nil pointer dereference triggered by INSERT

## Bug Report

Please answer these questions before submitting your issue. Thanks!

### 1. Minimal reproduce step (Required)

Hi,

The following test case triggers a nil pointer dereference

```
CREATE TABLE t0(c0 CHAR , c1 NUMERIC ZEROFILL , c2 BOOL DEFAULT true );
CREATE ALGORITHM=MERGE VIEW v0(c0, c1, c2) AS SELECT 0.5744235779532181, CAST((SELECT (NOT (t0.c1)) FROM t0 CROSS JOIN t0 AS t0_0 ON '듑' WHERE t0.c2) AS SIGNED), ((true)LIKE(-353269119)) FROM t0 LEFT OUTER JOIN t0 AS t0_0 ON t0_0.c0;
INSERT INTO t0(c2, c1) VALUES (false, 1420172923) ON DUPLICATE KEY UPDATE c2=(SELECT (SELECT v0.c2 FROM v0 WHERE v0.c2) FROM t0 WHERE 973867198 ORDER BY ((((t0.c1)&(((t0.c1)NOT REGEXP('-1015633450')))))NOT REGEXP((CASE t0.c2 WHEN NULL THEN '#\r' ELSE '' END ))) ASC);
-- runtime error: invalid memory address or nil pointer dereference
```

### 2. What did you expect to see? (Required)

No error.

### 3. What did you see instead (Required)

`runtime error: invalid memory address or nil pointer dereference`

### 4. What is your TiDB version? (Required)

Release Version: v9.0.0-beta.2.pre-1118-gfc6f7b2e42\nEdition: Community\nGit Commit Hash: fc6f7b2e42be08957a9b80e5761bfa4793066353\nGit Branch: master\nUTC Build Time: 2026-01-26 12:27:51\nGoVersion: go1.25.6\nRace Enabled: false\nCheck Table Before Drop: false\nStore: unistore\nKernel Type: Classic