[Bug]: 含有 ORDER BY 子句时有时没有正确排序

[r33s3n6]

Describe the bug
master分支版本，含有 ORDER BY 子句时有时没有正确排序

Fast Reproduce Steps(Required)
先执行init.sql建表，随后执行error.sql，有时导致预期之外的结果。
init.sql.txt

error.sql:

SELECT
  ceiling(
    cast(round(
      cast(case when (NOT NOT(cast((ref_0.c_u5gqigv9u >= ref_0.c_rv92) as unsigned))) then ref_0.c_ypx08c2rg else (select min(c_g3kz9bm) from t_i823jy)
           end
         as double), 
      cast(abs(
        cast(ref_0.c_hm0fkncc as signed)) as signed)) as double)) as c2
FROM
  t_co as ref_0
ORDER BY
  c2 ASC
LIMIT 138;

Expected behavior
正确排序

Actual Behavior
OB的单节点版本和多节点版本均有预期之外的结果。
SQL中含有ORDER BY，但是结果没有被正确排序。
output_re_main.log
output_re_single.log

Environment

Linux c0bae494cabb 6.5.0-18-generic #18~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Wed Feb  7 11:40:03 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

commit 5eee31b32b97af9818b3ef342d951c2bc8837f82 (HEAD -> master, origin/master)

observer (OceanBase_CE 4.3.1.0)

REVISION: 1-5eee31b32b97af9818b3ef342d951c2bc8837f82
BUILD_BRANCH: master
BUILD_TIME: May  7 2024 14:39:32
BUILD_FLAGS: RelWithDebInfo
BUILD_INFO: 

Copyright (c) 2011-present OceanBase Inc.

部署配置文件

user:
  username: root
  key_file: private_key
oceanbase-ce:
  servers:
    - name: server1
      ip: 10.0.10.11
    - name: server2
      ip: 10.0.10.12
    - name: server3
      ip: 10.0.10.13
  server1:
    mysql_port: 10000
    rpc_port: 10001
    home_path: /root/data/observer1
    zone: zone1
  server2:
    mysql_port: 10000
    rpc_port: 10001
    home_path: /root/data/observer2
    zone: zone2
  server3:
    mysql_port: 10000
    rpc_port: 10001
    home_path: /root/data/observer3
    zone: zone3
  tag: latest
  include: obd/observer.include.yaml
  global: 
    # for default system config used by farm, please see tools/deploy/obd/observer.include.yaml
    # You can also specify the configuration directly below (stored locally, switching the working directory and redeploying will still take effect)
    production_mode: false
    devname: eth0
    syslog_level: 'WARN'
    syslog_io_bandwidth_limit: '30M'
    log_disk_size: '30G'
    # diag_syslog_per_error_limit: '4'
    max_syslog_file_count: '4'
    cpu_count: '6'
    datafile_size: '10G'
    datafile_next: '5G'
    datafile_maxsize: '30G'
    root_password: ''
    memory_limit: '9G'
    system_memory: '1G'
obproxy-ce:
  servers:
    - 10.0.10.8
  global:
    listen_port: 10004
    prometheus_listen_port: 10005
    syslog_level: 'WARN'
    home_path: /root/data/obproxy
    root_password: ''
  include: obd/obproxy.include.yaml
  depends:
    - oceanbase-ce

租户配置：

DROP TENANT mysql FORCE;
DROP RESOURCE POOL pool_for_tenant_mysql;

CREATE RESOURCE UNIT 4c7g MAX_CPU 4, MIN_CPU 4, MEMORY_SIZE '7G';
create resource pool pool_test unit='4c7g', unit_num=1, zone_list=('zone1' ,'zone2', 'zone3');
create tenant test resource_pool_list=('pool_test'), primary_zone='RANDOM',comment 'test tenant', charset='utf8' set ob_tcp_invited_nodes='%', recyclebin=OFF, ob_query_timeout=5000000;

Additional Context
我们是来自北京航空航天大学网络空间安全学院的BASS团队，主要从事系统软件安全、操作系统和程序分析研究，研发自动化程序测试框架检测软件缺陷。我们使用自研的数据库漏洞测试工具在OceanBase中找到了上述可能的漏洞。

[hnwyllmm]

感谢，我们来重现一下。