TiDB loses connection when using transaction

[JZuming]

Bug Report

Please answer these questions before submitting your issue. Thanks!

1. Minimal reproduce step (Required)

Setup the environment:

tiup playground --db.binpath /path/to/latest/tidb-server &
mysql -h "127.0.0.1" -u root -P 4000 -D testdb < mysql_bk.sql

mysql_bk.sql:
mysql_bk.sql.txt

Test case

mysql -h "127.0.0.1" -u root -P 4000 -D testdb
mysql> start transaction;
mysql> insert into t_i9_d6 values (0, 1);
mysql> insert into t_yva4kd
  select
    null as c0,
    null as c1,
    null as c2,
    null as c3, 
    case when (
      EXISTS (
        select 1   
          from        
            t_d_6mnc as ref_10
          where 
            EXISTS (
              select 1      
                from                
                  t_d_6mnc as ref_11
                where ref_10.c6 not like 'gi5m%b')))
      then null else 61.40 end as c4, 
    null as c5, 
    null as c6, 
    null as c7
  from 
    t_i9_d6 as ref_2
  where (('wntar' || '8kgpd')) like 'p_r0u';
mysql> commit;

2. What did you expect to see? (Required)

The connection will not be lost.

3. What did you see instead (Required)

The test case made the connection lost.

ERROR 1105 (HY000): close of nil channel
ERROR 2013 (HY000): Lost connection to MySQL server during query
No connection. Trying to reconnect...
Connection id:    159
Current database: testdb

4. What is your TiDB version? (Required)

Release Version: v5.4.0-alpha-360-gb6c45af75
Edition: Community
Git Commit Hash: b6c45af75abf25e62f515c5cadaa329dfd675304
Git Branch: master
UTC Build Time: 2021-12-09 08:29:55
GoVersion: go1.16
Race Enabled: false
TiKV Min Version: v3.0.0-60965b006877ca7234adaced7890d7b029ed1306
Check Table Before Drop: false

[JZuming]

After the fixing of issue #30289, the fuzzer still made the tidb connection lost.

The log of the server:

[2021/12/09 09:20:09.462 +00:00] [ERROR] [conn.go:1019] ["connection running loop panic"] [conn=159] [lastSQL="insert into t_yva4kd\nselect \n null as c0,\n null as c1,\n null as c2, \n null as c3, \n case when (\n EXISTS (\n select 1 \n from \n t_d_6mnc as ref_10\n where \n\t EXISTS (\n select 1 \n from \n t_d_6mnc as ref_11\n where ref_10.c6 not like 'gi5m%b')))\n then null else 61.40 end as c4, \n null as c5, \n null as c6, \n null as c7\n from \n t_i9_d6 as ref_2\n where (('wntar' || '8kgpd')) like 'p_r0u'"] [err="close of nil channel"] [stack="goroutine 211020 [running]:\ngithub.com/pingcap/tidb/server.(*clientConn).Run.func1(0x41d7210, 0xc0005d07e0, 0xc00131a3c0)\n\t/home/zuming/tidb/server/conn.go:1017 +0xf5\npanic(0x382c300, 0x4147b30)\n\t/usr/local/go/src/runtime/panic.go:965 +0x1b9\ngithub.com/pingcap/tidb/executor.(*ExecStmt).Exec.func1(0xc0028081a0, 0xc001a50a08, 0xc001a509e8)\n\t/home/zuming/tidb/executor/adapter.go:343 +0x4d4\npanic(0x382c300, 0x4147b30)\n\t/usr/local/go/src/runtime/panic.go:965 +0x1b9\ngithub.com/pingcap/tidb/executor.(*HashJoinExec).Close(0xc002554900, 0x0, 0x0)\n\t/home/zuming/tidb/executor/join.go:119 +0x47\ngithub.com/pingcap/tidb/executor.(*baseExecutor).Close(0xc002554b40, 0x3715d40, 0x5c13768)\n\t/home/zuming/tidb/executor/executor.go:181 +0x7e\ngithub.com/pingcap/tidb/executor.(*HashJoinExec).Close(0xc002554b40, 0x0, 0xc002b8c960)\n\t/home/zuming/tidb/executor/join.go:153 +0x334\ngithub.com/pingcap/tidb/executor.(*baseExecutor).Close(0xc00255c200, 0x120, 0x41d7d70)\n\t/home/zuming/tidb/executor/executor.go:181 +0x7e\ngithub.com/pingcap/tidb/executor.(*ProjectionExec).Close(0xc00255c200, 0xc000e7d900, 0x5e25400)\n\t/home/zuming/tidb/executor/projection.go:329 +0x138\ngithub.com/pingcap/tidb/executor.(*InsertExec).Close(0xc0002fdce0, 0x41d7210, 0xc0014e67b0)\n\t/home/zuming/tidb/executor/insert.go:322 +0x102\ngithub.com/pingcap/tidb/parser/terror.Call(0xc001a50960)\n\t/home/zuming/tidb/parser/terror/terror.go:298 +0x3f\ngithub.com/pingcap/tidb/executor.(*ExecStmt).Exec(0xc0028081a0, 0x41d7210, 0xc0014e67b0, 0x0, 0x0, 0x4184560, 0xc002638f78)\n\t/home/zuming/tidb/executor/adapter.go:388 +0x41f\ngithub.com/pingcap/tidb/session.runStmt(0x41d7210, 0xc0020f2ae0, 0xc001c6f200, 0x41ede20, 0xc0028081a0, 0x0, 0x0, 0x0, 0x0)\n\t/home/zuming/tidb/session/session.go:1696 +0x37f\ngithub.com/pingcap/tidb/session.(*session).ExecuteStmt(0xc001c6f200, 0x41d7210, 0xc0020f2ae0, 0x41f5688, 0xc0024a3520, 0x0, 0x0, 0x0, 0x0)\n\t/home/zuming/tidb/session/session.go:1580 +0xab1\ngithub.com/pingcap/tidb/server.(*TiDBContext).ExecuteStmt(0xc0005d1c50, 0x41d7210, 0xc0020f2ae0, 0x41f5688, 0xc0024a3520, 0xc001b7ea60, 0x41d7210, 0xc0020f2ae0, 0x0)\n\t/home/zuming/tidb/server/driver_tidb.go:219 +0x6b\ngithub.com/pingcap/tidb/server.(*clientConn).handleStmt(0xc00131a3c0, 0x41d7168, 0xc0020f2ae0, 0x41f5688, 0xc0024a3520, 0x5e5a208, 0x0, 0x0, 0x1, 0x0, ...)\n\t/home/zuming/tidb/server/conn.go:1950 +0x1d1\ngithub.com/pingcap/tidb/server.(*clientConn).handleQuery(0xc00131a3c0, 0x41d7168, 0xc000f87140, 0xc001ccc001, 0x206, 0x0, 0x0)\n\t/home/zuming/tidb/server/conn.go:1819 +0x498\ngithub.com/pingcap/tidb/server.(*clientConn).dispatch(0xc00131a3c0, 0x41d7168, 0xc000f87140, 0xc001ccc000, 0x207, 0x206, 0x0, 0x0)\n\t/home/zuming/tidb/server/conn.go:1324 +0xafd\ngithub.com/pingcap/tidb/server.(*clientConn).Run(0xc00131a3c0, 0x41d7210, 0xc0005d07e0)\n\t/home/zuming/tidb/server/conn.go:1079 +0x2bc\ngithub.com/pingcap/tidb/server.(*Server).onConn(0xc001b7cf70, 0xc00131a3c0)\n\t/home/zuming/tidb/server/server.go:548 +0xa93\ncreated by github.com/pingcap/tidb/server.(*Server).startNetworkListener\n\t/home/zuming/tidb/server/server.go:451 +0x91c\n"]

[XuHuaiyu]

The parent operator above the HashJoinExec triggers an error during Open. Thus the HashJoinExec.closeCh is not initialized and cause an nil pointer panic during the HashJoinExec.Close.

[github-actions]

Please check whether the issue should be labeled with 'affects-x.y' or 'fixes-x.y.z', and then remove 'needs-more-info' label.