The function core.(*LogicalProjection).DeriveStats encountered a panic error

[King-Dylan]

Bug Report

The function core.(*LogicalProjection).DeriveStats encountered a panic error.

1. Minimal reproduce step (Required)

SQL> create table t1(id1 varchar(2) DEFAULT '00',id2 varchar(30) NOT NULL ,id3 datetime DEFAULT NULL,id4 varchar(100) NOT NULL DEFAULT 'ecifdata',id5 datetime NOT NULL DEFAULT CURRENT_TIMESTAMP ,id6 int(11) DEFAULT NULL,id7 int(11) DEFAULT NULL,  UNIQUE KEY `UI_id2` (`id2`),  KEY `ix_id1` (`id1`));
SQL> create table t2(id10  varchar(40) NOT NULL ,id2 varchar(30) NOT NULL,  KEY `IX_id2` (`id2`),
PRIMARY KEY (`id10`) /*T![clustered_index] NONCLUSTERED */ );
SQL> create table t3(id20  varchar(40) DEFAULT NULL,  UNIQUE KEY `IX_id20` (`id20`) );
SQL> explain UPDATE t1 a
SET a.id1     = '04',
      a.id3 = CURRENT_TIMESTAMP,
      a.id4      = SUBSTRING_INDEX(USER(), '@', 1),
      a.id5    = CURRENT_TIMESTAMP
WHERE a.id1 = '03'
  AND a.id6 - IFNULL(a.id7, 0) =
      (SELECT COUNT(1)
         FROM t2 b, t3 c
        WHERE b.id10 = c.id20
          AND b.id2 = a.id2
          AND b.id2 in (select rn.id2
                              from t1 rn
                             WHERE rn.id1 = '03'));

2. What did you expect to see? (Required)

No errors

3. What did you see instead (Required)

ERROR 1105 (HY000): runtime error: index out of range [8] with length 8

stack:

[err="runtime error: index out of range [8] with length 8"] [stack="github.com/pingcap/tidb/server.(*clientConn).Run.func1\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/server/conn.go:1090\nruntime.gopanic\n\t/usr/local/go/src/runtime/panic.go:884\ngithub.com/pingcap/tidb/executor.(*Compiler).Compile.func1\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/executor/compiler.go:72\nruntime.gopanic\n\t/usr/local/go/src/runtime/panic.go:884\nruntime.goPanicIndex\n\t/usr/local/go/src/runtime/panic.go:113\ngithub.com/pingcap/tidb/planner/core.(*LogicalProjection).DeriveStats\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/planner/core/stats.go:1101\ngithub.com/pingcap/tidb/planner/core.(*baseLogicalPlan).recursiveDeriveStats\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/planner/core/stats.go:133\ngithub.com/pingcap/tidb/planner/core.(*baseLogicalPlan).recursiveDeriveStats\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/planner/core/stats.go:126\ngithub.com/pingcap/tidb/planner/core.(*baseLogicalPlan).recursiveDeriveStats\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/planner/core/stats.go:126\ngithub.com/pingcap/tidb/planner/core.(*baseLogicalPlan).recursiveDeriveStats\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/planner/core/stats.go:126\ngithub.com/pingcap/tidb/planner/core.(*baseLogicalPlan).recursiveDeriveStats\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/planner/core/stats.go:126\ngithub.com/pingcap/tidb/planner/core.physicalOptimize\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/planner/core/optimizer.go:889\ngithub.com/pingcap/tidb/planner/core.DoOptimize\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/planner/core/optimizer.go:296\ngithub.com/pingcap/tidb/planner/core.(*PlanBuilder).buildUpdate\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/planner/core/logical_plan_builder.go:5479\ngithub.com/pingcap/tidb/planner/core.(*PlanBuilder).Build\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/planner/core/planbuilder.go:808\ngithub.com/pingcap/tidb/planner.buildLogicalPlan\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/planner/optimize.go:461\ngithub.com/pingcap/tidb/planner.optimize\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/planner/optimize.go:382\ngithub.com/pingcap/tidb/planner.Optimize\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/planner/optimize.go:245\ngithub.com/pingcap/tidb/planner/core.(*PlanBuilder).buildExplain\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/planner/core/planbuilder.go:4808\ngithub.com/pingcap/tidb/planner/core.(*PlanBuilder).Build\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/planner/core/planbuilder.go:779\ngithub.com/pingcap/tidb/planner.buildLogicalPlan\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/planner/optimize.go:461\ngithub.com/pingcap/tidb/planner.optimize\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/planner/optimize.go:382\ngithub.com/pingcap/tidb/planner.Optimize\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/planner/optimize.go:245\ngithub.com/pingcap/tidb/executor.(*Compiler).Compile\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/executor/compiler.go:116\ngithub.com/pingcap/tidb/session.(*session).ExecuteStmt\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/session/session.go:2199\ngithub.com/pingcap/tidb/server.(*TiDBContext).ExecuteStmt\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/server/driver_tidb.go:252\ngithub.com/pingcap/tidb/server.(*clientConn).handleStmt\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/server/conn.go:2122\ngithub.com/pingcap/tidb/server.(*clientConn).handleQuery\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/server/conn.go:1972\ngithub.com/pingcap/tidb/server.(*clientConn).dispatch\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/server/conn.go:1403\ngithub.com/pingcap/tidb/server.(*clientConn).Run\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/server/conn.go:1152\ngithub.com/pingcap/tidb/server.(*Server).onConn\n\t/home/jenkins/agent/workspace/build-common/go/src/github.com/pingcap/tidb/server/server.go:648"]

4. What is your TiDB version? (Required)

[King-Dylan]

/assign hi-rustin

[King-Dylan]

Need raise the priority, https://internal.pingcap.net/jira/projects/GTS/issues/GTS-65

[King-Dylan]

@chrysan cc

[Rustin170506]

I will take a look.

[Rustin170506]

Need raise the priority, internal.pingcap.net/jira/projects/GTS/issues/GTS-65

Please do not post the internal-only link on GitHub. Thanks!

[Rustin170506]

The code panic here:

tidb/pkg/planner/core/stats.go

Line 951 in d84e1d2

p.StatsInfo().ColNDVs[selfSchema.Columns[i].UniqueID] = childProfile.RowCount

[Rustin170506]

This LogicalProjection has 8 exprs and only has 7 columns in the schema. So we panic when we get the columns[8].

[Rustin170506]

Through my investigation, I identified several key points:

1. The panic occurs during DeriveStats: p.StatsInfo().ColNDVs[selfSchema.Columns[i].UniqueID] = childProfile.RowCount.
2. There's a discrepancy in the number of expressions and schema columns: the plan has 8 expressions but only 7 columns in the schema.
3. The logic plan causing the panic is a projection (ID 25), generated by the joinReOrderSolver.
4. Post-debugging, I noted that the schema undergoes changes after the LogicalProjection.PruneColumns process.
5. On further debugging the PruneColumns function individually, I discovered that the schema of projection#25 is affected even before it's reached in the process.
6. This led me to suspect a memory issue. Notably, projection#18 and projection#25 appear to share the same schema memory address (0x14006b557c0).
7. Consequently, when a column is pruned from projection#18, projection#25 becomes corrupted, leading to a mismatch between expressions and columns.