[Bug]: Nil pointer dereference in DedupJoin.checkSnapshotAdvancedDuplicates

[XuPeng-SH]

Bug Description

PREPARE + EXECUTE of INSERT ... ON DUPLICATE KEY UPDATE on a table with PRIMARY KEY + extra UNIQUE KEY causes nil pointer dereference.

Repro

CREATE TABLE t (id VARCHAR(64) PRIMARY KEY, val VARCHAR(128) NOT NULL, UNIQUE KEY uq_val (val));
SET @id='id1', @val='v1';
PREPARE stmt FROM 'INSERT INTO t (id, val) VALUES (?, ?) ON DUPLICATE KEY UPDATE val = VALUES(val)';
EXECUTE stmt USING @id, @val;  -- PANIC

Direct INSERT works. PREPARE works with single PK only.

Root Cause

1. PREPARE sets StmtSnapshotTS, EXECUTE has newer SnapshotTS
2. InitialSnapshotTS < currentTS triggers checkSnapshotAdvancedDuplicates
3. join.go:627 passes [nil, buildBat] to Eval
4. evalExpression.go:607 calls batches[0].RowCount() on nil -> panic