Unexpected error: "interface conversion: expression.Expression is nil, not *expression.ScalarFunction"

## Bug Report

Please answer these questions before submitting your issue. Thanks!

### 1. Minimal reproduce step (Required)
```sql
DROP TABLE tb0;
DROP TABLE tb1;
DROP TABLE tb2;
DROP VIEW v1;
CREATE TABLE tb0 (id INT UNIQUE AUTO_INCREMENT NOT NULL, c0 YEAR DEFAULT 2000, c1 DATETIME, c2 LONGTEXT, c3 VARBINARY(182)) CHARSET=utf8mb4;
CREATE TABLE tb1 (id INT UNIQUE AUTO_INCREMENT NOT NULL, c0 CHAR(162), PRIMARY KEY (`id`)) CHARSET=latin1;
CREATE TABLE tb2 (id INT UNIQUE AUTO_INCREMENT NOT NULL, c0 BINARY(8), c1 TIME DEFAULT '12:00:00', c2 DECIMAL(33,25) DEFAULT 0.00, c3 VARCHAR(135) DEFAULT 'test');
CREATE VIEW v1 AS SELECT id, c0, c1, c2, c3, CASE WHEN id IS NULL THEN 'NO_DATA' ELSE 'HAS_DATA' END AS data_status FROM tb2 ORDER BY id DESC LIMIT 100;

SELECT /*+ read_from_storage(tikv[t0,t1,t2,t3]) */ COUNT(t2.c0), COUNT(*) FROM v1 AS t0 INNER JOIN tb1 AS t1 ON (t0.data_status = t1.c0) INNER JOIN tb0 AS t2 ON (t1.id = t2.c2) RIGHT JOIN (SELECT /*+ read_from_storage(tikv[t0]) */ t0.c0 AS col_0 FROM tb1 AS t0) AS t3 ON (t2.c1 = t3.col_0) WHERE t2.c2 GROUP BY t0.id, t0.c0, t0.c2, t0.data_status HAVING (COUNT(*) < 87);
```

### 2. What did you expect to see? (Required)
no error
MySQL Behavior:
```sql
mysql> SELECT /*+ read_from_storage(tikv[t0,t1,t2,t3]) */ COUNT(t2.c0), COUNT(*) FROM v1 AS t0 INNER JOIN tb1 AS t1 ON (t0.data_status = t1.c0) INNER JOIN tb0 AS t2 ON (t1.id = t2.c2) RIGHT JOIN (SELECT /*+ read_from_storage(tikv[t0]) */ t0.c0 AS col_0 FROM tb1 AS t0) AS t3 ON (t2.c1 = t3.col_0) WHERE t2.c2 GROUP BY t0.id, t0.c0, t0.c2, t0.data_status HAVING (COUNT(*) < 87);
Empty set, 2 warnings (0.001 sec)

mysql> select version();
+-----------+
| version() |
+-----------+
| 8.4.6 |
+-----------+
1 row in set (0.000 sec)
```
### 3. What did you see instead (Required)
```sql
mysql> SELECT /*+ read_from_storage(tikv[t0,t1,t2,t3]) */ COUNT(t2.c0), COUNT(*) FROM v1 AS t0 INNER JOIN tb1 AS t1 ON (t0.data_status = t1.c0) INNER JOIN tb0 AS t2 ON (t1.id = t2.c2) RIGHT JOIN (SELECT /*+ read_from_storage(tikv[t0]) */ t0.c0 AS col_0 FROM tb1 AS t0) AS t3 ON (t2.c1 = t3.col_0) WHERE t2.c2 GROUP BY t0.id, t0.c0, t0.c2, t0.data_status HAVING (COUNT(*) < 87);
ERROR 1105 (HY000): interface conversion: expression.Expression is nil, not *expression.ScalarFunction
```
log info
```
[ERROR] [conn.go:1050] ["connection running loop panic"]
[conn=1675624456]
[session_alias=]
[lastSQL="SELECT /*+ read_from_storage(tikv[t0,t1,t2,t3]) */ COUNT(t2.c0), COUNT(*) FROM v1 AS t0 INNER JOIN tb1 AS t1 ON (t0.data_status = t1.c0) INNER JOIN tb0 AS t2 ON (t1.id = t2.c2) RIGHT JOIN (SELECT /*+ read_from_storage(tikv[t0]) */ t0.c0 AS col_0 FROM tb1 AS t0) AS t3 ON (t2.c1 = t3.col_0) WHERE t2.c2 GROUP BY t0.id, t0.c0, t0.c2, t0.data_status HAVING (COUNT(*) < 87)"]
[err="interface conversion: expression.Expression is nil, not *expression.ScalarFunction"]
[stack="
github.com/pingcap/tidb/pkg/server.(*clientConn).Run.func1
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/server/conn.go:1053
runtime.gopanic
/Users/pingcap/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.23.11.darwin-arm64/src/runtime/panic.go:791
github.com/pingcap/tidb/pkg/executor.(*Compiler).Compile.func1
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/executor/compiler.go:59
runtime.gopanic
/Users/pingcap/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.23.11.darwin-arm64/src/runtime/panic.go:791
runtime.panicdottypeE
/Users/pingcap/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.23.11.darwin-arm64/src/runtime/iface.go:275
runtime.panicdottypeI
/Users/pingcap/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.23.11.darwin-arm64/src/runtime/iface.go:285
github.com/pingcap/tidb/pkg/planner/core/operator/logicalop.(*LogicalJoin).ExtractOnCondition
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/planner/core/operator/logicalop/logical_join.go:1319
github.com/pingcap/tidb/pkg/planner/core/operator/logicalop.(*LogicalJoin).extractOnCondition
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/planner/core/operator/logicalop/logical_join.go:1407
github.com/pingcap/tidb/pkg/planner/core/operator/logicalop.(*LogicalJoin).PredicatePushDown
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/planner/core/operator/logicalop/logical_join.go:266
github.com/pingcap/tidb/pkg/planner/core/operator/logicalop.(*LogicalSelection).PredicatePushDown
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/planner/core/operator/logicalop/logical_selection.go:111
github.com/pingcap/tidb/pkg/planner/core/operator/logicalop.(*LogicalJoin).PredicatePushDown
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/planner/core/operator/logicalop/logical_join.go:301
github.com/pingcap/tidb/pkg/planner/core/operator/logicalop.(*LogicalSelection).PredicatePushDown
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/planner/core/operator/logicalop/logical_selection.go:111
github.com/pingcap/tidb/pkg/planner/core/operator/logicalop.(*LogicalJoin).PredicatePushDown
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/planner/core/operator/logicalop/logical_join.go:301
github.com/pingcap/tidb/pkg/planner/core/operator/logicalop.(*LogicalSelection).PredicatePushDown
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/planner/core/operator/logicalop/logical_selection.go:111
github.com/pingcap/tidb/pkg/planner/core/operator/logicalop.(*BaseLogicalPlan).PredicatePushDown
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/planner/core/operator/logicalop/base_logical_plan.go:145
github.com/pingcap/tidb/pkg/planner/core/operator/logicalop.(*LogicalAggregation).PredicatePushDown
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/planner/core/operator/logicalop/logical_aggregation.go:111
github.com/pingcap/tidb/pkg/planner/core/operator/logicalop.(*LogicalSelection).PredicatePushDown
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/planner/core/operator/logicalop/logical_selection.go:111
github.com/pingcap/tidb/pkg/planner/core/operator/logicalop.(*BaseLogicalPlan).PredicatePushDown
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/planner/core/operator/logicalop/base_logical_plan.go:145
github.com/pingcap/tidb/pkg/planner/core/operator/logicalop.(*LogicalProjection).PredicatePushDown
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/planner/core/operator/logicalop/logical_projection.go:102
github.com/pingcap/tidb/pkg/planner/core.(*PPDSolver).Optimize
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/planner/core/rule_predicate_push_down.go:46
github.com/pingcap/tidb/pkg/planner/core.logicalOptimize
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/planner/core/optimizer.go:1089
github.com/pingcap/tidb/pkg/planner/core.VolcanoOptimize
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/planner/core/optimizer.go:339
github.com/pingcap/tidb/pkg/planner/core.doOptimize
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/planner/core/optimizer.go:288
github.com/pingcap/tidb/pkg/planner/core.DoOptimize
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/planner/core/optimizer.go:401
github.com/pingcap/tidb/pkg/planner.optimize
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/planner/optimize.go:529
github.com/pingcap/tidb/pkg/planner.optimizeNoCache
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/planner/optimize.go:361
github.com/pingcap/tidb/pkg/planner.Optimize
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/planner/optimize.go:217
github.com/pingcap/tidb/pkg/executor.(*Compiler).Compile
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/executor/compiler.go:102
github.com/pingcap/tidb/pkg/session.(*session).ExecuteStmt
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/session/session.go:2162
github.com/pingcap/tidb/pkg/server.(*TiDBContext).ExecuteStmt
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/server/driver_tidb.go:291
github.com/pingcap/tidb/pkg/server.(*clientConn).handleStmt
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/server/conn.go:2046
github.com/pingcap/tidb/pkg/server.(*clientConn).handleQuery
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/server/conn.go:1802
github.com/pingcap/tidb/pkg/server.(*clientConn).dispatch
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/server/conn.go:1392
github.com/pingcap/tidb/pkg/server.(*clientConn).Run
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/server/conn.go:1158
github.com/pingcap/tidb/pkg/server.(*Server).onConn
/Users/pingcap/workspace/bp-tidb-release-darwin-arm64-hcw5f-build-binaries/source/tidb/pkg/server/server.go:790
"]
```
### 4. What is your TiDB version? (Required)
```
+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| tidb_version() |
+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Release Version: v9.0.0-beta.2.pre-250-ga6d415f24a
Edition: Community
Git Commit Hash: a6d415f24a7d182ebca3d189c457d9044537028f
Git Branch: HEAD
UTC Build Time: 2025-08-03 10:01:12
GoVersion: go1.23.11
Race Enabled: false
Check Table Before Drop: false
Store: tikv
Kernel Type: Classic |
+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
```