From b30a0ab8ca5fa0cb54f4eaddc4c2dd92ff8d012f Mon Sep 17 00:00:00 2001
From: ou yuanning <45346669+ouyuanning@users.noreply.github.com>
Date: Sun, 26 Jan 2025 14:41:33 +0800
Subject: [PATCH] Fix bug: double free in Top Operator (#21339)

Fix bug: double free in Top Operator

Approved by: @badboynt1, @aressu1985
---
 pkg/sql/colexec/top/types.go                  |  3 ++-
 test/distributed/cases/prepare/prepare.result | 12 ++++++++++++
 test/distributed/cases/prepare/prepare.test   |  8 ++++++++
 3 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/pkg/sql/colexec/top/types.go b/pkg/sql/colexec/top/types.go
index 0352ed90d1502..0c09d1379c30b 100644
--- a/pkg/sql/colexec/top/types.go
+++ b/pkg/sql/colexec/top/types.go
@@ -131,7 +131,8 @@ func (ctr *container) reset(proc *process.Process) {
 	}
 
 	if ctr.buildBat != nil {
-		ctr.buildBat.Clean(proc.Mp())
+		//should not clean ctr.buildBat, because ctr.buildBat's value from PreOperator or ctr.executorsForOrderColumn.Eval
+		// PreOperator or ctr.executorsForOrderColumn will clean them
 		ctr.buildBat = nil
 	}
 }
diff --git a/test/distributed/cases/prepare/prepare.result b/test/distributed/cases/prepare/prepare.result
index 5cbf81d40f423..25f349fd325cd 100644
--- a/test/distributed/cases/prepare/prepare.result
+++ b/test/distributed/cases/prepare/prepare.result
@@ -641,4 +641,16 @@ internal error: table 'tb_delete_opt_to_truncate' has been changed, please reset
 set session delete_opt_to_truncate = 123;
 internal error: convert to the system variable bool type failed
 drop table tb_delete_opt_to_truncate;
+drop table if exists t1;
+create table t1 (a bigint not null auto_increment, b int, primary key(a));
+insert into t1(b) values (1),(2),(3);
+prepare s1 from select * from t1 where a = ? order by a limit 1 for update;
+set @a=1;
+execute s1 using @a;
+a    b
+1    1
+set @a=2;
+execute s1 using @a;
+a    b
+2    2
 drop database prepare_test_2;
diff --git a/test/distributed/cases/prepare/prepare.test b/test/distributed/cases/prepare/prepare.test
index c0580385e53d9..4d39aa6026896 100644
--- a/test/distributed/cases/prepare/prepare.test
+++ b/test/distributed/cases/prepare/prepare.test
@@ -494,6 +494,14 @@ execute st_delete_opt_to_truncate;
 set session delete_opt_to_truncate = 123;
 
 drop table tb_delete_opt_to_truncate;
+drop table if exists t1;
+create table t1 (a bigint not null auto_increment, b int, primary key(a));
+insert into t1(b) values (1),(2),(3);
+prepare s1 from select * from t1 where a = ? order by a limit 1 for update;
+set @a=1;
+execute s1 using @a;
+set @a=2;
+execute s1 using @a;
 drop database prepare_test_2;