tidb
tidb copied to clipboard
pingcap
Query Triggers Runtime Error, Forcibly Terminating User Session
Bug Report
Please answer these questions before submitting your issue. Thanks!
1. Minimal reproduce step (Required)
DROP TABLE IF EXISTS t0;
CREATE TABLE t0 (c1 FLOAT8, c2 DOUBLE, UNIQUE (c2, c1));
SELECT t0.c1 AS ca1, t0.c1 AS ca2, t0.c2 AS ca3 FROM t0 WHERE ((t0.c2) IN (SELECT t0.c1 AS ca4 FROM t0)) NOT IN (((t0.c1 IS FALSE)), ((((BINARY (NULL ^ TRUE)) NOT REGEXP ((BINARY BIT_LENGTH((DEFAULT(t0.c2))) >> 17))) IS NOT TRUE)));
SELECT * from t0 WHERE c1 = 1.0;
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 2097212
Server version: 8.0.11-TiDB-v8.5.0-20251119-e96f28c TiDB Server (Apache License 2.0) Community Edition, MySQL 8.0 compatible
Copyright (c) 2000, 2023, Oracle and/or its affiliates.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> DROP TABLE IF EXISTS t0;
Query OK, 0 rows affected (0.02 sec)
mysql> CREATE TABLE t0 (c1 FLOAT8, c2 DOUBLE, UNIQUE (c2, c1));
Query OK, 0 rows affected (0.01 sec)
mysql> SELECT t0.c1 AS ca1, t0.c1 AS ca2, t0.c2 AS ca3 FROM t0 WHERE ((t0.c2) IN (SELECT t0.c1 AS ca4 FROM t0)) NOT IN (((t0.c1 IS FALSE)), ((((BINARY (NULL ^ TRUE)) NOT REGEXP ((BINARY BIT_LENGTH((DEFAULT(t0.c2))) >> 17))) IS NOT TRUE)));
ERROR 1105 (HY000): runtime error: index out of range [-1]
mysql>
mysql> SELECT * from t0 WHERE c1 = 1.0;
ERROR 2013 (HY000): Lost connection to MySQL server during query
No connection. Trying to reconnect...
Connection id: 2097214
Current database: test
Empty set (0.01 sec)
2. What did you expect to see? (Required)
The query should execute without errors and return an empty set as the table is empty.
3. What did you see instead (Required)
The user session was forcibly terminated by the server.
4. What is your TiDB version? (Required)
Release Version: v8.5.0-20251119-e96f28c Edition: Community Git Commit Hash: e96f28c6511204001765668332a2c3d62d3d6fc3 Git Branch: heads/refs/tags/v8.5.0-20251119-e96f28c UTC Build Time: 2025-11-19 15:51:41 GoVersion: go1.23.3 Race Enabled: false Check Table Before Drop: false Store: unistore
Can reproduce in v8.5.4. The panic stack is
github.com/pingcap/tidb/pkg/server.(*clientConn).Run.func1
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-7vzg8-build-binaries/source/tidb/pkg/server/conn.go:1045
runtime.gopanic
/Users/pingcap/go/pkg/mod/golang.org/[email protected]/src/runtime/panic.go:785
github.com/pingcap/tidb/pkg/executor.(*Compiler).Compile.func1
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-7vzg8-build-binaries/source/tidb/pkg/executor/compiler.go:59
runtime.gopanic
/Users/pingcap/go/pkg/mod/golang.org/[email protected]/src/runtime/panic.go:785
runtime.goPanicIndex
/Users/pingcap/go/pkg/mod/golang.org/[email protected]/src/runtime/panic.go:115
github.com/pingcap/tidb/pkg/planner/core.(*expressionRewriter).inToExpression
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-7vzg8-build-binaries/source/tidb/pkg/planner/core/expression_rewriter.go:1925
github.com/pingcap/tidb/pkg/planner/core.(*expressionRewriter).Leave
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-7vzg8-build-binaries/source/tidb/pkg/planner/core/expression_rewriter.go:1571
github.com/pingcap/tidb/pkg/parser/ast.(*PatternInExpr).Accept
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-7vzg8-build-binaries/source/tidb/pkg/parser/ast/expressions.go:777
github.com/pingcap/tidb/pkg/planner/core.rewriteExprNode
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-7vzg8-build-binaries/source/tidb/pkg/planner/core/expression_rewriter.go:301
github.com/pingcap/tidb/pkg/planner/core.(*PlanBuilder).rewriteWithPreprocess
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-7vzg8-build-binaries/source/tidb/pkg/planner/core/expression_rewriter.go:239
github.com/pingcap/tidb/pkg/planner/core.(*PlanBuilder).rewrite
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-7vzg8-build-binaries/source/tidb/pkg/planner/core/expression_rewriter.go:206
github.com/pingcap/tidb/pkg/planner/core.(*PlanBuilder).buildSelection
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-7vzg8-build-binaries/source/tidb/pkg/planner/core/logical_plan_builder.go:924
github.com/pingcap/tidb/pkg/planner/core.(*PlanBuilder).buildSelect
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-7vzg8-build-binaries/source/tidb/pkg/planner/core/logical_plan_builder.go:3872
github.com/pingcap/tidb/pkg/planner/core.(*PlanBuilder).Build
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-7vzg8-build-binaries/source/tidb/pkg/planner/core/planbuilder.go:549
github.com/pingcap/tidb/pkg/planner.buildLogicalPlan
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-7vzg8-build-binaries/source/tidb/pkg/planner/optimize.go:576
github.com/pingcap/tidb/pkg/planner.optimize
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-7vzg8-build-binaries/source/tidb/pkg/planner/optimize.go:493
github.com/pingcap/tidb/pkg/planner.Optimize
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-7vzg8-build-binaries/source/tidb/pkg/planner/optimize.go:361
github.com/pingcap/tidb/pkg/executor.(*Compiler).Compile
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-7vzg8-build-binaries/source/tidb/pkg/executor/compiler.go:102
github.com/pingcap/tidb/pkg/session.(*session).ExecuteStmt
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-7vzg8-build-binaries/source/tidb/pkg/session/session.go:2112
github.com/pingcap/tidb/pkg/server.(*TiDBContext).ExecuteStmt
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-7vzg8-build-binaries/source/tidb/pkg/server/driver_tidb.go:291
github.com/pingcap/tidb/pkg/server.(*clientConn).handleStmt
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-7vzg8-build-binaries/source/tidb/pkg/server/conn.go:2033
github.com/pingcap/tidb/pkg/server.(*clientConn).handleQuery
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-7vzg8-build-binaries/source/tidb/pkg/server/conn.go:1780
github.com/pingcap/tidb/pkg/server.(*clientConn).dispatch
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-7vzg8-build-binaries/source/tidb/pkg/server/conn.go:1379
github.com/pingcap/tidb/pkg/server.(*clientConn).Run
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-7vzg8-build-binaries/source/tidb/pkg/server/conn.go:1148
github.com/pingcap/tidb/pkg/server.(*Server).onConn
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-7vzg8-build-binaries/source/tidb/pkg/server/server.go:741
