Fix: Prevent nil pointer dereference in FOR UPDATE with CTE (#23165)

aptend · web-flow · commit a630c553f2d6 · 2025-11-28T04:48:12.000Z
Fix nil pointer dereference panic when using `FOR UPDATE` with CTE. Added a nil check before accessing `tableDef` in `bindSelectClause` to prevent panic when `tableDef` is `nil` (which happens when the node is a PROJECT node from a CTE/subquery, not a base table). Approved by: @ouyuanning, @aunjgr
diff --git a/pkg/sql/plan/query_builder.go b/pkg/sql/plan/query_builder.go
@@ -3246,8 +3246,7 @@ func (builder *QueryBuilder) bindSelectClause(
 		return
 	}
 
-	if builder.isForUpdate {
-		tableDef := builder.qry.Nodes[nodeID].GetTableDef()
+	if tableDef := builder.qry.Nodes[nodeID].GetTableDef(); tableDef != nil && builder.isForUpdate {
 		pkPos, pkTyp := getPkPos(tableDef, false)
 		lastTag := builder.qry.Nodes[nodeID].BindingTags[0]
 		lockTarget := &plan.LockTarget{

Original file line number	Diff line number	Diff line change
`@@ -3246,8 +3246,7 @@ func (builder *QueryBuilder) bindSelectClause(`
`3246`	`3246`	`return`
`3247`	`3247`	`}`
`3248`	`3248`
`3249`		`- if builder.isForUpdate {`
`3250`		`- tableDef := builder.qry.Nodes[nodeID].GetTableDef()`
	`3249`	`+ if tableDef := builder.qry.Nodes[nodeID].GetTableDef(); tableDef != nil && builder.isForUpdate {`
`3251`	`3250`	`pkPos, pkTyp := getPkPos(tableDef, false)`
`3252`	`3251`	`lastTag := builder.qry.Nodes[nodeID].BindingTags[0]`
`3253`	`3252`	`lockTarget := &plan.LockTarget{`