[Bug]: `union all` 不同的类型时，`to_base64(NULL)` 有时会得到错误的结果

Describe the bug
master分支版本，union all 不同的类型时，to_base64(NULL) 有时会得到错误的结果

Fast Reproduce Steps(Required)
先执行init.sql建表，随后执行error_crash.sql，有时导致预期之外的结果，有时导致某个节点崩溃。error.sql是简化后的版本，可导致出现预期之外的结果
init.sql.txt
error_crash.sql.txt
error.sql.txt

executable and coredump

Expected behavior

to_base64(null)在单独执行时输出null：

mysql> select to_base64(
    ->       cast(cast(null as char) as char));
+----------------------------------------------------+
| to_base64(
      cast(cast(null as char) as char)) |
+----------------------------------------------------+
| NULL                                               |
+----------------------------------------------------+
1 row in set (0.00 sec)

Actual Behavior
但在union all列类型不同时（第一个查询为数字，第二个查询为文本），有时会错误地输出空字符串，有时会正确地输出NULL。

Environment

Linux c0bae494cabb 6.5.0-18-generic #18~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Wed Feb  7 11:40:03 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

commit 7ead2595472f666ae677b2a820aef3bfe40ffcb0 (HEAD -> master, origin/master)

observer (OceanBase_CE 4.3.1.0)

REVISION: 1-7ead2595472f666ae677b2a820aef3bfe40ffcb0
BUILD_BRANCH: master
BUILD_TIME: Apr 29 2024 21:37:35
BUILD_FLAGS: RelWithDebInfo
BUILD_INFO: 

Copyright (c) 2011-present OceanBase Inc.

部署配置文件

user:
  username: root
  key_file: private_key
oceanbase-ce:
  servers:
    - name: server1
      ip: 10.0.10.11
    - name: server2
      ip: 10.0.10.12
    - name: server3
      ip: 10.0.10.13
  server1:
    mysql_port: 10000
    rpc_port: 10001
    home_path: /root/data/observer1
    zone: zone1
  server2:
    mysql_port: 10000
    rpc_port: 10001
    home_path: /root/data/observer2
    zone: zone2
  server3:
    mysql_port: 10000
    rpc_port: 10001
    home_path: /root/data/observer3
    zone: zone3
  tag: latest
  include: obd/observer.include.yaml
  global: 
    # for default system config used by farm, please see tools/deploy/obd/observer.include.yaml
    # You can also specify the configuration directly below (stored locally, switching the working directory and redeploying will still take effect)
    production_mode: false
    devname: eth0
    syslog_level: 'WARN'
    syslog_io_bandwidth_limit: '30M'
    log_disk_size: '30G'
    # diag_syslog_per_error_limit: '4'
    max_syslog_file_count: '4'
    cpu_count: '6'
    datafile_size: '10G'
    datafile_next: '5G'
    datafile_maxsize: '30G'
    root_password: ''
    memory_limit: '9G'
    system_memory: '1G'
obproxy-ce:
  servers:
    - 10.0.10.8
  global:
    listen_port: 10004
    prometheus_listen_port: 10005
    syslog_level: 'WARN'
    home_path: /root/data/obproxy
    root_password: ''
  include: obd/obproxy.include.yaml
  depends:
    - oceanbase-ce

租户配置：

DROP TENANT mysql FORCE;
DROP RESOURCE POOL pool_for_tenant_mysql;

CREATE RESOURCE UNIT 4c7g MAX_CPU 4, MIN_CPU 4, MEMORY_SIZE '7G';
create resource pool pool_test unit='4c7g', unit_num=1, zone_list=('zone1' ,'zone2', 'zone3');
create tenant test resource_pool_list=('pool_test'), primary_zone='RANDOM',comment 'test tenant', charset='utf8' set ob_tcp_invited_nodes='%', recyclebin=OFF, ob_query_timeout=5000000;

Additional Context
我们是来自北京航空航天大学网络空间安全学院的BASS团队，主要从事系统软件安全、操作系统和程序分析研究，研发自动化程序测试框架检测软件缺陷。我们使用自研的数据库漏洞测试工具在OceanBase中找到了上述可能的漏洞。

Start by running init.sql.txt followed by error.sql.txt to reproduce the incorrect empty-string versus NULL result, then use error_crash.sql.txt to investigate the node crash. Compare the UNION ALL type-coercion path with the standalone to_base64(NULL) behavior; done means the result is consistently NULL and the crash is no longer reproducible.