P1-[4.0 bug hunting]-[Plancache]-tidb-dashboard causes tidb-server panic when plancache enabled

[sre-bot]

Bug Hunter issue tidb-challenge-program/bug-hunting-issue#104

---

Bug Report

Please answer these questions before submitting your issue. Thanks!

1. What did you do?

When browsing statements in the tidb-dashboard, the tidb-server will panic when plan cache is enabled. The minimal test-case is as follows:

DROP TABLE IF EXISTS t1;
CREATE TABLE t1 (
	 id INT NOT NULL PRIMARY KEY auto_increment,
	 a timestamp NOT NULL
);
INSERT INTO t1 VALUES (null, '2020-05-30 20:30:00');
PREPARE mystmt FROM "SELECT * FROM t1 WHERE UNIX_TIMESTAMP(a) >= ?";
SET @a=1590868800;
EXECUTE mystmt USING @a;

(I will also upload the full test-case, which shows the original query generated by tidb-dashboard).

2. What did you expect to see?

No panic.

3. What did you see instead?

2020/05/30 15:08:52.064 -06:00] [ERROR] [conn.go:662] ["connection running loop panic"] [conn=1] [lastSQL="EXECUTE mystmt USING @a"] [err="runtime error: invalid memory address or nil pointer dereference"] [stack="goroutine 487 [running]:\ngithub.com/pingcap/tidb/server.(*clientConn).Run.func1(0x3a1a3c0, 0xc000886660, 0xc000785a00)\n\t/home/jenkins/agent/workspace/tidb_master/go/src/github.com/pingcap/tidb/server/conn.go:660 +0xee\npanic(0x30ba080, 0x510d110)\n\t/usr/local/go/src/runtime/panic.go:679 +0x1b2\ngithub.com/pingcap/tidb/util/chunk.Row.IsNull(...)\n\t/home/jenkins/agent/workspace/tidb_master/go/src/github.com/pingcap/tidb/util/chunk/row.go:207\ngithub.com/pingcap/tidb/expression.(*Column).EvalTime(0xc0007ad220, 0x3a5f900, 0xc000871000, 0x0, 0x0, 0x0, 0x0, 0x7fe93a63e838, 0x1)\n\t/home/jenkins/agent/workspace/tidb_master/go/src/github.com/pingcap/tidb/expression/column.go:400 +0x1c\ngithub.com/pingcap/tidb/expression.(*builtinUnixTimestampIntSig).evalIntWithCtx(0xc000648370, 0x3a5f900, 0xc000871000, 0x0, 0x0, 0x1, 0x1, 0xc0007a4000, 0x39ea6c0)\n\t/home/jenkins/agent/workspace/tidb_master/go/src/github.com/pingcap/tidb/expression/builtin_time.go:4784 +0x90\ngithub.com/pingcap/tidb/expression.(*ScalarFunction).EvalInt(0xc001215090, 0x3a5f900, 0xc000871000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)\n\t/home/jenkins/agent/workspace/tidb_master/go/src/github.com/pingcap/tidb/expression/scalar_function.go:347 +0x8b\ngithub.com/pingcap/tidb/expression.(*ScalarFunction).Eval(0xc001215090, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)\n\t/home/jenkins/agent/workspace/tidb_master/go/src/github.com/pingcap/tidb/expression/scalar_function.go:316 +0x290\ngithub.com/pingcap/tidb/expression.(*Constant).getLazyDatum(0xc00146c900, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)\n\t/home/jenkins/agent/workspace/tidb_master/go/src/github.com/pingcap/tidb/expression/constant.go:190 +0x84\ngithub.com/pingcap/tidb/expression.(*Constant).EvalInt(0xc00146c900, 0x3a5f900, 0xc000871000, 0x0, 0x0, 0x8, 0x1, 0x0, 0x203000)\n\t/home/jenkins/agent/workspace/tidb_master/go/src/github.com/pingcap/tidb/expression/constant.go:224 +0x40\ngithub.com/pingcap/tidb/expression.(*builtinCastIntAsRealSig).evalReal(0xc000648790, 0x0, 0x0, 0xc00143ab80, 0x80, 0xc0016405b8, 0x11fbc76)\n\t/home/jenkins/agent/workspace/tidb_master/go/src/github.com/pingcap/tidb/expression/builtin_cast.go:485 +0x71\ngithub.com/pingcap/tidb/expression.(*ScalarFunction).EvalReal(...)\n\t/home/jenkins/agent/workspace/tidb_master/go/src/github.com/pingcap/tidb/expression/scalar_function.go:354\ngithub.com/pingcap/tidb/expression.(*ScalarFunction).Eval(0xc0012150e0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)\n\t/home/jenkins/agent/workspace/tidb_master/go/src/github.com/pingcap/tidb/expression/scalar_function.go:323 +0xe6\ngithub.com/pingcap/tidb/expression.foldConstant(0x3a8f260, 0xc0012150e0, 0x11fc4e8, 0x50, 0x3239580)\n\t/home/jenkins/agent/workspace/tidb_master/go/src/github.com/pingcap/tidb/expression/constant_fold.go:197 +0x1072\ngithub.com/pingcap/tidb/expression.FoldConstant(0x3a8f260, 0xc0012150e0, 0x34710d4, 0x4)\n\t/home/jenkins/agent/workspace/tidb_master/go/src/github.com/pingcap/tidb/expression/constant_fold.go:36 +0x39\ngithub.com/pingcap/tidb/expression.BuildCastFunction(0x3a5f900, 0xc000871000, 0x3a8efe0, 0xc00146c900, 0xc0005b71a0, 0x0, 0x0)\n\t/home/jenkins/agent/workspace/tidb_master/go/src/github.com/pingcap/tidb/expression/builtin_cast.go:1805 +0x2d3\ngithub.com/pingcap/tidb/expression.WrapWithCastAsReal(0x3a5f900, 0xc000871000, 0x3a8efe0, 0xc00146c900, 0x0, 0x0)\n\t/home/jenkins/agent/workspace/tidb_master/go/src/github.com/pingcap/tidb/expression/builtin_cast.go:1833 +0x14f\ngithub.com/pingcap/tidb/expression.newBaseBuiltinFuncWithTp(0x3a5f900, 0xc000871000, 0x346fdba, 0x2, 0xc0014c1aa0, 0x2, 0x2, 0x0, 0xc001640dc6, 0x2, ...)\n\t/home/jenkins/agent/workspace/tidb_master/go/src/github.com/pingcap/tidb/expression/builtin.go:144 +0x52f\ngithub.com/pingcap/tidb/expression.(*compareFunctionClass).generateCmpSigs(0xc0002eec30, 0x3a5f900, 0xc000871000, 0xc0014c1aa0, 0x2, 0x2, 0xc0014c1a01, 0x2, 0x2, 0x123623c, ...)\n\t/home/jenkins/agent/workspace/tidb_master/go/src/github.com/pingcap/tidb/expression/builtin_compare.go:1297 +0xd4\ngithub.com/pingcap/tidb/expression.(*compareFunctionClass).getFunction(0xc0002eec30, 0x3a5f900,"]

4. What version of TiDB are you using? (tidb-server -V or run select tidb_version(); on TiDB)

mysql> select tidb_version()\G
*************************** 1. row ***************************
tidb_version(): Release Version: v4.0.0-beta.2-525-g709691607
Edition: Community
Git Commit Hash: 709691607daf167a75d4b950ef5b5a659d7bd743
Git Branch: master
UTC Build Time: 2020-05-29 11:09:55
GoVersion: go1.13
Race Enabled: false
TiKV Min Version: v3.0.0-60965b006877ca7234adaced7890d7b029ed1306
Check Table Before Drop: false
1 row in set (0.00 sec)

panic.txt