[Bug] BE crashes with SIGSEGV in BinaryColumnBase::filter_range → NullableColumn::filter_range → Chunk::filter_range on v4.0.12

Steps to reproduce the behavior (Required)

1. Run sql:

SELECT app_code, COALESCE( get_json_string(OUTPUT, '$.CBSCORE'), get_json_string(OUTPUT, '$.cbscore'), get_json_string(OUTPUT, '$.CBScore') ) AS CB_Score, COALESCE( get_json_string(OUTPUT, '$.CBRANK'), get_json_string(OUTPUT, '$.cbrank'), get_json_string(OUTPUT, '$.CBRank') ) AS CB_Rank, CREATED_DATE, SCORE_STAGE, CURRENT_STAGE, get_json_string(UPPER(OUTPUT), '$.CBHITTYPE') AS CBHITTYPE FROM dmapp.dtm_los_log_cbscore

1. BE crashed:

Run with JEMALLOC_CONF: 'percpu_arena:percpu,oversize_threshold:0,muzzy_decay_ms:5000,dirty_decay_ms:5000,metadata_thp:auto,background_thread:true,prof:true,prof_active:false' 4.0.12 RELEASE (build 1fe715d distro centos arch x86_64) query_id:01a0b276-0ec1-72c9-b9d8-425138bfe789, fragment_instance:01a0b276-0ec1-72c9-b9d8-425138bfe78c, plan_node_id:0 *** Aborted at 1789700478 (unix time) try "date -d @1789700478" if you are using GNU date *** PC: @ 0x15450d16c10d __memcpy_evex_unaligned_erms *** SIGSEGV (@0x645f6174) received by PID 3006359 (TID 0x15444ee72640) LWP(3006729) from PID 1683972468; stack trace: *** @ 0x15450d0904f8 __pthread_once_slow @ 0xdfdcd94 google::(anonymous namespace)::FailureSignalHandler(int, siginfo_t*, void*) @ 0x15450e6cf99e PosixSignals::chained_handler(int, siginfo_t*, void*) [clone .part.0] @ 0x15450e6d0496 JVM_handle_linux_signal @ 0x15450d03fc30 (/usr/lib64/libc.so.6+0x3fc2f) @ 0x15450d16c10d __memcpy_evex_unaligned_erms @ 0x90041dc starrocks::BinaryColumnBase::filter_range(std::vector<unsigned char, starrocks::ColumnAllocator > const&, unsigned long, unsigned long) @ 0x8fdfd8e starrocks::NullableColumn::filter_range(std::vector<unsigned char, starrocks::ColumnAllocator > const&, unsigned long, unsigned long) @ 0x8f670c9 starrocks::Chunk::filter_range(std::vector<unsigned char, starrocks::ColumnAllocator > const&, unsigned long, unsigned long) @ 0x77c381b starrocks::SegmentIterator::_do_get_next(starrocks::Chunk*, std::vector<unsigned int, std::allocator >) @ 0x77d0a21 starrocks::SegmentIterator::do_get_next(starrocks::Chunk) @ 0x78b17e6 starrocks::ProjectionIterator::do_get_next(starrocks::Chunk*) @ 0x8405d25 starrocks::SegmentIteratorWrapper::do_get_next(starrocks::Chunk*) @ 0x808784b starrocks::TimedChunkIterator::do_get_next(starrocks::Chunk*) @ 0x78ed899 starrocks::TabletReader::do_get_next(starrocks::Chunk*) @ 0xa80decd starrocks::pipeline::OlapChunkSource::_read_chunk_from_storage(starrocks::RuntimeState*, starrocks::Chunk*) @ 0xa80ea67 starrocks::pipeline::OlapChunkSource::_read_chunk(starrocks::RuntimeState*, std::shared_ptrstarrocks::Chunk) @ 0xa804dd0 starrocks::pipeline::ChunkSource::buffer_next_batch_chunks_blocking(starrocks::RuntimeState, unsigned long, starrocks::workgroup::WorkGroup const*) @ 0xa25df18 auto starrocks::pipeline::ScanOperator::_trigger_next_scan(starrocks::RuntimeState*, int)::{lambda(auto:1&)#1}::operator()starrocks::workgroup::YieldContext(starrocks::workgroup::YieldContext&) const [clone .isra.0] @ 0xa3a8fff starrocks::workgroup::ScanExecutor::worker_thread() @ 0x8752837 starrocks::ThreadPool::dispatch_thread() @ 0x8749530 starrocks::Thread::supervise_thread(void*) @ 0x15450d08b2ea start_thread @ 0x15450d110500 __clone3

1. FE audit log:

2026-09-18 10:02:28.565+07:00 [slow_query] |Timestamp=1789700476609|Client=10.0.82.23:50822|User=dmapp|AuthorizedUser='dmapp'@'%'|ResourceGroup=bui_wg|Catalog=default_catalog|Db=ptkd|State=ERR|ErrorCode=CANCELLED|Time=71956|ScanBytes=0|ScanRows=0|ReturnRows=0|StmtId=5261875|QueryId=01a0b276-0ec1-72c9-b9d8-425138bfe789|IsQuery=true|feIp=10.0.27.71|Stmt=/* ApplicationName=DBeaver 26.1.3 - SQLEditor <PTKD_3.sql> */ SELECT app_code, COALESCE( get_json_string(OUTPUT, '$.CBSCORE'), get_json_string(OUTPUT, '$.cbscore'), get_json_string(OUTPUT, '$.CBScore') ) AS CB_Score, COALESCE( get_json_string(OUTPUT, '$.CBRANK'), get_json_string(OUTPUT, '$.cbrank'), get_json_string(OUTPUT, '$.CBRank') ) AS CB_Rank, CREATED_DATE, SCORE_STAGE, CURRENT_STAGE, get_json_string(UPPER(OUTPUT), '$.CBHITTYPE') AS CBHITTYPE FROM dmapp.dtm_los_log_cbscore|Digest=|PlanCpuCost=6.502605264E9|PlanMemCost=0.0|Warehouse=default_warehouse|CNGroup=|IsForwardToLeader=false|QueryFEAllocatedMemory=2405984|SessionId=01a0b23d-5ea4-7822-b322-9c74114e795a|CustomQueryId=|TransmittedBytes=0|QuerySource=EXTERNAL|Command=MySQL.Query|QueriedRelations=[default_catalog.dmapp.dtm_los_log_cbscore]

Expected behavior (Required)

BE not crash

Real behavior (Required)

BE crashes with SIGSEGV

StarRocks version (Required)

v 4.0.12