[Bug] BE coredump when call get_value() in expr_context.cpp

[weizuo93]

Describe the bug

BE coredump in expr_context.cpp when call get_value().

Core was generated by `/home/work/app/doris/c3prc-hadoop-test/be/package/be/lib/palo_be'.
Program terminated with signal 11, Segmentation fault.
#0  is_null (offset=..., offset=..., this=<optimized out>) at /builds/BkUi_hk7/0/olap/doris/be/src/runtime/tuple.h:138
138	/builds/BkUi_hk7/0/olap/doris/be/src/runtime/tuple.h: 没有那个文件或目录.
Missing separate debuginfos, use: debuginfo-install glibc-2.17-157.el7_3.1.x86_64 libgcc-4.8.5-28.el7_5.1.x86_64 zlib-1.2.7-17.el7.x86_64
(gdb) bt
#0  is_null (offset=..., offset=..., this=<optimized out>) at /builds/BkUi_hk7/0/olap/doris/be/src/runtime/tuple.h:138
#1  doris::SlotRef::get_big_int_val (this=0x72a65400, context=0xf660b680, row=<optimized out>) at /builds/BkUi_hk7/0/olap/doris/be/src/exprs/slot_ref.cpp:177
#2  0x0000000000d76daf in get_value (row=0xf660b680, e=<optimized out>, this=0xf660b680) at /builds/BkUi_hk7/0/olap/doris/be/src/exprs/expr_context.cpp:302
#3  doris::ExprContext::get_value (this=0xf660b680, row=row@entry=0x139dee000) at /builds/BkUi_hk7/0/olap/doris/be/src/exprs/expr_context.cpp:254
#4  0x0000000001632efc in doris::NewAggFnEvaluator::Update (this=0x30c40d00, row=row@entry=0x139dee000, dst=dst@entry=0x27caa6000, fn=<optimized out>)
    at /builds/BkUi_hk7/0/olap/doris/be/src/exprs/new_agg_fn_evaluator.cc:410
#5  0x000000000158ced6 in Add (dst=0x27caa6000, row=0x139dee000, this=<optimized out>) at /builds/BkUi_hk7/0/olap/doris/be/src/exprs/new_agg_fn_evaluator.h:284
#6  doris::PartitionedAggregationNode::UpdateTuple (this=this@entry=0xb215b80, agg_fn_evals=0x37788a00, tuple=0x27caa6000, row=row@entry=0x139dee000, is_merge=is_merge@entry=false)
    at /builds/BkUi_hk7/0/olap/doris/be/src/exec/partitioned_aggregation_node.cc:1047
#7  0x0000000001597d6f in TryAddToHashTable (status=0xb215d48, remaining_capacity=0x7f7584151150, hash=1225313753, in_row=0x139dee000, hash_tbl=<optimized out>, partition=0x40e4d2c0, ht_ctx=0x38fbbb80, 
    this=0xb215b80) at /builds/BkUi_hk7/0/olap/doris/be/src/exec/partitioned_aggregation_node_ir.cc:242
#8  doris::PartitionedAggregationNode::ProcessBatchStreaming (this=this@entry=0xb215b80, needs_serialize=<optimized out>, in_batch=0x3e7fab00, out_batch=out_batch@entry=0x899e2f20, ht_ctx=0x38fbbb80, 
    remaining_capacity=0x7f7584151140) at /builds/BkUi_hk7/0/olap/doris/be/src/exec/partitioned_aggregation_node_ir.cc:184
#9  0x00000000015908c8 in doris::PartitionedAggregationNode::GetRowsStreaming (this=this@entry=0xb215b80, state=state@entry=0xdb50a300, out_batch=out_batch@entry=0x899e2f20)
    at /builds/BkUi_hk7/0/olap/doris/be/src/exec/partitioned_aggregation_node.cc:579
#10 0x0000000001593ed1 in doris::PartitionedAggregationNode::GetNextInternal (this=this@entry=0xb215b80, state=0xdb50a300, row_batch=row_batch@entry=0x899e2f20, eos=0x8ede93b1)
    at /builds/BkUi_hk7/0/olap/doris/be/src/exec/partitioned_aggregation_node.cc:440
#11 0x000000000159407f in doris::PartitionedAggregationNode::get_next (this=0xb215b80, state=<optimized out>, row_batch=0x899e2f20, eos=<optimized out>)
    at /builds/BkUi_hk7/0/olap/doris/be/src/exec/partitioned_aggregation_node.cc:363
#12 0x00000000010985df in doris::PlanFragmentExecutor::get_next_internal (this=this@entry=0x8ede9270, batch=batch@entry=0x7f7584151368)
    at /builds/BkUi_hk7/0/olap/doris/be/src/runtime/plan_fragment_executor.cpp:474
#13 0x0000000001099aa1 in doris::PlanFragmentExecutor::open_internal (this=this@entry=0x8ede9270) at /builds/BkUi_hk7/0/olap/doris/be/src/runtime/plan_fragment_executor.cpp:283
#14 0x000000000109a350 in doris::PlanFragmentExecutor::open (this=this@entry=0x8ede9270) at /builds/BkUi_hk7/0/olap/doris/be/src/runtime/plan_fragment_executor.cpp:249
#15 0x000000000101bdbb in doris::FragmentExecState::execute (this=0x8ede9200) at /builds/BkUi_hk7/0/olap/doris/be/src/runtime/fragment_mgr.cpp:220
#16 0x000000000101e526 in doris::FragmentMgr::exec_actual(std::shared_ptr<doris::FragmentExecState>, std::function<void (doris::PlanFragmentExecutor*)>) (this=0x6113100, exec_state=..., cb=...)
    at /builds/BkUi_hk7/0/olap/doris/be/src/runtime/fragment_mgr.cpp:430
#17 0x0000000001023c1c in __invoke_impl<void, void (doris::FragmentMgr::*&)(std::shared_ptr<doris::FragmentExecState>, std::function<void(doris::PlanFragmentExecutor*)>), doris::FragmentMgr*&, std::shared_ptr<doris::FragmentExecState>&, std::function<void(doris::PlanFragmentExecutor*)>&> (__t=@0xf640d580: 0x6113100, __f=
    @0xf640d540: (void (doris::FragmentMgr::*)(doris::FragmentMgr * const, std::shared_ptr<doris::FragmentExecState>, std::function<void(doris::PlanFragmentExecutor*)>)) 0x101e500 <doris::FragmentMgr::exec_actual(std::shared_ptr<doris::FragmentExecState>, std::function<void (doris::PlanFragmentExecutor*)>)>) at /usr/include/c++/7.3.0/bits/invoke.h:73
#18 __invoke<void (doris::FragmentMgr::*&)(std::shared_ptr<doris::FragmentExecState>, std::function<void(doris::PlanFragmentExecutor*)>), doris::FragmentMgr*&, std::shared_ptr<doris::FragmentExecState>&, std::function<void(doris::PlanFragmentExecutor*)>&> (__fn=
    @0xf640d540: (void (doris::FragmentMgr::*)(doris::FragmentMgr * const, std::shared_ptr<doris::FragmentExecState>, std::function<void(doris::PlanFragmentExecutor*)>)) 0x101e500 <doris::FragmentMgr::exec_actual(std::shared_ptr<doris::FragmentExecState>, std::function<void (doris::PlanFragmentExecutor*)>)>) at /usr/include/c++/7.3.0/bits/invoke.h:95
#19 __call<void, 0, 1, 2> (__args=..., this=0xf640d540) at /usr/include/c++/7.3.0/functional:632
#20 operator()<> (this=0xf640d540) at /usr/include/c++/7.3.0/functional:718
#21 std::_Function_handler<void (), std::_Bind_result<void, void (doris::FragmentMgr::*(doris::FragmentMgr*, std::shared_ptr<doris::FragmentExecState>, std::function<void (doris::PlanFragmentExecutor*)>))(std::shared_ptr<doris::FragmentExecState>, std::function<void (doris::PlanFragmentExecutor*)>)> >::_M_invoke(std::_Any_data const&) (__functor=...) at /usr/include/c++/7.3.0/bits/std_function.h:316
#22 0x00000000011ade82 in operator() (this=0x151f3058) at /usr/include/c++/7.3.0/bits/std_function.h:706
#23 run (this=0x151f3050) at /builds/BkUi_hk7/0/olap/doris/be/src/util/threadpool.cpp:42
#24 doris::ThreadPool::dispatch_thread (this=0x6be7c20) at /builds/BkUi_hk7/0/olap/doris/be/src/util/threadpool.cpp:551
#25 0x00000000011a5ce8 in operator() (this=0x8a9a2e8) at /usr/include/c++/7.3.0/bits/std_function.h:706
#26 doris::Thread::supervise_thread (arg=0x8a9a2d0) at /builds/BkUi_hk7/0/olap/doris/be/src/util/thread.cpp:385
#27 0x00007f75da561dc5 in start_thread () from /lib64/libpthread.so.0
#28 0x00007f75da86d73d in clone () from /lib64/libc.so.6
(gdb) f 3
#3  doris::ExprContext::get_value (this=0xf660b680, row=row@entry=0x139dee000) at /builds/BkUi_hk7/0/olap/doris/be/src/exprs/expr_context.cpp:254
254	/builds/BkUi_hk7/0/olap/doris/be/src/exprs/expr_context.cpp: 没有那个文件或目录.
(gdb) p row
$1 = (doris::TupleRow *) 0x139dee000
(gdb) p *(doris::TupleRow *) 0x139dee000
$2 = {
  _tuples = {0x1d380a000}
}
(gdb) f 2
#2  0x0000000000d76daf in get_value (row=0xf660b680, e=<optimized out>, this=0xf660b680) at /builds/BkUi_hk7/0/olap/doris/be/src/exprs/expr_context.cpp:302
302	in /builds/BkUi_hk7/0/olap/doris/be/src/exprs/expr_context.cpp
(gdb) p row
$3 = (doris::TupleRow *) 0xf660b680
(gdb) p *(doris::TupleRow *) 0xf660b680
$4 = {
  _tuples = {0x0}
}
(gdb)

I'm confused why the value of TupleRow * point row changed between frame 2 and frame 3.