makeslice: len out of range in `executor.(*executorBuilder).buildShuffle`

## Bug Report

Please answer these questions before submitting your issue. Thanks!

### 1. Minimal reproduce step (Required)

SQL to init database

```sql
create table t_dci (
c_dph7 int ,
c_l1t tinyint ,
c_d3wokzls77 int ,
c_bywfl tinyint unique ,
c_kzre text ,
c_fzqupuma int not null ,
c_w9qyk_fpj double not null ,
c_ib1xsf3c8d tinyint ,
primary key(c_d3wokzls77, c_dph7) CLUSTERED) pre_split_regions=6;

create table t_jg8o (
c_otj13 int unique ,
c_foveoe text ,
c_jbb text ,
c_s int not null unique ,
c_ovz0 double ,
c_m0qqv_cl4x text ,
c_cz text not null ,
c__qy double ,
c_z int not null ,
c_a90ol text not null ,
primary key(c_z) CLUSTERED) pre_split_regions=2;

create table t_rc (
c_m2y int ,
c_yu tinyint not null ,
primary key(c_m2y) CLUSTERED) pre_split_regions=2;

create table t__9r63 (
c_g7eofzlxn int ,
c_r58lkh double ,
c_x2erxo10w int ,
c_wsr tinyint ,
c_hd2v4v0 double ,
c_tb3u text ,
c_onfeptr2q tinyint unique ,
primary key(c_g7eofzlxn, c_x2erxo10w) CLUSTERED) pre_split_regions=7;

alter table t__9r63 add column c_o8tsf double;

alter table t_rc add column c_b48gd04utl text;

```

SQL that causes error

```sql
SELECT
first_value(
cast(subq_0.c9 as signed)) over (partition by subq_0.c0 order by subq_0.c2) as c1
FROM
(select

count(
cast((select c_yu from t_rc order by c_yu limit 1 offset 6)
as signed)) over (partition by ref_11.c_b48gd04utl order by ref_11.c_b48gd04utl, ref_11.c_b48gd04utl, ref_11.c_b48gd04utl, ref_11.c_b48gd04utl, ref_11.c_b48gd04utl, ref_11.c_b48gd04utl, ref_11.c_b48gd04utl, ref_11.c_b48gd04utl, ref_11.c_b48gd04utl, ref_11.c_b48gd04utl, ref_11.c_b48gd04utl) as c0,

count(
cast((select c_l1t from t_dci order by c_l1t limit 1 offset 6)
as signed)) over (partition by ref_2.c_x2erxo10w, ref_7.c_yu order by ref_3.c_yu, ref_9.c_m2y) as c1,
ref_0.c_tb3u as c2,
(select c_a90ol from t_jg8o order by c_a90ol limit 1 offset 5)
as c3,
ref_6.c_m2y as c4,
ref_6.c_yu as c5,
ref_9.c_yu as c6,
ref_5.c_m2y as c7,
ref_0.c_r58lkh as c8,
82569031 as c9,
(select c_b48gd04utl from t_rc order by c_b48gd04utl limit 1 offset 5)
as c10,
ref_4.c_m2y as c11
from
(((t__9r63 as ref_0
left outer join t__9r63 as ref_1
on ((NOT NOT(cast((ref_1.c_hd2v4v0 && ref_0.c_wsr) as unsigned)))))
left outer join (t__9r63 as ref_2
left outer join t_rc as ref_3
on ((NOT NOT(cast((cast(ref_3.c_b48gd04utl as char) <=> cast(ref_3.c_b48gd04utl as char)) as unsigned)))))
on ((NOT NOT(cast((cast(ref_1.c_o8tsf as double) > cast((NOT NOT(cast((cast(ref_3.c_b48gd04utl as char) <=> cast(ref_3.c_b48gd04utl as char)) as unsigned))) as unsigned)) as unsigned)))))
left outer join (((t_rc as ref_4
right outer join t_rc as ref_5
on ((NOT NOT(cast((cast(ref_5.c_b48gd04utl as char) <=> cast(ref_5.c_b48gd04utl as char)) as unsigned)))))
right outer join (t_rc as ref_6
right outer join t_rc as ref_7
on ((NOT NOT(cast((cast(ref_7.c_b48gd04utl as char) <=> cast(ref_7.c_b48gd04utl as char)) as unsigned)))))
on ((NOT NOT(cast((cast(ref_7.c_b48gd04utl as char) <=> cast(ref_7.c_b48gd04utl as char)) as unsigned)))))
right outer join ((t_rc as ref_8
right outer join t_rc as ref_9
on ((NOT NOT(cast((cast(ref_9.c_b48gd04utl as char) <=> cast(ref_9.c_b48gd04utl as char)) as unsigned)))))
right outer join (t_rc as ref_10
right outer join t_rc as ref_11
on ((NOT NOT(cast((cast(ref_11.c_b48gd04utl as char) <=> cast(ref_11.c_b48gd04utl as char)) as unsigned)))))
on ((NOT NOT(cast((cast(ref_11.c_b48gd04utl as char) <=> cast(ref_11.c_b48gd04utl as char)) as unsigned)))))
on ((NOT NOT(cast((cast(ref_7.c_b48gd04utl as char) <=> cast(ref_7.c_b48gd04utl as char)) as unsigned)))))
on ((NOT NOT(cast((cast(ref_11.c_b48gd04utl as char) <=> cast(ref_11.c_b48gd04utl as char)) as unsigned)))))
where ((NOT NOT(cast((cast((select c_b48gd04utl from t_rc order by c_b48gd04utl limit 1 offset 6)
as char) <=> cast((select c_b48gd04utl from t_rc order by c_b48gd04utl limit 1 offset 6)
as char)) as unsigned))))
and ((NOT NOT(cast((cast((select c_b48gd04utl from t_rc order by c_b48gd04utl limit 1 offset 6)
as char) <=> cast((select c_b48gd04utl from t_rc order by c_b48gd04utl limit 1 offset 6)
as char)) as unsigned))))) as subq_0;

```

### 2. What did you expect to see? (Required)
Expect no crashes
### 3. What did you see instead (Required)
```
runtime error: makeslice: len out of range
github.com/pingcap/tidb/pkg/server.(*clientConn).Run.func1
/workspace/source/tidb/pkg/server/conn.go:1044
runtime.gopanic
/usr/local/go/src/runtime/panic.go:914
github.com/pingcap/tidb/pkg/executor.(*ExecStmt).Exec.func1
/workspace/source/tidb/pkg/executor/adapter.go:487
runtime.gopanic
/usr/local/go/src/runtime/panic.go:920
runtime.panicmakeslicelen
/usr/local/go/src/runtime/slice.go:29
runtime.makeslice
/usr/local/go/src/runtime/slice.go:98
github.com/pingcap/tidb/pkg/executor.(*executorBuilder).buildShuffle
/workspace/source/tidb/pkg/executor/builder.go:5094
github.com/pingcap/tidb/pkg/executor.(*executorBuilder).build
/workspace/source/tidb/pkg/executor/builder.go:299
github.com/pingcap/tidb/pkg/executor.(*executorBuilder).buildProjection
/workspace/source/tidb/pkg/executor/builder.go:2017
github.com/pingcap/tidb/pkg/executor.(*executorBuilder).build
/workspace/source/tidb/pkg/executor/builder.go:277
github.com/pingcap/tidb/pkg/executor.(*ExecStmt).buildExecutor
/workspace/source/tidb/pkg/executor/adapter.go:1215
github.com/pingcap/tidb/pkg/executor.(*ExecStmt).Exec
/workspace/source/tidb/pkg/executor/adapter.go:558
github.com/pingcap/tidb/pkg/session.runStmt
/workspace/source/tidb/pkg/session/session.go:2284
github.com/pingcap/tidb/pkg/session.(*session).ExecuteStmt
/workspace/source/tidb/pkg/session/session.go:2145
github.com/pingcap/tidb/pkg/server.(*TiDBContext).ExecuteStmt
/workspace/source/tidb/pkg/server/driver_tidb.go:291
github.com/pingcap/tidb/pkg/server.(*clientConn).handleStmt
/workspace/source/tidb/pkg/server/conn.go:2058
github.com/pingcap/tidb/pkg/server.(*clientConn).handleQuery
/workspace/source/tidb/pkg/server/conn.go:1811
github.com/pingcap/tidb/pkg/server.(*clientConn).dispatch
/workspace/source/tidb/pkg/server/conn.go:1385
github.com/pingcap/tidb/pkg/server.(*clientConn).Run
/workspace/source/tidb/pkg/server/conn.go:1147
github.com/pingcap/tidb/pkg/server.(*Server).onConn
/workspace/source/tidb/pkg/server/server.go:741

```
### 4. What is your TiDB version? (Required)

```
Release Version: v8.4.0-alpha-66-g1167e0c
Edition: Community
Git Commit Hash: 1167e0c06fc8e2dd066bd974315284bc0e884acc
Git Branch: HEAD
UTC Build Time: 2024-09-03 01:15:19
GoVersion: go1.21.13
Race Enabled: false
Check Table Before Drop: false
Store: tikv
```

We are the BASS team from the School of Cyber Science and Technology at Beihang University. Our main focus is on system software security, operating systems, and program analysis research, as well as the development of automated program testing frameworks for detecting software defects. Using our self-developed database vulnerability testing tool, we have identified the above-mentioned vulnerabilities in TiDB that may lead to database crashes.