TiDB panics at CheckUpdateList after change columns

[sticnarf]

Bug Report

1. Minimal reproduce step (Required)

Launch a TiDB:

tiup playground nightly --tiflash 0

Run the program in this comment: #22395 (comment)

2. What did you expect to see? (Required)

No error reported

3. What did you see instead (Required)

panic: Error 1105: runtime error: index out of range [2] with length 2

goroutine 28 [running]:
main.main.func1(0xc0000a03c0)
        /tmp/main.go:38 +0x509
created by main.main
        /tmp/main.go:28 +0x21e
panic: Error 1105: runtime error: index out of range [2] with length 2

goroutine 46 [running]:
main.main.func1(0xc0000a03c0)
        /tmp/main.go:38 +0x509
created by main.main
        /tmp/main.go:28 +0x21e

TiDB Log:

[2021/07/06 15:41:41.219 +08:00] [ERROR] [conn.go:918] ["connection running loop panic"] [conn=43] [lastSQL="update t set v = ? where id = ? [arguments: (1, 0)]"] [err="runtime error: index out of range [2] with length 2"] [stack="goroutine 1116 [running]:
github.com/pingcap/tidb/server.(*clientConn).Run.func1(0x3c32db8, 0xc001782630, 0xc001d58d80)
	/home/jenkins/agent/workspace/build_tidb_multi_branch_master/go/src/github.com/pingcap/tidb/server/conn.go:916 +0xf5
panic(0x356c040, 0xc0024f1380)
	/usr/local/go/src/runtime/panic.go:965 +0x1b9
github.com/pingcap/tidb/executor.(*ExecStmt).Exec.func1(0xc000a45a00, 0xc0047b8c30, 0xc0047b8c10)
	/home/jenkins/agent/workspace/build_tidb_multi_branch_master/go/src/github.com/pingcap/tidb/executor/adapter.go:332 +0x4d4
panic(0x356c040, 0xc0024f1380)
	/usr/local/go/src/runtime/panic.go:965 +0x1b9
github.com/pingcap/tidb/planner/core.CheckUpdateList(0xc00118cd70, 0x2, 0x2, 0xc000a45860, 0xc00118cd70, 0x2)
	/home/jenkins/agent/workspace/build_tidb_multi_branch_master/go/src/github.com/pingcap/tidb/planner/core/logical_plan_builder.go:4606 +0x625
github.com/pingcap/tidb/executor.(*executorBuilder).buildUpdate(0xc0026e4c40, 0xc000a45860, 0x3c72970, 0xc00218e780)
	/home/jenkins/agent/workspace/build_tidb_multi_branch_master/go/src/github.com/pingcap/tidb/executor/builder.go:1897 +0x4ed
github.com/pingcap/tidb/executor.(*executorBuilder).build(0xc0026e4c40, 0x3c5ee58, 0xc000a45860, 0xc000a45860, 0xc0048ac400)
	/home/jenkins/agent/workspace/build_tidb_multi_branch_master/go/src/github.com/pingcap/tidb/executor/builder.go:199 +0x1865
github.com/pingcap/tidb/executor.(*ExecuteExec).Build(0xc00139e870, 0xc0026e4c40, 0xc00139e780, 0x3c36b98)
	/home/jenkins/agent/workspace/build_tidb_multi_branch_master/go/src/github.com/pingcap/tidb/executor/prepared.go:274 +0xc5
github.com/pingcap/tidb/executor.(*ExecStmt).buildExecutor(0xc000a45a00, 0xc001074000, 0x33793c0, 0x58162a8, 0x329c820)
	/home/jenkins/agent/workspace/build_tidb_multi_branch_master/go/src/github.com/pingcap/tidb/executor/adapter.go:806 +0x285
github.com/pingcap/tidb/executor.(*ExecStmt).Exec(0xc000a45a00, 0x3c32db8, 0xc004542e40, 0x0, 0x0, 0x0, 0x0)
	/home/jenkins/agent/workspace/build_tidb_multi_branch_master/go/src/github.com/pingcap/tidb/executor/adapter.go:380 +0x1f7
github.com/pingcap/tidb/session.runStmt(0x3c32db8, 0xc0045428a0, 0xc00218e780, 0x3c48dc0, 0xc000a45a00, 0x0, 0x0, 0x0, 0x0)
	/home/jenkins/agent/workspace/build_tidb_multi_branch_master/go/src/github.com/pingcap/tidb/session/session.go:1636 +0x37f
github.com/pingcap/tidb/session.(*session).preparedStmtExec(0xc00218e780, 0x3c32db8, 0xc0045428a0, 0x3c69758, 0xc005497e50, 0x0, 0x401, 0xc004856a00, 0xc005725830, 0x2, ...)
	/home/jenkins/agent/workspace/build_tidb_multi_branch_master/go/src/github.com/pingcap/tidb/session/session.go:1773 +0x299
github.com/pingcap/tidb/session.(*session).ExecutePreparedStmt(0xc00218e780, 0x3c32db8, 0xc0045428a0, 0x401, 0xc005725830, 0x2, 0x2, 0x40, 0x20, 0x203001, ...)
	/home/jenkins/agent/workspace/build_tidb_multi_branch_master/go/src/github.com/pingcap/tidb/session/session.go:1934 +0x40e
github.com/pingcap/tidb/server.(*TiDBStatement).Execute(0xc0014ca460, 0x3c32db8, 0xc0045428a0, 0xc005725830, 0x2, 0x2, 0x7fd881bad4c0, 0xc000508400, 0x0, 0xc0047b8ff0)
	/home/jenkins/agent/workspace/build_tidb_multi_branch_master/go/src/github.com/pingcap/tidb/server/driver_tidb.go:73 +0x96
github.com/pingcap/tidb/server.(*clientConn).executePreparedStmtAndWriteResult(0xc001d58d80, 0x3c32db8, 0xc0045428a0, 0x3c5eec8, 0xc0014ca460, 0xc005725830, 0x2, 0x2, 0x0, 0x0, ...)
	/home/jenkins/agent/workspace/build_tidb_multi_branch_master/go/src/github.com/pingcap/tidb/server/conn_stmt.go:228 +0xad
github.com/pingcap/tidb/server.(*clientConn).handleStmtExecute(0xc001d58d80, 0x3c32d10, 0xc0045428a0, 0xc000312d01, 0x1f, 0x1f, 0x0, 0x0)
	/home/jenkins/agent/workspace/build_tidb_multi_branch_master/go/src/github.com/pingcap/tidb/server/conn_stmt.go:208 +0x685
github.com/pingcap/tidb/server.(*clientConn).dispatch(0xc001d58d80, 0x3c32d10, 0xc00569f580, 0xc000312d00, 0x20, 0x1f, 0x0, 0x0)
	/home/jenkins/agent/workspace/build_tidb_multi_branch_master/go/src/github.com/pingcap/tidb/server/conn.go:1237 +0x110f
github.com/pingcap/tidb/server.(*clientConn).Run(0xc001d58d80, 0x3c32db8, 0xc001782630)
	"]

4. What is your TiDB version? (Required)

TiDB nightly 20210706

Release Version: v5.2.0-alpha-208-g7259784c6
Edition: Community
Git Commit Hash: 7259784c683c44841ffb4cd202ed96ac0d4738ca
Git Branch: master
UTC Build Time: 2021-07-05 12:53:49
GoVersion: go1.16.4
Race Enabled: false
TiKV Min Version: v3.0.0-60965b006877ca7234adaced7890d7b029ed1306
Check Table Before Drop: false

[sticnarf]

I can confirm this issue occurs on all released TiDB versions including 5.0.0 ~ 5.0.3 and 5.1.0.

[zimulala]

@AilinKid found that this was a problem with Prepare and Execute using different schemas.
The problem is not just that "column type change" is buggy, it has been around for some time

[ti-srebot]

Please edit this comment or add a new comment to complete the following information

Not a bug

1. Remove the 'type/bug' label
2. Add notes to indicate why it is not a bug

Duplicate bug

1. Add the 'type/duplicate' label
2. Add the link to the original bug

Bug

Note: Make Sure that 'component', and 'severity' labels are added
Example for how to fill out the template: #20100

1. Root Cause Analysis (RCA) (optional)

2. Symptom (optional)

3. All Trigger Conditions (optional)

4. Workaround (optional)

5. Affected versions

6. Fixed versions