Panic triggered at expression.(*CorrelatedColumn).Eval (expression/column.go:88)

[JZuming]

Bug Report

Please answer these questions before submitting your issue. Thanks!

1. Minimal reproduce step (Required)

Setup the database:

CREATE TABLE t0 (c1 double, c2 double);

Testcase

select
  exists (
    select
          subq_2.c0 as c8
        from
          (select
                ref_153.c1 as c0
              from
                t0 as ref_153
              group by ref_153.c1 having 0 <> (
                  select 1
                    from
                      t0 as ref_173
                    where count(ref_153.c2) = avg(ref_153.c2)
                    order by c1 desc limit 1)) as subq_2
     ) as c10;

2. What did you expect to see? (Required)

No panic.

3. What did you see instead (Required)

ERROR 1105 (HY000): runtime error: invalid memory address or nil pointer dereference

TiDB log:

[ERROR] [conn.go:1039] ["connection running loop panic"] [conn=2199023352193] [lastSQL="select  
  exists (
    select  
          subq_2.c0 as c8
        from 
          (select  
                ref_153.c1 as c0 
              from 
                t0 as ref_153
              group by ref_153.c1 having 0 <> ( 
                  select 1 
                    from 
                      t0 as ref_173
                    where count(ref_153.c2) = avg(ref_153.c2)
                    order by c1 desc limit 1)) as subq_2
     ) as c10"] [err="runtime error: invalid memory address or nil pointer dereference"] [stack="github.com/pingcap/tidb/server.(*clientConn).Run.func1
    /root/tidb/server/conn.go:1042
runtime.gopanic
    /usr/local/go/src/runtime/panic.go:884
github.com/pingcap/tidb/executor.(*Compiler).Compile.func1
    /root/tidb/executor/compiler.go:54
runtime.gopanic
    /usr/local/go/src/runtime/panic.go:884
runtime.panicmem
    /usr/local/go/src/runtime/panic.go:260
runtime.sigpanic
    /usr/local/go/src/runtime/signal_unix.go:837
github.com/pingcap/tidb/expression.(*CorrelatedColumn).Eval
    /root/tidb/expression/column.go:88
github.com/pingcap/tidb/expression.PbConverter.conOrCorColToPBExpr
    /root/tidb/expression/expr_to_pb.go:81
github.com/pingcap/tidb/expression.canExprPushDown
    /root/tidb/expression/expression.go:1422
github.com/pingcap/tidb/expression.canScalarFuncPushDown
    /root/tidb/expression/expression.go:1378
github.com/pingcap/tidb/expression.canExprPushDown
    /root/tidb/expression/expression.go:1428
github.com/pingcap/tidb/expression.canScalarFuncPushDown
    /root/tidb/expression/expression.go:1378
github.com/pingcap/tidb/expression.canExprPushDown
    /root/tidb/expression/expression.go:1428
github.com/pingcap/tidb/expression.PushDownExprsWithExtraInfo
    /root/tidb/expression/expression.go:1437
github.com/pingcap/tidb/expression.PushDownExprs
    /root/tidb/expression/expression.go:1448
github.com/pingcap/tidb/planner/core.(*DataSource).PredicatePushDown
    /root/tidb/planner/core/rule_predicate_push_down.go:141
github.com/pingcap/tidb/planner/core.(*LogicalSelection).PredicatePushDown
    /root/tidb/planner/core/rule_predicate_push_down.go:108
github.com/pingcap/tidb/planner/core.(*baseLogicalPlan).PredicatePushDown
    /root/tidb/planner/core/rule_predicate_push_down.go:81
github.com/pingcap/tidb/planner/core.(*LogicalProjection).PredicatePushDown
    /root/tidb/planner/core/rule_predicate_push_down.go:479
github.com/pingcap/tidb/planner/core.(*baseLogicalPlan).PredicatePushDown
    /root/tidb/planner/core/rule_predicate_push_down.go:81
github.com/pingcap/tidb/planner/core.(*baseLogicalPlan).PredicatePushDown
    /root/tidb/planner/core/rule_predicate_push_down.go:81
github.com/pingcap/tidb/planner/core.(*LogicalLimit).PredicatePushDown
    /root/tidb/planner/core/rule_predicate_push_down.go:607
github.com/pingcap/tidb/planner/core.(*baseLogicalPlan).PredicatePushDown
    /root/tidb/planner/core/rule_predicate_push_down.go:81
github.com/pingcap/tidb/planner/core.(*LogicalMaxOneRow).PredicatePushDown
    /root/tidb/planner/core/rule_predicate_push_down.go:614
github.com/pingcap/tidb/planner/core.(*LogicalJoin).PredicatePushDown
    /root/tidb/planner/core/rule_predicate_push_down.go:239
github.com/pingcap/tidb/planner/core.(*LogicalSelection).PredicatePushDown
    /root/tidb/planner/core/rule_predicate_push_down.go:108
github.com/pingcap/tidb/planner/core.(*LogicalJoin).PredicatePushDown
    /root/tidb/planner/core/rule_predicate_push_down.go:239
github.com/pingcap/tidb/planner/core.(*baseLogicalPlan).PredicatePushDown
    /root/tidb/planner/core/rule_predicate_push_down.go:81
github.com/pingcap/tidb/planner/core.(*LogicalProjection).PredicatePushDown
    /root/tidb/planner/core/rule_predicate_push_down.go:479
github.com/pingcap/tidb/planner/core.(*ppdSolver).optimize
    /root/tidb/planner/core/rule_predicate_push_down.go:46
github.com/pingcap/tidb/planner/core.logicalOptimize
    /root/tidb/planner/core/optimizer.go:1093
github.com/pingcap/tidb/planner/core.DoOptimize
    /root/tidb/planner/core/optimizer.go:294
github.com/pingcap/tidb/planner.optimize
    /root/tidb/planner/optimize.go:467
github.com/pingcap/tidb/planner.Optimize
    /root/tidb/planner/optimize.go:295
github.com/pingcap/tidb/executor.(*Compiler).Compile
    /root/tidb/executor/compiler.go:98
github.com/pingcap/tidb/session.(*session).ExecuteStmt
    /root/tidb/session/session.go:2139
github.com/pingcap/tidb/server.(*TiDBContext).ExecuteStmt
    /root/tidb/server/driver_tidb.go:252
github.com/pingcap/tidb/server.(*clientConn).handleStmt
    /root/tidb/server/conn.go:2054
github.com/pingcap/tidb/server.(*clientConn).handleQuery
    /root/tidb/server/conn.go:1851
github.com/pingcap/tidb/server.(*clientConn).dispatch
    /root/tidb/server/conn.go:1337
github.com/pingcap/tidb/server.(*clientConn).Run
    /root/tidb/server/conn.go:1120
github.com/pingcap/tidb/server.(*Server).onConn
    /root/tidb/server/server.go:675"]

4. What is your TiDB version? (Required)

+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Release Version: v7.1.0-alpha-27-gf5ca27ef3
Edition: Community
Git Commit Hash: f5ca27e
Git Branch: master
UTC Build Time: 2023-03-23 13:57:53
GoVersion: go1.20.2
Race Enabled: false
TiKV Min Version: 6.2.0-alpha
Check Table Before Drop: false
Store: unistore |
+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+