Parameterized query causes storaged crash

[Aiee]

Please check the FAQ documentation before raising an issue

Describe the bug (required)

Your Environments (required)

• OS: uname -a
• Compiler: g++ --version or clang++ --version
• CPU: lscpu
• Commit id master branch

How To Reproduce(required)

Steps to reproduce the behavior:
schema:

"CREATE SPACE IF NOT EXISTS test_data(vid_type = FIXED_STRING(30));" +
		"USE test_data; " +
		"CREATE TAG IF NOT EXISTS person(name string, age int8, grade int16, " +
		"friends int32, book_num int64, birthday datetime, " +
		"start_school date, morning time, property double, " +
		"is_girl bool, child_name fixed_string(10), expend float, " +
		"first_out_city timestamp, hobby string); " +
		"CREATE TAG IF NOT EXISTS student(name string, interval duration); " +
		"CREATE EDGE IF NOT EXISTS like(likeness double); " +
		"CREATE EDGE IF NOT EXISTS friend(start_Datetime datetime, end_Datetime datetime); " +
		"CREATE TAG INDEX IF NOT EXISTS person_name_index ON person(name(8));"

"INSERT VERTEX person(name, age, grade, friends, book_num," +
		"birthday, start_school, morning, property," +
		"is_girl, child_name, expend, first_out_city) VALUES" +
		"'Bob':('Bob', 10, 3, 10, 100, datetime('2010-09-10T10:08:02')," +
		"date('2017-09-10'), time('07:10:00'), " +
		"1000.0, false, \"Hello World!\", 100.0, 1111)," +
		"'Lily':('Lily', 9, 3, 10, 100, datetime('2010-09-10T10:08:02'), " +
		"date('2017-09-10'), time('07:10:00'), " +
		"1000.0, false, \"Hello World!\", 100.0, 1111)," +
		"'Tom':('Tom', 10, 3, 10, 100, datetime('2010-09-10T10:08:02'), " +
		"date('2017-09-10'), time('07:10:00'), " +
		"1000.0, false, \"Hello World!\", 100.0, 1111)," +
		"'Jerry':('Jerry', 9, 3, 10, 100, datetime('2010-09-10T10:08:02')," +
		"date('2017-09-10'), time('07:10:00'), " +
		"1000.0, false, \"Hello World!\", 100.0, 1111), " +
		"'John':('John', 10, 3, 10, 100, datetime('2010-09-10T10:08:02'), " +
		"date('2017-09-10'), time('07:10:00'), " +
		"1000.0, false, \"Hello World!\", 100.0, 1111)"

"INSERT VERTEX student(name, interval) VALUES " +
  "'Bob':('Bob', duration({months:1, seconds:100, microseconds:20})), 'Lily':('Lily', duration({years: 1, seconds: 0})), " +
   "'Tom':('Tom', duration({years: 1, seconds: 0})), 'Jerry':('Jerry', duration({years: 1, seconds: 0})), 'John':('John', duration({years: 1, seconds: 0}))"

"INSERT EDGE like(likeness) VALUES " +
"'Bob'->'Lily':(80.0), " +
"'Bob'->'Tom':(70.0), " +
"'Jerry'->'Lily':(84.0)," +
"'Tom'->'Jerry':(68.3), " +
"'Bob'->'John':(97.2)"

"INSERT EDGE friend(start_Datetime, end_Datetime) VALUES " +
	"'Bob'->'Lily':(datetime('2008-09-10T10:08:02'), datetime('2010-09-10T10:08:02')), " +
	"'Bob'->'Tom':(datetime('2008-09-10T10:08:02'), datetime('2010-09-10T10:08:02')), " +
	"'Jerry'->'Lily':(datetime('2008-09-10T10:08:02'), datetime('2010-09-10T10:08:02')), " +
	"'Tom'->'Jerry':(datetime('2008-09-10T10:08:02'), datetime('2010-09-10T10:08:02')), " +
	"'Bob'->'John':(datetime('2008-09-10T10:08:02'), datetime('2010-09-10T10:08:02'))"

console commands

:param p1 => true;
:param p2 => 3;
:param p3 => [true,3];
:param p4 => {"a": true, "b": "Bob"}

MATCH (v:person {name: $p4.b}) WHERE v.person.age>$p2-3 and $p1==true RETURN v ORDER BY $p3[0] LIMIT $p2

Storage log:

I20221115 16:13:03.795331 2759267 MetaClient.cpp:3108] Load leader of "127.0.0.1":39735 in 7 space
I20221115 16:13:03.795367 2759267 MetaClient.cpp:3114] Load leader ok
I20221115 16:13:25.889154 2765210 LookupProcessor.cpp:173] 1
I20221115 16:13:25.889180 2765210 LookupProcessor.cpp:174] 0x7fc575609848
I20221115 16:13:25.889184 2765210 LookupProcessor.cpp:175] {"index_id":42,"filter":"HgIAAAAAAAAACyMAAAAAAAAAAAYAAAAAAAAAcGVyc29uBAAAAAAAAABuYW1lGwDcGwKMAWJYA0JvYgABYSEAAAAAWAFiAA8jAAAAAAAAAAAGAAAAAAAAAHBlcnNvbgMAAAAAAAAAYWdlADYAAA","column_hints":[{"column_name":"bmFtZQ","scan_type":1,"begin_value":{"sVal":"Qm9i"},"end_value":{},"include_begin":true,"include_end":false}]}
E20221115 16:13:25.889317 2765210 Serializer.h:43] Thrift serialization is only defined for structs and unions, not containers thereof. Attemping to deserialize a value of type `nebula::Value`.
F20221115 16:13:25.889621 2765210 ExprVisitorBase.h:71] Unexpect expression kind 27 at storage

storage coredump

Program terminated with signal SIGABRT, Aborted.
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50	../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
[Current thread is 1 (Thread 0x7fc5427f5700 (LWP 2765210))]
(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007fc58319b859 in __GI_abort () at abort.c:79
#2  0x000000000565b7ba in google::LogMessage::Fail() ()
#3  0x000000000565e8b4 in google::LogMessage::SendToLog() ()
#4  0x000000000565b289 in google::LogMessage::Flush() ()
#5  0x000000000565ef69 in google::LogMessageFatal::~LogMessageFatal() ()
#6  0x00000000034012f8 in nebula::storage::ExprVisitorBase::fatal (this=0x7fc5427eafd0, expr=0x7fc53e630380) at /home/yichen.wang/Workspace/nebula/src/storage/ExprVisitorBase.h:71
#7  0x000000000340151f in nebula::storage::ExprVisitorBase::visit (this=0x7fc5427eafd0, expr=0x7fc53e630380) at /home/yichen.wang/Workspace/nebula/src/storage/ExprVisitorBase.cpp:37
#8  0x0000000004a1c4c2 in nebula::AttributeExpression::accept (this=0x7fc53e630380, visitor=0x7fc5427eafd0) at /home/yichen.wang/Workspace/nebula/src/common/expression/AttributeExpression.cpp:73
#9  0x0000000003401498 in nebula::storage::ExprVisitorBase::visit (this=0x7fc5427eafd0, expr=0x7fc53e630450) at /home/yichen.wang/Workspace/nebula/src/storage/ExprVisitorBase.cpp:30
#10 0x0000000004a08d3c in nebula::RelationalExpression::accept (this=0x7fc53e630450, visitor=0x7fc5427eafd0) at /home/yichen.wang/Workspace/nebula/src/common/expression/RelationalExpression.cpp:260
#11 0x00000000034015bd in nebula::storage::ExprVisitorBase::visit (this=0x7fc5427eafd0, expr=0x7fc53e6302d0) at /home/yichen.wang/Workspace/nebula/src/storage/ExprVisitorBase.cpp:41
#12 0x0000000004a0b30e in nebula::LogicalExpression::accept (this=0x7fc53e6302d0, visitor=0x7fc5427eafd0) at /home/yichen.wang/Workspace/nebula/src/common/expression/LogicalExpression.cpp:137
#13 0x000000000357e6b3 in nebula::storage::IndexSelectionNode::init (this=0x7fc53e6150a0, ctx=...) at /home/yichen.wang/Workspace/nebula/src/storage/exec/IndexSelectionNode.cpp:18
#14 0x0000000003566d8f in nebula::storage::IndexProjectionNode::init (this=0x7fc53e615140, ctx=...) at /home/yichen.wang/Workspace/nebula/src/storage/exec/IndexProjectionNode.cpp:24
#15 0x000000000354219a in nebula::storage::IndexNode::init (this=0x7fc53e6151e0, initCtx=...) at /home/yichen.wang/Workspace/nebula/src/storage/exec/IndexNode.h:196
#16 0x00000000035198c8 in nebula::storage::LookupProcessor::doProcess (this=0x7fc575682000, req=...) at /home/yichen.wang/Workspace/nebula/src/storage/index/LookupProcessor.cpp:63
#17 0x00000000035190ff in nebula::storage::LookupProcessor::<lambda()>::operator()(void) const (__closure=0x7fc575607e00) at /home/yichen.wang/Workspace/nebula/src/storage/index/LookupProcessor.cpp:30
#18 0x0000000003529e4a in folly::detail::function::FunctionTraits<void()>::callBig<nebula::storage::LookupProcessor::process(const nebula::storage::cpp2::LookupIndexRequest&)::<lambda()> >(folly::detail::function::Data &) (p=...) at /home/yichen.wang/Workspace/nebula/build/third-party/install/include/folly/Function.h:385
#19 0x00000000051a8997 in virtual thunk to apache::thrift::concurrency::FunctionRunner::run() ()
#20 0x0000000005305e38 in apache::thrift::concurrency::ThreadManager::Impl::Worker::run() ()
#21 0x0000000005307f3e in apache::thrift::concurrency::PthreadThread::threadMain(void*) ()
#22 0x00007fc583373609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#23 0x00007fc583298133 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

The crash is caused by an kAttribute expression sent to storage, which was checked in ExprVisitorBase.h:71.

Expected behavior
Return 1 row as the result

Additional context

[jinyingsunny]

fund in nebula-master

[critical27]

I didn't reproduce in master. Has it been fixed?

[critical27]

Closing it if no more update