[BugFix] fix asan crash in array_map

[silverbullet233]

Why I'm doing:

What I'm doing:

Fixes https://github.com/StarRocks/StarRocksTest/issues/8699

root cause

this crash is because we can't find the slot id in chunk and then can't pass the DCHECK inside it.

In fact, for array_map(x -> array_map(x->x+100, x),[[1,23],[4,3,2]]), the lambda expr x->array_map(x->x+100,x)
only depends on the lambda argument, not on other capture columns. capture_slot_ids should be empty here.
But the argument of the inner lambda expr array_map(x->x+100,x)is mistakenly regarded as the capture column and be added into the capture_slot_ids.

1. we use LambdaFunction::get_slot_ids to get the capture columns' slot id, and the result of this interface incorrectly includes the lambda argument id. this is the root cause of the above crash.
2. on the other hand, before executing extract_outer_common_exprs , we need to know the maximum slot_id used in the current Expr tree. The rewritten ColumnRef will allocate slot_id from the max_used_slot_id + 1. Here we need to consider the slot_id used by the lambda arguments. Currently, LambdaFunction:get_slot_ids is also used to get the result.

Obviously, these two places rely on LambdaFunction::get_slot_ids and there is a conflict. One needs to consider the lambda argument and the other does not.

To solve this problem

1. modify the behavior of LambdaFunction::get_slot_ids, and only include the capture columns' slot id in the return result
2. add a new interface Expr::for_each_slot_id to traverse all slot ids in a certain Expr tree.

What type of PR is this:

• BugFix
• Feature
• Enhancement
• Refactor
• UT
• Doc
• Tool

Does this PR entail a change in behavior?

• Yes, this PR will result in a change in behavior.
• No, this PR will not result in a change in behavior.

If yes, please specify the type of change:

• Interface/UI changes: syntax, type conversion, expression evaluation, display information
• Parameter changes: default values, similar parameters but with different default values
• Policy changes: use new policy to replace old one, functionality automatically enabled
• Feature removed
• Miscellaneous: upgrade & downgrade compatibility, etc.

Checklist:

• I have added test cases for my bug fix or my new feature
• This pr needs user documentation (for new or modified features or behaviors)
  • I have added documentation for my new feature or new function
• This is a backport pr

Bugfix cherry-pick branch check:

• I have checked the version labels which the pr will be auto-backported to the target branch
  • 3.3
  • 3.2
  • 3.1
  • 3.0
  • 2.5

[github-actions]

[Java-Extensions Incremental Coverage Report]

✅ pass : 0 / 0 (0%)

[github-actions]

[FE Incremental Coverage Report]

✅ pass : 0 / 0 (0%)

[github-actions]

[BE Incremental Coverage Report]

✅ pass : 12 / 13 (92.31%)

file detail

	path	covered_line	new_line	coverage	not_covered_line_detail
🔵	be/src/exprs/placeholder_ref.h	0	1	00.00%	[35]
🔵	be/src/exprs/column_ref.cpp	3	3	100.00%	[]
🔵	be/src/exprs/expr.cpp	4	4	100.00%	[]
🔵	be/src/exprs/lambda_function.cpp	5	5	100.00%	[]

[LiShuMing]

solid!

[github-actions]

@Mergifyio backport branch-3.3

[github-actions]

@Mergifyio backport branch-3.2

[mergify]

backport branch-3.3

✅ Backports have been created

• #52006 [BugFix] fix asan crash in array_map (backport #51966) has been created for branch branch-3.3

[mergify]

backport branch-3.2

✅ Backports have been created

• #52007 [BugFix] fix asan crash in array_map (backport #51966) has been created for branch branch-3.2

[silverbullet233]

@mergify backport branch-3.3.5

[mergify]

backport branch-3.3.5

✅ Backports have been created

• #52008 [BugFix] fix asan crash in array_map (backport #51966) has been created for branch branch-3.3.5