`predicate_push_down` returns a nil plan

## Bug Report

The following query outputs `ERROR 1105 (HY000): runtime error: invalid memory address or nil pointer dereference`, which might be unexpected

### 1. Minimal reproduce step (Required)
```sql
CREATE TABLE b (id BIGINT, k BIGINT);

-- A LEFT OUTER JOIN relation, referenced five times. `name` is the null-padded side.
-- (SELECT l.id AS id, r.name AS name FROM b l LEFT OUTER JOIN (SELECT id AS name, k FROM b) r ON l.k = r.k)

EXPLAIN
SELECT t1.id
FROM (SELECT l.id AS id, r.name AS name FROM b l LEFT OUTER JOIN (SELECT id AS name, k FROM b) r ON l.k = r.k) AS t1
WHERE (t1.id = ALL (
SELECT t2.id
FROM (SELECT l.id AS id, r.name AS name FROM b l LEFT OUTER JOIN (SELECT id AS name, k FROM b) r ON l.k = r.k) AS t2
))
IN (
SELECT t5.id
FROM (SELECT l.id AS id, r.name AS name FROM b l LEFT OUTER JOIN (SELECT id AS name, k FROM b) r ON l.k = r.k) AS t3
CROSS JOIN (SELECT l.id AS id, r.name AS name FROM b l LEFT OUTER JOIN (SELECT id AS name, k FROM b) r ON l.k = r.k) AS t4
CROSS JOIN (SELECT l.id AS id, r.name AS name FROM b l LEFT OUTER JOIN (SELECT id AS name, k FROM b) r ON l.k = r.k) AS t5
WHERE t4.name IS NULL
GROUP BY t5.id, t4.name
);

-- Expected: a plan.
-- Actual: ERROR 1105 (HY000): runtime error: invalid memory address or nil pointer dereference
```

Some more experiments made by an agent:
```sql
-- INSERT INTO mysql.opt_rule_blacklist VALUES ('predicate_push_down');
-- admin reload opt_rule_blacklist;
-- -- re-run the EXPLAIN above: it now plans successfully
-- DELETE FROM mysql.opt_rule_blacklist;
-- admin reload opt_rule_blacklist;
-- -- re-run: panics again
```

### 2. What did you expect to see? (Required)
A plan
### 3. What did you see instead (Required)
`ERROR 1105 (HY000): runtime error: invalid memory address or nil pointer dereference`
### 4. What is your TiDB version? (Required)
`Build: v9.0.0-beta.2.pre-2051-g3bea8196a5 @3bea8196 (master, unistore, assertions off)`

Start by reproducing the provided EXPLAIN query in TiDB v9.0.0-beta.2.pre-2051-g3bea8196a5, then inspect the predicate_push_down optimizer rule. Compare the failing plan with the successful result when predicate_push_down is disabled through mysql.opt_rule_blacklist; done means the query produces a plan without a nil pointer error while the rule remains enabled.

Written by the indexing model from the issue text.