opt/execbuilder: pick correct canary column ordinal

[mgartner]

opt/execbuilder: pick correct canary column ordinal

The execbuilder previously used the colOrdMap of an Upsert's input to
find the ordinal of the canary column. In rare cases, the canary column
could also be used as a partial index DEL column. Because a colOrdMap
can only map each column ID to a single ordinal, and because partial
index columns are positioned after the canary column, the ordinal
fetched from the colOrdMap would be the partial index DEL column
ordinal, not the canary column ordinal.

This could cause node-crashing panics during execution when trying to
access the canary canary column in the input row after the partial index
columns are sliced off.

As an example, consider the table and mutation:

CREATE TABLE t (c BOOL PRIMARY KEY, INDEX (c) WHERE c)

UPSERT INTO t VALUES (false)

The input to the Upsert operator produces 4 physical columns:

1. An insert column with the value to insert if a row with the same
   PK does not already exist. We'll call this logical column new_c.
2. A canary column which is non-NULL if a row with the same PK already
   exists. This is always a PK column fetched from the table—in our
   example this is c. Let's call this logical column old_c.
3. A partial index PUT column which is true if the new row should be
   added to the partial index. Since the partial index predicate
   expression is the PK column, this is the same logical column as
   new_c.
4. A partial index DEL column which is true if the old row should be
   removed from the partial index. This is the same logical column as
   old_c.

So, the physical columns produced by the input of the Upsert are:

insert column	canary column	partial index PUT	partial index DEL
new_c	old_c	new_c	old_c

Using the colOrdMap to find the ordinal of old_c yields 3, instead
of 1.

During execution the partial index columns are sliced off, and the row
becomes:

insert column	canary column
new_c	old_c

When the execution engine attempts to access index 3 of this row, the
process panics with an out-of-bounds exception.

This has been fixed by using the lengths of the insert (and other)
columns to find the canary column ordinal, instead of the colOrdMap.

Fixes #136458

Release note (bug fix): A bug has been fixed that could cause gateway
nodes to panic when performing an UPSERT on a table with a BOOL
primary key column and a partial index with the PK column as the
predicate expression.

opt/execbuilder: remove colOrdMap return value from Builder.buildMutationInput

Release note: None

[cockroach-teamcity]

This change is 

[DrewKimball]

Nice fix!

Do you think we're incorrectly using a ColMap like this anywhere else during planning? I wouldn't be surprised if there are other places where we can map the same column ID to different ordinal locations in the exec plan.

Reviewed 3 of 3 files at r1, 1 of 1 files at r2, all commit messages.
Reviewable status: complete! 1 of 0 LGTMs obtained (waiting on @michae2)

[mgartner]

Do you think we're incorrectly using a ColMap like this anywhere else during planning? I wouldn't be surprised if there are other places where we can map the same column ID to different ordinal locations in the exec plan.

Yes, I think it's possible. Note that it may not surface as a panic or correctness bug though—so it's not necessarily a problem.

[mgartner]

TFTR!

bors r+

[craig]

Build succeeded:

• local_roachtest
• linux_amd64_fips_build
• lint
• linux_amd64_build
• examples_orms
• unit_tests
• check_generated_code
• docker_image_amd64
• local_roachtest_fips
• acceptance

[blathers-crl]

Based on the specified backports for this PR, I applied new labels to the following linked issue(s). Please adjust the labels as needed to match the branches actually affected by the issue(s), including adding any known older branches.

---

Issue #136458: branch-release-23.2, branch-release-24.1, branch-release-24.3, branch-release-25.1.

---

_{🦉 Hoot! I am a Blathers, a bot for CockroachDB. My owner is dev-inf.}

[blathers-crl]

Encountered an error creating backports. Some common things that can go wrong:

1. The backport branch might have already existed.
2. There was a merge conflict.
3. The backport branch contained merge commits.

You might need to create your backport manually using the backport tool.

---

error creating merge commit from ca34bce to blathers/backport-release-23.2-141728: POST https://api.github.com/repos/cockroachdb/cockroach/merges: 409 Merge conflict []

you may need to manually resolve merge conflicts with the backport tool.

Backport to branch 23.2.x failed. See errors above.

---

error creating merge commit from ca34bce to blathers/backport-release-24.1-141728: POST https://api.github.com/repos/cockroachdb/cockroach/merges: 409 Merge conflict []

you may need to manually resolve merge conflicts with the backport tool.

Backport to branch 24.1.x failed. See errors above.

---

error creating merge commit from ca34bce to blathers/backport-release-24.3-141728: POST https://api.github.com/repos/cockroachdb/cockroach/merges: 409 Merge conflict []

you may need to manually resolve merge conflicts with the backport tool.

Backport to branch 24.3.x failed. See errors above.

---

error creating merge commit from 2d108ac to blathers/backport-release-25.1-141728: POST https://api.github.com/repos/cockroachdb/cockroach/merges: 409 Merge conflict []

you may need to manually resolve merge conflicts with the backport tool.

Backport to branch 25.1.x failed. See errors above.

---

_{🦉 Hoot! I am a Blathers, a bot for CockroachDB. My owner is dev-inf.}