Cherry pick 3.5 (0516-0522) (#5559)

Fix crash double free of expr. (#5557)

* Fix crash double free of expr.

* Change issue id.

Co-authored-by: shylock <[email protected]>

src/parser/parser.yy

@@ -1801,12 +1801,10 @@ match_node
         $$ = new MatchNode();
     }
     | parenthesized_expression {
-        auto& e = $1;
-        if (e->kind() != Expression::Kind::kLabel) {
-            delete $1;
+        if ($1->kind() != Expression::Kind::kLabel) {
             throw nebula::GraphParser::syntax_error(@1, "Invalid node pattern");
         }
-        $$ = new MatchNode(static_cast<LabelExpression*>(e)->name(), nullptr, nullptr);
+        $$ = new MatchNode(static_cast<LabelExpression*>($1)->name(), nullptr, nullptr);
     }
     | L_PAREN match_alias match_node_label_list R_PAREN {
         $$ = new MatchNode(*$2, $3, nullptr);

tests/tck/features/bugfix/SyntaxErrorCrash.feature

@@ -0,0 +1,32 @@
+# Copyright (c) 2023 vesoft inc. All rights reserved.
+#
+# This source code is licensed under Apache 2.0 License.
+# #5558
+Feature: Test crash double delete expr
+
+  Background:
+    Given a graph with space named "nba"
+
+  Scenario: crash double delete expr
+    When executing query:
+      """
+      match (v.player) return v;
+      """
+    Then a SyntaxError should be raised at runtime:  Invalid node pattern near `(v.player)'
+    When executing query:
+      """
+      match (v.player) return v;
+      """
+    Then a SyntaxError should be raised at runtime:  Invalid node pattern near `(v.player)'
+    When executing query:
+      """
+      match (v.player) return v;
+      """
+    Then a SyntaxError should be raised at runtime:  Invalid node pattern near `(v.player)'
+    When executing query:
+      """
+      return 1;
+      """
+    Then the result should be, in any order:
+      | 1 |
+      | 1 |