tiflash crash when query sql

[aytrack]

Bug Report

Please answer these questions before submitting your issue. Thanks!

1. Minimal reproduce step (Required)

drop table if exists IDT_MULTI15674STROBJSTROBJ;
CREATE TABLE `IDT_MULTI15674STROBJSTROBJ` (
  `COL1` enum('^YSQT0]V@9TFN>^WB6G?NG@S8>VYOM;BSC@<BCQ6','T\NKZQQ=C1@IH9W>64=ZISGS?O[JDFBI5M]QXJYQNSKU>NGAWLXS26LMTZ2YNN`XKIUGKY0IHDWV>E[BJJCABOKH1M^CB5E@DLS7Q88PWZTEAY]1ZQMN5NX[I<KBBK','PXWTHJ?R]P=`Y','OFJHCEKCQGT:MXI7P3[YO4N0DF=2XJWJ4Z9Z;HQ8TMUTZV8YLQAHWJ4BDZHR3A','@[ETQPEKKDD;9INXAQISU0O65J86AWQ2SZ8=ZZW6TKT4GCF_O13QW_S>FIYA983K:E4N77@FINM5HVGQCUCVNF5WLOOOEORAM=_JLMVFURMUASTVDBE','NL3V:J9LM4U5KUCV<RIJ_RKMZ4;CXD_0:K`HCO=P1YNYTHX8KYZRQ?PL01HLNSUC_R7:I5<V[HV0BIDEBZAPT73R7`DP43XXPLQCEI8>R;P','M5=T5FLQEZMPZAXH]4G:TSYYYVQ7O@4S6C3N8WPFKSP;SRD6VW@94BBH8XCT','P]I52Y46F?@RMOOF6;FWDTO`7FIT]R:]ELHD[CNLDSHC7FPBYOOJXLZSBV^5C^AAF6J5BCKE4V9==@H=4C]GMZXPNM','ECIQWH>?MK=ARGI0WVJNIBZFCFVJHFIUYJ:2?2WWZBNBWTPFNQPLLBFP9R_','E<<T9UUF2?XM8TWS_','W[5E_U1J?YSOQISL1KD','M@V^`^8I','5UTEJUZIQJOJU_D6@V2DSVOIK@LUT^E?RTL>_Y9OT@SOPYR72VIJVMBWIVPF@TTBZ@8ZPBZL=LXZF`WM4V2?K>AT','PZ@PR6XN28JL`B','ZOHBSCRMZPOI`IVTSEZAIDAF7DS@1TT20AP9','QLDIOY[Y:JZR@OL__I^@FBO=O_?WOOR:2BE:QJC','BI^TGJ_N<H:7OW8XXITM@FBWDNJ=KA`X:9@BUY4UHKSHFP`EAWR9_QS^HR2AI39MGVXWVD]RUI46SHU=GXAX;RT765X:CU7M4XOD^S9JFZI=HTTS?C0CT','M@HGGFM43C7','@M`IHSJQ8HBTGOS`=VW]QBMLVWN`SP;E>EEXYKV1POHTOJQPGCPVR=TYZMGWABUQR07J8U::W4','N`ZN4P@9T[JW;FR6=FA4WP@APNPG[XQVIK4]F]2>EC>JEIOXC``;;?OHP') DEFAULT NULL,
  `COL2` bit(41) DEFAULT NULL,
  `COL3` datetime DEFAULT NULL,
  KEY `U_M_COL4` (`COL1`,`COL2`) /*!80000 INVISIBLE */,
  KEY `U_M_COL5` (`COL3`,`COL2`) /*!80000 INVISIBLE */
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin;
INSERT INTO `IDT_MULTI15674STROBJSTROBJ` VALUES
('^YSQT0]V@9TFN>^WB6G?NG@S8>VYOM;BSC@<BCQ6',x'00f5eb3d03f9','3585-06-21 04:48:31');

alter table IDT_MULTI15674STROBJSTROBJ set tiflash replica 1;
set tidb_isolation_read_engines = 'tiflash';
select sleep(10);
select/*+ use_index_merge(t_alias) */ count(col1) from IDT_MULTI15674STROBJSTROBJ t_alias where (col3 between "0059-08-03 10:04:59" and "0059-08-03 10:04:59" or col2 in (0x3434333732313031393739, 0x3434333732313031393739, 0x3434333732313031393739)) or col2 <= 0x3434333732313031393739 ;

2. What did you expect to see? (Required)

query success

3. What did you see instead (Required)

tiflash crash

2024/03/05 11:44:23.480 +01:00] [ERROR] [BaseDaemon.cpp:376] [########################################] [source=BaseDaemon] [thread_id=1408]
[2024/03/05 11:44:23.480 +01:00] [ERROR] [BaseDaemon.cpp:377] ["(from thread 1407) Received signal Segmentation fault(11)."] [source=BaseDaemon] [thread_id=1408]
[2024/03/05 11:44:23.480 +01:00] [ERROR] [BaseDaemon.cpp:407] ["Address: 0x1"] [source=BaseDaemon] [thread_id=1408]
[2024/03/05 11:44:23.480 +01:00] [ERROR] [BaseDaemon.cpp:413] ["Access: read."] [source=BaseDaemon] [thread_id=1408]
[2024/03/05 11:44:23.480 +01:00] [ERROR] [BaseDaemon.cpp:422] ["Address not mapped to object."] [source=BaseDaemon] [thread_id=1408]
[2024/03/05 11:44:24.868 +01:00] [DEBUG] [SchemaSyncService.cpp:113] ["add sync schema task for keyspaces done, num_add_tasks=0"] [thread_id=1401]
[2024/03/05 11:44:24.868 +01:00] [DEBUG] [SchemaSyncService.cpp:142] ["remove sync schema task for keyspaces done, num_remove_tasks=0"] [thread_id=1401]
[2024/03/05 11:44:28.725 +01:00] [ERROR] [BaseDaemon.cpp:569] ["
       0x756bfb1	faultSignalHandler(int, siginfo_t*, void*) [tiflash+123125681]
                	libs/libdaemon/src/BaseDaemon.cpp:220
  0x7f1091fe7cf0	<unknown symbol> [libpthread.so.0+77040]
       0x871f4b6	memcpy [tiflash+141685942]
                	libs/libmemcpy/memcpy.cpp:23
       0x1c77b8b	DB::WriteBuffer::write(char const*, unsigned long) [tiflash+29850507]
                	dbms/src/IO/WriteBuffer.h:93
       0x814b334	DB::flashColToArrowCol(DB::TiDBColumn&, DB::ColumnWithTypeAndName const&, tipb::FieldType const&, unsigned long, unsigned long) [tiflash+135574324]
                	dbms/src/Flash/Coprocessor/ArrowColCodec.cpp:401
       0x8147309	DB::ArrowChunkCodecStream::encode(DB::Block const&, unsigned long, unsigned long) [tiflash+135557897]
                	dbms/src/Flash/Coprocessor/ArrowChunkCodec.cpp:44
       0x827beb4	DB::UnaryDAGResponseWriter::write(DB::Block const&) [tiflash+136822452]
                	dbms/src/Flash/Coprocessor/UnaryDAGResponseWriter.cpp:114
       0x82e8d6c	DB::DataStreamExecutor::execute(DB::ResultHandler&&) [tiflash+137268588]
                	dbms/src/Flash/Executor/DataStreamExecutor.cpp:50
       0x82ef8c9	DB::QueryExecutor::execute(std::__1::function<void (DB::Block const&)>) [tiflash+137296073]
                	dbms/src/Flash/Executor/QueryExecutor.cpp:27
       0x816c440	DB::DAGDriver<false>::execute() [tiflash+135709760]
                	dbms/src/Flash/Coprocessor/DAGDriver.cpp:112
       0x8115658	DB::CoprocessorHandler::execute() [tiflash+135353944]
                	dbms/src/Flash/CoprocessorHandler.cpp:122
       0x813b2b3	std::__1::__function::__func<DB::FlashService::Coprocessor(grpc::ServerContext*, coprocessor::Request const*, coprocessor::Response*)::$_6, std::__1::allocator<DB::FlashService::Coprocessor(grpc::ServerContext*, coprocessor::Request const*, coprocessor::Response*)::$_6>, grpc::Status ()>::operator()() [tiflash+135508659]
                	/usr/local/bin/../include/c++/v1/__functional/function.h:345
       0x8139ec8	std::__1::__packaged_task_func<std::__1::function<grpc::Status ()>, std::__1::allocator<std::__1::function<grpc::Status ()> >, grpc::Status ()>::operator()() [tiflash+135503560]
                	/usr/local/bin/../include/c++/v1/future:1687
       0x813a085	std::__1::packaged_task<grpc::Status ()>::operator()() [tiflash+135504005]
                	/usr/local/bin/../include/c++/v1/future:1960
       0x86a9484	void* std::__1::__thread_proxy<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, legacy::ThreadPool::ThreadPool(unsigned long, std::__1::function<void ()>)::$_0> >(void*) [tiflash+141202564]
                	/usr/local/bin/../include/c++/v1/thread:291
  0x7f1091fdd1ca	start_thread [libpthread.so.0+33226]"] [source=BaseDaemon] [thread_id=1408]

4. What is your TiFlash version? (Required)

v7.1.4

[windtalker]

Should be duplicated with #8674

[lilinghai]

fixed by #8767