What is the latest build you tested with? If possible, we recommend testing with the latest nightly build.

I have tested with a stable release

### Did you include all relevant data sets for reproducing the issue?

Yes

### Did you include all code required to reproduce the issue?

- [X] Yes, I have

### Did you include all relevant configuration (e.g., CPU architecture, Python version, Linux distribution) to reproduce the issue?

- [X] Yes, I have


Discussion / hints:
Thanks, we'll take a look and fix this.
Thanks, we'll take a look and fix this.

Fix patch:
diff --git a/src/function/cast/string_cast.cpp b/src/function/cast/string_cast.cpp
index 9f8b5ee29811..f3a19c4273bf 100644
--- a/src/function/cast/string_cast.cpp
+++ b/src/function/cast/string_cast.cpp
@@ -342,8 +342,8 @@ bool VectorStringToMap::StringToNestedTypeCastLoop(const string_t *source_data,
 		vector_cast_data.all_converted = false;
 	}
 
-	auto &key_validity = FlatVector::Validity(result_key_child);
 	if (!vector_cast_data.all_converted) {
+		auto &key_validity = FlatVector::Validity(result_key_child);
 		for (idx_t row_idx = 0; row_idx < count; row_idx++) {
 			if (!result_mask.RowIsValid(row_idx)) {
 				continue;


Test patch:
diff --git a/test/fuzzer/afl/case_map_cast.test b/test/fuzzer/afl/case_map_cast.test
new file mode 100644
index 000000000000..bc95f30a754f
--- /dev/null
+++ b/test/fuzzer/afl/case_map_cast.test
@@ -0,0 +1,7 @@
+# name: test/fuzzer/afl/case_map_cast.test
+# description: Test case with map
+# group: [afl]
+
+query I
+SELECT TRUE WHERE CASE MAP { } WHEN 'abc' [ ('any_string' IN (NULL::VARCHAR)): ] THEN TRUE END ;
+----