fix: return error instead of panic on downcast failure in regex kernels

Defense in depth for #22886: `regexp_is_match_flag!` and
`regexp_is_match_flag_scalar!` used `.expect("failed to downcast array")`
on both operands. Any expression path that bypasses the analyzer's type
coercion (e.g. a hand-built plan going straight to physical planning)
would panic instead of returning a DataFusion error. Return `exec_err!`
instead; the fast paths are unchanged.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: u70b3

datafusion/physical-expr/src/expressions/binary.rs

@@ -1279,7 +1279,7 @@ mod tests {
     use crate::expressions::{Column, Literal, col, lit, try_cast};
     use datafusion_expr::lit as expr_lit;
 
-    use datafusion_common::plan_datafusion_err;
+    use datafusion_common::{assert_contains, plan_datafusion_err};
     use datafusion_physical_expr_common::physical_expr::fmt_sql;
 
     use crate::planner::logical2physical;
@@ -3331,6 +3331,33 @@ mod tests {
         Ok(())
     }
 
+    #[test]
+    fn regex_mismatched_array_types_error() -> Result<()> {
+        // The analyzer coerces both operands of a regex operator to a common
+        // string type, but an expression that bypasses it (e.g. constructed
+        // directly) must return an error instead of panicking
+        // (https://github.com/apache/datafusion/issues/22886)
+        let schema = Schema::new(vec![
+            Field::new("a", DataType::Utf8View, true),
+            Field::new("b", DataType::Utf8, true),
+        ]);
+        let a = Arc::new(StringViewArray::from(vec!["user auth failed"])) as ArrayRef;
+        let b = Arc::new(StringArray::from(vec!["(auth|login)"])) as ArrayRef;
+
+        // construct the expression directly, without coercion
+        let expr = binary(
+            col("a", &schema)?,
+            Operator::RegexMatch,
+            col("b", &schema)?,
+            &schema,
+        )?;
+        let batch = RecordBatch::try_new(Arc::new(schema), vec![a, b])?;
+        let err = expr.evaluate(&batch).unwrap_err();
+        assert_contains!(err.to_string(), "failed to downcast array");
+
+        Ok(())
+    }
+
     #[test]
     fn or_with_nulls_op() -> Result<()> {
         let schema = Schema::new(vec![

datafusion/physical-expr/src/expressions/binary/kernels.rs

@@ -27,7 +27,7 @@ use arrow::compute::kernels::boolean::not;
 use arrow::compute::kernels::comparison::{regexp_is_match, regexp_is_match_scalar};
 use arrow::datatypes::DataType;
 use datafusion_common::{Result, ScalarValue};
-use datafusion_common::{internal_err, plan_err};
+use datafusion_common::{exec_err, internal_err, plan_err};
 
 use std::sync::Arc;
 
@@ -162,14 +162,27 @@ create_left_integral_dyn_scalar_kernel!(
 /// Invoke a compute kernel on a pair of binary data arrays with flags
 macro_rules! regexp_is_match_flag {
     ($LEFT:expr, $RIGHT:expr, $ARRAYTYPE:ident, $NOT:expr, $FLAG:expr) => {{
-        let ll = $LEFT
-            .as_any()
-            .downcast_ref::<$ARRAYTYPE>()
-            .expect("failed to downcast array");
-        let rr = $RIGHT
-            .as_any()
-            .downcast_ref::<$ARRAYTYPE>()
-            .expect("failed to downcast array");
+        // The analyzer coerces both operands to a common string type, but
+        // expressions that bypass it may still reach here with mismatched
+        // types, which must surface as an error rather than a panic.
+        let ll = match $LEFT.as_any().downcast_ref::<$ARRAYTYPE>() {
+            Some(ll) => ll,
+            None => {
+                return exec_err!(
+                    "failed to downcast array to {} for operation 'regex_match_dyn'",
+                    stringify!($ARRAYTYPE)
+                );
+            }
+        };
+        let rr = match $RIGHT.as_any().downcast_ref::<$ARRAYTYPE>() {
+            Some(rr) => rr,
+            None => {
+                return exec_err!(
+                    "failed to downcast array to {} for operation 'regex_match_dyn'",
+                    stringify!($ARRAYTYPE)
+                );
+            }
+        };
 
         let flag = if $FLAG {
             Some($ARRAYTYPE::from(vec!["i"; ll.len()]))
@@ -210,10 +223,15 @@ pub(crate) fn regex_match_dyn(
 /// Invoke a compute kernel on a data array and a scalar value with flag
 macro_rules! regexp_is_match_flag_scalar {
     ($LEFT:expr, $RIGHT:expr, $ARRAYTYPE:ident, $NOT:expr, $FLAG:expr) => {{
-        let ll = $LEFT
-            .as_any()
-            .downcast_ref::<$ARRAYTYPE>()
-            .expect("failed to downcast array");
+        let ll = match $LEFT.as_any().downcast_ref::<$ARRAYTYPE>() {
+            Some(ll) => ll,
+            None => {
+                return Some(exec_err!(
+                    "failed to downcast array to {} for operation 'regex_match_dyn_scalar'",
+                    stringify!($ARRAYTYPE)
+                ));
+            }
+        };
 
         if let Some(Some(string_value)) = $RIGHT.try_as_str() {
             let flag = $FLAG.then_some("i");