executor: point get for update read panic on partition table

[vivid392845427]

Bug Report

Please answer these questions before submitting your issue. Thanks!

1. Minimal reproduce step (Required)

fail in test-store

create table t1(id int primary key, balance DECIMAL(10, 2), balance2 DECIMAL(10, 2) GENERATED ALWAYS AS (-balance) VIRTUAL, created_at TIMESTAMP) PARTITION BY HASH(id) PARTITIONS 8;

insert into t1(id, balance, created_at) values(1, 100, now());

begin pessimistic;
select * from t1 where id = 1 for update;

2. What did you expect to see? (Required)

success with results

3. What did you see instead (Required)

Error 1105: runtime error: invalid memory address or nil pointer dereference

the panic stack

tack="goroutine 18715 [running]:
github.com/pingcap/tidb/server.(*clientConn).Run.func1(0x3c0b3b8, 0xc0109f4c90, 0xc010917b00)
/home/rwork/src/github.com/pingcap/tidb/server/conn.go:799 +0xf5
panic(0x3358840, 0x4f161d0)
/home/rwork/local/go/src/runtime/panic.go:965 +0x1b9
github.com/pingcap/tidb/executor.(*ExecStmt).Exec.func1(0xc00f6dcc00, 0xc00f72eb08, 0xc00f72eae8)
/home/rwork/src/github.com/pingcap/tidb/executor/adapter.go:329 +0x4d3
panic(0x3358840, 0x4f161d0)
/home/rwork/local/go/src/runtime/panic.go:965 +0x1b9
github.com/pingcap/parser/model.(*ColumnInfo).GetOriginDefaultValue(...)
/home/rwork/pkg/mod/github.com/pingcap/parser@v0.0.0-20210610080504-cb77169bfed9/model/model.go:158
github.com/pingcap/tidb/table.GetColOriginDefaultValue(0x3c4ac90, 0xc01098b540, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
/home/rwork/src/github.com/pingcap/tidb/table/column.go:477 +0x69
github.com/pingcap/tidb/executor.NewRowDecoder.func2(0x4, 0xc0133217c0, 0xc00fa42c60, 0x3c37568)
/home/rwork/src/github.com/pingcap/tidb/executor/builder.go:4052 +0xcf
github.com/pingcap/tidb/util/rowcodec.(*ChunkDecoder).DecodeToChunk(0xc00f6dccc0, 0xc00fc697a0, 0x1b, 0x20, 0x3c37568, 0x53ca028, 0xc0133217c0, 0x8, 0x8)
/home/rwork/src/github.com/pingcap/tidb/util/rowcodec/decoder.go:240 +0x1d0
github.com/pingcap/tidb/executor.DecodeRowValToChunk(0x3c4ac90, 0xc01098b540, 0xc013321720, 0xc012191080, 0x3c37568, 0x53ca028, 0xc00fc697a0, 0x1b, 0x20, 0xc0133217c0, ...)
/home/rwork/src/github.com/pingcap/tidb/executor/point_get.go:486 +0x8e
github.com/pingcap/tidb/executor.(*PointGetExecutor).Next(0xc012ef5980, 0x3c0b3b8, 0xc01223e810, 0xc0133217c0, 0x0, 0x0)
/home/rwork/src/github.com/pingcap/tidb/executor/point_get.go:279 +0x553
github.com/pingcap/tidb/executor.Next(0x3c0b3b8, 0xc01223e810, 0x3c0f758, 0xc012ef5980, 0xc0133217c0, 0x0, 0x0)
/home/rwork/src/github.com/pingcap/tidb/executor/executor.go:286 +0x2de
github.com/pingcap/tidb/executor.(*ProjectionExec).unParallelExecute(0xc010b2be00, 0x3c0b3b8, 0xc01223e810, 0xc0133218b0, 0x0, 0x2ce6332a74900)
/home/rwork/src/github.com/pingcap/tidb/executor/projection.go:193 +0xb2
github.com/pingcap/tidb/executor.(*ProjectionExec).Next(0xc010b2be00, 0x3c0b3b8, 0xc01223e810, 0xc0133218b0, 0xc00f6f2700, 0xc00fae7308)
/home/rwork/src/github.com/pingcap/tidb/executor/projection.go:179 +0x73
github.com/pingcap/tidb/executor.Next(0x3c0b3b8, 0xc01223e810, 0x3c0f7d8, 0xc010b2be00, 0xc0133218b0, 0x0, 0x0)
/home/rwork/src/github.com/pingcap/tidb/executor/executor.go:286 +0x2de
github.com/pingcap/tidb/executor.(*ExecStmt).runPessimisticSelectForUpdate(0xc00f6dcc00, 0x3c0b3b8, 0xc01223e810, 0x3c0f7d8, 0xc010b2be00, 0x0, 0x0, 0x0, 0x0)
/home/rwork/src/github.com/pingcap/tidb/executor/adapter.go:540 +0x285
github.com/pingcap/tidb/executor.(*ExecStmt).handlePessimisticSelectForUpdate(0xc00f6dcc00, 0x3c0b3b8, 0xc01223e810, 0x3c0f7d8, 0xc010b2be00, 0x55a7e80, 0x3c0b303, 0x0, 0x203003)
/home/rwork/src/github.com/pingcap/tidb/executor/adapter.go:521 +0x5d
github.com/pingcap/tidb/executor.(*ExecStmt).Exec(0xc00f6dcc00, 0x3c0b3b8, 0xc01223e810, 0x0, 0x0, 0x0, 0x0)
/home/rwork/src/github.com/pingcap/tidb/executor/adapter.go:413 +0xb49
github.com/pingcap/tidb/session.runStmt(0x3c0b3b8, 0xc0101e36b0, 0xc01098b540, 0x3c21278, 0xc00f6dcc00, 0x0, 0x0, 0x0, 0x0)
/home/rwork/src/github.com/pingcap/tidb/session/session.go:1653 +0x37f
github.com/pingcap/tidb/session.(*session).ExecuteStmt(0xc01098b540, 0x3c0b3b8, 0xc0101e36b0, 0x3c25928, 0xc0002db680, 0x0, 0x0, 0x0, 0x0)
/home/rwork/src/github.com/pingcap/tidb/session/session.go:1548 +0xaab
github.com/pingcap/tidb/server.(*TiDBContext).ExecuteStmt(0xc0109f5110, 0x3c0b3b8, 0xc0101e36b0, 0x3c25928, 0xc0002db680, 0xc00fc69560, 0x3c0b3b8, 0xc0101e36b0, 0xc00f72f0d0)
/home/rwork/src/github.com/pingcap/tidb/server/driver_tidb.go:218 +0x6b
github.com/pingcap/tidb/server.(*clientConn).handleStmt(0xc010917b00, 0x3c0b310, 0xc0101e36b0, 0x3c25928, 0xc0002db680, 0x55daf88, 0x0, 0x0, 0x1, 0x0, ...)
/home/rwork/src/github.com/pingcap/tidb/server/conn.go:1691 +0x1bb

Seems the point get executor decodes value with incorrect colunm index or offset.
The non for update point get read and non-partition for update point get read are ok.

4. What is your TiDB version? (Required)

master ed686d1
release-5.1 4ca5d03

[cfzjywxk]

/cc @qw4990

[lysu]

@tiancaiamao it seems this issue is caused by -2 ID introduced by #21148, PTAL

[tiancaiamao]

@tiancaiamao it seems this issue is caused by -2 ID introduced by #21148, PTAL

Oh, I get the point ... I add a extra partition table ID column for select lock, the table reader executor will add the extra column and pass the extra column to the ancestral select lock executor. However, I forget the point get / batch point get cases for that extra PID column.

[ti-srebot]

Please edit this comment or add a new comment to complete the following information

Not a bug

1. Remove the 'type/bug' label
2. Add notes to indicate why it is not a bug

Duplicate bug

1. Add the 'type/duplicate' label
2. Add the link to the original bug

Bug

Note: Make Sure that 'component', and 'severity' labels are added
Example for how to fill out the template: #20100

1. Root Cause Analysis (RCA) (optional)

2. Symptom (optional)

3. All Trigger Conditions (optional)

4. Workaround (optional)

5. Affected versions

6. Fixed versions

[tiancaiamao]

It is introduced by another bugfix PR, and it's fixed immediately, so I just change the bug label to regression.
It does actually impose any released version.

[zyguan]

DROP TABLE IF EXISTS `t2`;
CREATE TABLE `t2` ( `c1` int(11) NOT NULL, `c2` int(11) DEFAULT NULL, `c3` int(11) DEFAULT NULL, `c4` int(11) DEFAULT NULL, PRIMARY KEY (`c1`) /*T![clustered_index] CLUSTERED */, KEY `k2` (`c2`), KEY `k3` (`c3`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin PARTITION BY HASH( `c1` ) PARTITIONS 10;
INSERT INTO t2 (`c1`, `c2`, `c3`, `c4`) VALUES (1, 1, 1, 1) , (3, 3, 3, 3) , (2, 2, 2, 2) , (4, 4, 4, 4);
select * from t2 where c1 in (3, 4) order by c2 for update;

[2021/06/22 02:38:49.331 +00:00] [INFO] [conn.go:877] ["command dispatched failed"] [conn=157] [connInfo="id:157, addr:172.18.219.0:46758 status:10, collation:utf8_general_ci, user:root"] [command=Query] [status="inTxn:0, autocommit:1"] [sql="select * from t2 where c1 in (3, 4) order by c2 for update"] [txn_mode=PESSIMISTIC] [err="runtime error: invalid memory address or nil pointer dereference\ngit.luolix.top/pingcap/tidb/executor.(*UnionExec).resultPuller.func1\n\t/home/jenkins/agent/workspace/build-tidb/tidb/executor/executor.go:1554\nruntime.gopanic\n\t/usr/local/go/src/runtime/panic.go:965\nruntime.panicmem\n\t/usr/local/go/src/runtime/panic.go:212\nruntime.sigpanic\n\t/usr/local/go/src/runtime/signal_unix.go:734\ngit.luolix.top/pingcap/parser/model.(*ColumnInfo).GetOriginDefaultValue\n\t/go/pkg/mod/github.com/pingcap/parser@v0.0.0-20210618053735-57843e8185c4/model/model.go:158\ngit.luolix.top/pingcap/tidb/table.GetColOriginDefaultValue\n\t/home/jenkins/agent/workspace/build-tidb/tidb/table/column.go:484\ngit.luolix.top/pingcap/tidb/executor.NewRowDecoder.func2\n\t/home/jenkins/agent/workspace/build-tidb/tidb/executor/builder.go:4065\ngit.luolix.top/pingcap/tidb/util/rowcodec.(*ChunkDecoder).DecodeToChunk\n\t/home/jenkins/agent/workspace/build-tidb/tidb/util/rowcodec/decoder.go:240\ngit.luolix.top/pingcap/tidb/executor.DecodeRowValToChunk\n\t/home/jenkins/agent/workspace/build-tidb/tidb/executor/point_get.go:500\ngit.luolix.top/pingcap/tidb/executor.(*BatchPointGetExec).Next\n\t/home/jenkins/agent/workspace/build-tidb/tidb/executor/batch_point_get.go:206\ngit.luolix.top/pingcap/tidb/executor.Next\n\t/home/jenkins/agent/workspace/build-tidb/tidb/executor/executor.go:286\ngit.luolix.top/pingcap/tidb/executor.(*UnionExec).resultPuller\n\t/home/jenkins/agent/workspace/build-tidb/tidb/executor/executor.go:1583\nruntime.goexit\n\t/usr/local/go/src/runtime/asm_amd64.s:1371"]

Still got panicked. @tiancaiamao PTAL