executor: Fix a panic when using on duplicate update

[MyonKeminta]

What problem does this PR solve?

Issue Number: close #28078

Problem Summary: When using statements like insert into a select ... from b on duplicate key update a.y = b.y, where b.y is not selected in select ... from b part, sometimes it may panic and reports "slice bounds out of range".

initEvalBuffer4Dup constructs a list of column types (the evalBufferTypes variable), which is expected to match the Schema4OnDuplicate built in function Schema4OnDuplicate. It contains several parts sequentially:

• columns of already-existed rows
• extra columns to select (the implicitly required columns in the on duplicate key update clause)
• columns of new rows to insert

The problem is:

1. When constructing evalBufferTypes, wrong index is used to find the second part (extra columns to select) . The inner select plan contains both explicitly written columns in select clause (which are columns [:actualColLen]), and the implicitly required columns in the on duplicate key update clause (which are columns [actualColLen:]). In function initEvalBuffer4Dup, the actualColLen is exactly e.rowLen.
2. Then it creates a buffer for storing values to be inserted. It's expected to match the third part of evalBufferTypes mentioned above. However wrong index is used again and it didn't count the number of extra columns to the offset.

What is changed and how it works?

Fixed the above two mistakes.

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)
• No code

Side effects

• Performance regression: Consumes more CPU
• Performance regression: Consumes more Memory
• Breaking backward compatibility

Documentation

• Affects user behaviors
• Contains syntax changes
• Contains variable changes
• Contains experimental features
• Changes MySQL compatibility

Release note

Fix a panic that may happen when using `on duplicate key update`.

[ti-chi-bot]

[REVIEW NOTIFICATION]

This pull request has been approved by:

• cfzjywxk
• winoros

To complete the pull request process, please ask the reviewers in the list to review by filling /cc @reviewer in the comment.
After your PR has acquired the required number of LGTMs, you can assign this pull request to the committer in the list by filling /assign @committer in the comment to help you merge this pull request.

The full list of commands accepted by this bot can be found here.

Reviewer can indicate their review by submitting an approval review.
Reviewer can cancel approval by submitting a request changes review.

[cfzjywxk]

LGTM, it seems difficult to maintain the index in a shared buffer, we may record a task to refactor these part in the future. Also as the original information is derived from planner, the variables here become a bit confusing, maybe we could add more comments.

[MyonKeminta]

/run-unit-test

[sre-bot]

Code Coverage Details: https://codecov.io/github/pingcap/tidb/commit/a136badc7c1e3071937eb65a4d9a07f0de0e5bef

[winoros]

/merge

[ti-chi-bot]

This pull request has been accepted and is ready to merge.

Commit hash: 59132e2

[ti-srebot]

cherry pick to release-5.0 in PR #31341

[ti-srebot]

cherry pick to release-5.1 in PR #31342

[ti-srebot]

cherry pick to release-5.2 in PR #31343

[ti-srebot]

cherry pick to release-5.3 in PR #31344

[ti-srebot]

cherry pick to release-5.4 in PR #31345