sql: do not rewrite UDF body statement slice while assigning placeholders

Previously, we accidentally modified the original slice that contains
the body statements of a UDF while copying it during the placeholder
assignment step. As a result, constant folding that occurred in one
session could become visible in the query plan cache, causing incorrect
results. This commit fixes the bug by copying the slice as well as the
body statements.

This bug only applied to prepared statements, since we don't add plans with
stable expressions to the plan cache outside of the prepare path.

Fixes cockroachdb#147186

Release note (bug fix): Fixed a bug that could cause stable expressions
to be folded in cached query plans. The bug could cause stable expressions
like `current_setting` to return the wrong result if used in a prepared
statement. The bug was introduced in point releases v23.2.22, v24.1.14,
v24.3.9, and v25.1.2, and the v25.2 alpha.

Author: DrewKimball

pkg/sql/logictest/testdata/logic_test/udf_prepare

@@ -6,3 +6,47 @@ PREPARE p AS SELECT $1::INT
 
 statement error pgcode 0A000 cannot evaluate function in this context
 EXECUTE p(f())
+
+statement ok
+DEALLOCATE p;
+
+# Ensure that stable folding does not affect plans stored in the plan cache.
+subtest regression_147186
+
+statement ok
+CREATE FUNCTION f147186() RETURNS INT LANGUAGE SQL AS $$ SELECT CAST(current_setting('foo.bar') AS INT) $$;
+
+statement ok
+CREATE TABLE t147186 (a INT, b INT DEFAULT f147186());
+
+statement ok
+PREPARE p AS INSERT INTO t147186 (a) VALUES ($1);
+
+statement ok
+SET foo.bar = '100';
+
+statement ok
+EXECUTE p(1);
+
+query II rowsort
+SELECT a, b FROM t147186;
+----
+1  100
+
+statement ok
+SET foo.bar = '200';
+
+statement ok
+EXECUTE p(2);
+
+# The second row should reflect the custom var change.
+query II rowsort
+SELECT a, b FROM t147186;
+----
+1  100
+2  200
+
+statement ok
+DEALLOCATE p;
+
+subtest end

pkg/sql/opt/norm/factory.go

@@ -382,9 +382,20 @@ func (f *Factory) AssignPlaceholders(from *memo.Memo) (err error) {
 				}
 				recursiveRoutines[t.Def] = struct{}{}
 			}
+			// Copy the arguments, if any.
+			var newArgs memo.ScalarListExpr
+			if t.Args != nil {
+				copiedArgs := f.CopyAndReplaceDefault(&t.Args, replaceFn).(*memo.ScalarListExpr)
+				newArgs = *copiedArgs
+			}
+			// Make sure to copy the slice that stores the body statements, rather
+			// than mutating the original.
+			newDef := *t.Def
+			newDef.Body = make([]memo.RelExpr, len(t.Def.Body))
 			for i := range t.Def.Body {
-				t.Def.Body[i] = f.CopyAndReplaceDefault(t.Def.Body[i], replaceFn).(memo.RelExpr)
+				newDef.Body[i] = f.CopyAndReplaceDefault(t.Def.Body[i], replaceFn).(memo.RelExpr)
 			}
+			return f.ConstructUDFCall(newArgs, &memo.UDFCallPrivate{Def: &newDef})
 		case *memo.RecursiveCTEExpr:
 			// A recursive CTE may have the stats change on its Initial expression
 			// after placeholder assignment, if that happens we need to