diff --git a/src/client/inc/tsclient.h b/src/client/inc/tsclient.h
index 74db4112263d4ec33c7555116c7710d3e1293126..d2c582f26cfa421803354d061bd72caa9ba84420 100644
--- a/src/client/inc/tsclient.h
+++ b/src/client/inc/tsclient.h
@@ -119,7 +119,6 @@ typedef struct SInternalField {
   TAOS_FIELD      field;
   bool            visible;
   SExprInfo      *pExpr;
-//  SExprFilter    *pFieldFilters;
 } SInternalField;
 
 typedef struct SFieldInfo {
diff --git a/src/client/src/tscParseInsert.c b/src/client/src/tscParseInsert.c
index 77f580114e25b64ab0de289e3802ec757099a27e..d0dcf9c87922001d8a855e20706bc7da4a6161f7 100644
--- a/src/client/src/tscParseInsert.c
+++ b/src/client/src/tscParseInsert.c
@@ -829,6 +829,7 @@ static int32_t tscCheckIfCreateTable(char **sqlstr, SSqlObj *pSql, char** boundC
     index = 0;
     sToken = tStrGetToken(sql, &index, false);
     if (sToken.type != TK_TAGS && sToken.type != TK_LP) {
+      tscDestroyBoundColumnInfo(&spd);
       return tscInvalidSQLErrMsg(pCmd->payload, "keyword TAGS expected", sToken.z);
     }
 
@@ -841,6 +842,7 @@ static int32_t tscCheckIfCreateTable(char **sqlstr, SSqlObj *pSql, char** boundC
       char* end = NULL;
       code = parseBoundColumns(pCmd, &spd, pTagSchema, sql, &end);
       if (code != TSDB_CODE_SUCCESS) {
+        tscDestroyBoundColumnInfo(&spd);
         return code;
       }
 
@@ -858,11 +860,13 @@ static int32_t tscCheckIfCreateTable(char **sqlstr, SSqlObj *pSql, char** boundC
     sql += index;
 
     if (sToken.type != TK_LP) {
+      tscDestroyBoundColumnInfo(&spd);
       return tscInvalidSQLErrMsg(pCmd->payload, "( is expected", sToken.z);
     }
     
     SKVRowBuilder kvRowBuilder = {0};
     if (tdInitKVRowBuilder(&kvRowBuilder) < 0) {
+      tscDestroyBoundColumnInfo(&spd);
       return TSDB_CODE_TSC_OUT_OF_MEMORY;
     }
 
@@ -875,6 +879,7 @@ static int32_t tscCheckIfCreateTable(char **sqlstr, SSqlObj *pSql, char** boundC
 
       if (TK_ILLEGAL == sToken.type) {
         tdDestroyKVRowBuilder(&kvRowBuilder);
+        tscDestroyBoundColumnInfo(&spd);
         return TSDB_CODE_TSC_INVALID_SQL;
       }
 
@@ -892,6 +897,7 @@ static int32_t tscCheckIfCreateTable(char **sqlstr, SSqlObj *pSql, char** boundC
       code = tsParseOneColumn(pSchema, &sToken, tagVal, pCmd->payload, &sql, false, tinfo.precision);
       if (code != TSDB_CODE_SUCCESS) {
         tdDestroyKVRowBuilder(&kvRowBuilder);
+        tscDestroyBoundColumnInfo(&spd);
         return code;
       }
 
diff --git a/src/client/src/tscSQLParser.c b/src/client/src/tscSQLParser.c
index 421d99c892ff713c2dcaef5cf0158b373d1c185a..b96f85f66e09ade5fdd46298924b8fe1b2675b92 100644
--- a/src/client/src/tscSQLParser.c
+++ b/src/client/src/tscSQLParser.c
@@ -1504,24 +1504,24 @@ static int32_t handleArithmeticExpr(SSqlCmd* pCmd, SQueryInfo* pQueryInfo, int32
     SInternalField* pInfo = tscFieldInfoGetInternalField(&pQueryInfo->fieldsInfo, slot);
 
     if (pInfo->pExpr == NULL) {
-      SExprInfo* pArithExprInfo = calloc(1, sizeof(SExprInfo));
+      SExprInfo* pExprInfo = calloc(1, sizeof(SExprInfo));
 
       // arithmetic expression always return result in the format of double float
-      pArithExprInfo->base.resBytes      = sizeof(double);
-      pArithExprInfo->base.interBytes    = sizeof(double);
-      pArithExprInfo->base.resType       = TSDB_DATA_TYPE_DOUBLE;
+      pExprInfo->base.resBytes   = sizeof(double);
+      pExprInfo->base.interBytes = sizeof(double);
+      pExprInfo->base.resType    = TSDB_DATA_TYPE_DOUBLE;
 
-      pArithExprInfo->base.functionId = TSDB_FUNC_ARITHM;
-      pArithExprInfo->base.numOfParams = 1;
-      pArithExprInfo->base.resColId = getNewResColId(pQueryInfo);
+      pExprInfo->base.functionId = TSDB_FUNC_ARITHM;
+      pExprInfo->base.numOfParams = 1;
+      pExprInfo->base.resColId = getNewResColId(pQueryInfo);
 
-      int32_t ret = exprTreeFromSqlExpr(pCmd, &pArithExprInfo->pExpr, pItem->pNode, pQueryInfo, NULL, &(pArithExprInfo->base.uid));
+      int32_t ret = exprTreeFromSqlExpr(pCmd, &pExprInfo->pExpr, pItem->pNode, pQueryInfo, NULL, &(pExprInfo->base.uid));
       if (ret != TSDB_CODE_SUCCESS) {
-        tExprTreeDestroy(pArithExprInfo->pExpr, NULL);
+        tExprTreeDestroy(pExprInfo->pExpr, NULL);
         return invalidSqlErrMsg(tscGetErrorMsgPayload(pCmd), "invalid expression in select clause");
       }
 
-      pInfo->pExpr = pArithExprInfo;
+      pInfo->pExpr = pExprInfo;
     }
 
     SBufferWriter bw = tbufInitWriter(NULL, false);
diff --git a/src/client/src/tscUtil.c b/src/client/src/tscUtil.c
index 387352f8cfc8fcadbb3753701175b61316740176..e1c1709f5cfa6ca1a6c1c3a7859e68ef8574266f 100644
--- a/src/client/src/tscUtil.c
+++ b/src/client/src/tscUtil.c
@@ -1484,11 +1484,43 @@ static void destroyFilterInfo(SColumnFilterList* pFilterList) {
   pFilterList->numOfFilters = 0;
 }
 
+void* sqlExprDestroy(SExprInfo* pExpr) {
+  if (pExpr == NULL) {
+    return NULL;
+  }
+
+  SSqlExpr* p = &pExpr->base;
+  for(int32_t i = 0; i < tListLen(p->param); ++i) {
+    tVariantDestroy(&p->param[i]);
+  }
+
+  if (p->flist.numOfFilters > 0) {
+    tfree(p->flist.filterInfo);
+  }
+
+  if (pExpr->pExpr != NULL) {
+    tExprTreeDestroy(pExpr->pExpr, NULL);
+  }
+
+  tfree(pExpr);
+  return NULL;
+}
+
 void tscFieldInfoClear(SFieldInfo* pFieldInfo) {
   if (pFieldInfo == NULL) {
     return;
   }
-  
+
+  if (pFieldInfo->internalField != NULL) {
+    size_t num = taosArrayGetSize(pFieldInfo->internalField);
+    for (int32_t i = 0; i < num; ++i) {
+      SInternalField* pfield = taosArrayGet(pFieldInfo->internalField, i);
+      if (pfield->pExpr != NULL && pfield->pExpr->pExpr != NULL) {
+        sqlExprDestroy(pfield->pExpr);
+      }
+    }
+  }
+
   taosArrayDestroy(pFieldInfo->internalField);
   tfree(pFieldInfo->final);
 
@@ -1629,25 +1661,6 @@ SExprInfo* tscSqlExprGet(SQueryInfo* pQueryInfo, int32_t index) {
   return taosArrayGetP(pQueryInfo->exprList, index);
 }
 
-void* sqlExprDestroy(SExprInfo* pExpr) {
-  if (pExpr == NULL) {
-    return NULL;
-  }
-
-  SSqlExpr* p = &pExpr->base;
-  for(int32_t i = 0; i < tListLen(p->param); ++i) {
-    tVariantDestroy(&p->param[i]);
-  }
-
-  if (pExpr->pExpr != NULL) {
-    tExprTreeDestroy(pExpr->pExpr, NULL);
-  }
-  
-  tfree(pExpr);
-  
-  return NULL;
-}
-
 /*
  * NOTE: Does not release SExprInfo here.
  */
@@ -1715,8 +1728,11 @@ void tscSqlExprAssign(SExprInfo* dst, const SExprInfo* src) {
   assert(dst != NULL && src != NULL);
 
   *dst = *src;
-  dst->base.flist.filterInfo = calloc(src->base.flist.numOfFilters, sizeof(SColumnFilterInfo));
-  memcpy(dst->base.flist.filterInfo, src->base.flist.filterInfo, sizeof(SColumnFilterInfo) * src->base.flist.numOfFilters);
+
+  if (src->base.flist.numOfFilters > 0) {
+    dst->base.flist.filterInfo = calloc(src->base.flist.numOfFilters, sizeof(SColumnFilterInfo));
+    memcpy(dst->base.flist.filterInfo, src->base.flist.filterInfo, sizeof(SColumnFilterInfo) * src->base.flist.numOfFilters);
+  }
 
   dst->pExpr = exprdup(src->pExpr);
 
diff --git a/src/query/inc/qExecutor.h b/src/query/inc/qExecutor.h
index d25e1a991eca7be8859339e4c353d156caab2cef..82b752b3021dfc1c70ee1650d83c313e1587e8f2 100644
--- a/src/query/inc/qExecutor.h
+++ b/src/query/inc/qExecutor.h
@@ -430,13 +430,10 @@ typedef struct SSLimitOperatorInfo {
 
   int64_t   rowsTotal;
   int64_t   currentOffset;
-
   SLimitVal limit;
   SLimitVal slimit;
 
-  struct SLocalMerger *pMerger;
   char    **prevRow;
-  bool      hasPrev;
   SArray   *orderColumnList;
 } SSLimitOperatorInfo;
 
diff --git a/src/query/src/qExecutor.c b/src/query/src/qExecutor.c
index 09c96cc0c98dd2358f5c7be576c9f581e308bf03..5d910481c9e4870b77e87aae0ba5f96718c33a15 100644
--- a/src/query/src/qExecutor.c
+++ b/src/query/src/qExecutor.c
@@ -1879,7 +1879,6 @@ static void teardownQueryRuntimeEnv(SQueryRuntimeEnv *pRuntimeEnv) {
   pRuntimeEnv->pool = destroyResultRowPool(pRuntimeEnv->pool);
   taosArrayDestroyEx(pRuntimeEnv->prevResult, freeInterResult);
   pRuntimeEnv->prevResult = NULL;
-
 }
 
 static bool needBuildResAfterQueryComplete(SQInfo* pQInfo) {
@@ -4516,6 +4515,12 @@ static void destroyGlobalAggOperatorInfo(void* param, int32_t numOfOutput) {
   tfree(pInfo->currentGroupColData);
 }
 
+static void destroySlimitOperatorInfo(void* param, int32_t numOfOutput) {
+  SSLimitOperatorInfo *pInfo = (SSLimitOperatorInfo*) param;
+  taosArrayDestroy(pInfo->orderColumnList);
+  tfree(pInfo->prevRow);
+}
+
 SOperatorInfo* createGlobalAggregateOperatorInfo(SQueryRuntimeEnv* pRuntimeEnv, SOperatorInfo* upstream,
                                                  SExprInfo* pExpr, int32_t numOfOutput, void* param) {
   SMultiwayMergeInfo* pInfo = calloc(1, sizeof(SMultiwayMergeInfo));
@@ -5598,9 +5603,8 @@ SOperatorInfo* createSLimitOperatorInfo(SQueryRuntimeEnv* pRuntimeEnv, SOperator
   SQueryAttr* pQueryAttr = pRuntimeEnv->pQueryAttr;
 
   pInfo->orderColumnList = getResultGroupCheckColumns(pQueryAttr);
-  pInfo->pMerger = pMerger;
-  pInfo->slimit = pQueryAttr->slimit;
-  pInfo->limit  = pQueryAttr->limit;
+  pInfo->slimit          = pQueryAttr->slimit;
+  pInfo->limit           = pQueryAttr->limit;
 
   pInfo->currentGroupOffset = pQueryAttr->slimit.offset;
   pInfo->currentOffset = pQueryAttr->limit.offset;
@@ -5632,7 +5636,7 @@ SOperatorInfo* createSLimitOperatorInfo(SQueryRuntimeEnv* pRuntimeEnv, SOperator
   pOperator->exec         = doSLimit;
   pOperator->info         = pInfo;
   pOperator->pRuntimeEnv  = pRuntimeEnv;
-
+  pOperator->cleanup      = destroySlimitOperatorInfo;
   return pOperator;
 }
 
@@ -6974,6 +6978,10 @@ static void* destroyQueryFuncExpr(SExprInfo* pExprInfo, int32_t numOfExpr) {
     if (pExprInfo[i].base.flist.filterInfo) {
       freeColumnFilterInfo(pExprInfo[i].base.flist.filterInfo, pExprInfo[i].base.flist.numOfFilters);
     }
+
+    for(int32_t j = 0; j < pExprInfo[i].base.numOfParams; ++j) {
+      tVariantDestroy(&pExprInfo[i].base.param[j]);
+    }
   }
 
   tfree(pExprInfo);
@@ -6991,40 +6999,13 @@ void freeQInfo(SQInfo *pQInfo) {
   releaseQueryBuf(pRuntimeEnv->tableqinfoGroupInfo.numOfTables);
 
   doDestroyTableQueryInfo(&pRuntimeEnv->tableqinfoGroupInfo);
-
   teardownQueryRuntimeEnv(&pQInfo->runtimeEnv);
 
   SQueryAttr *pQueryAttr = pQInfo->runtimeEnv.pQueryAttr;
-  if (pQueryAttr != NULL) {
-    if (pQueryAttr->fillVal != NULL) {
-      tfree(pQueryAttr->fillVal);
-    }
-
-    pQueryAttr->pFilterInfo = doDestroyFilterInfo(pQueryAttr->pFilterInfo, pQueryAttr->numOfFilterCols);
-
-    pQueryAttr->pExpr1 = destroyQueryFuncExpr(pQueryAttr->pExpr1, pQueryAttr->numOfOutput);
-    pQueryAttr->pExpr2 = destroyQueryFuncExpr(pQueryAttr->pExpr2, pQueryAttr->numOfExpr2);
-    pQueryAttr->pExpr3 = destroyQueryFuncExpr(pQueryAttr->pExpr3, pQueryAttr->numOfExpr3);
-
-    tfree(pQueryAttr->tagColList);
-
-    if (pQueryAttr->tableCols != NULL) {
-      for (int32_t i = 0; i < pQueryAttr->numOfCols; i++) {
-        SColumnInfo *column = pQueryAttr->tableCols + i;
-        freeColumnFilterInfo(column->flist.filterInfo, column->flist.numOfFilters);
-      }
-      tfree(pQueryAttr->tableCols);
-    }
-
-    if (pQueryAttr->pGroupbyExpr != NULL) {
-      taosArrayDestroy(pQueryAttr->pGroupbyExpr->columnInfo);
-      tfree(pQueryAttr->pGroupbyExpr);
-    }
-  }
+  freeQueryAttr(pQueryAttr);
 
   tsdbDestroyTableGroup(&pQueryAttr->tableGroupInfo);
 
-
   tfree(pQInfo->pBuf);
   tfree(pQInfo->sql);
 
@@ -7182,15 +7163,11 @@ void freeQueryAttr(SQueryAttr* pQueryAttr) {
       tfree(pQueryAttr->fillVal);
     }
 
-    for (int32_t i = 0; i < pQueryAttr->numOfFilterCols; ++i) {
-      SSingleColumnFilterInfo* pColFilter = &pQueryAttr->pFilterInfo[i];
-      if (pColFilter->numOfFilters > 0) {
-        tfree(pColFilter->pFilters);
-      }
-    }
+    pQueryAttr->pFilterInfo = doDestroyFilterInfo(pQueryAttr->pFilterInfo, pQueryAttr->numOfFilterCols);
 
     pQueryAttr->pExpr1 = destroyQueryFuncExpr(pQueryAttr->pExpr1, pQueryAttr->numOfOutput);
     pQueryAttr->pExpr2 = destroyQueryFuncExpr(pQueryAttr->pExpr2, pQueryAttr->numOfExpr2);
+    pQueryAttr->pExpr3 = destroyQueryFuncExpr(pQueryAttr->pExpr3, pQueryAttr->numOfExpr3);
 
     tfree(pQueryAttr->tagColList);
     tfree(pQueryAttr->pFilterInfo);
diff --git a/src/query/src/qSqlParser.c b/src/query/src/qSqlParser.c
index 83e1ff6bf841aafe0b822cdad5844bd2a30ad591..f8f5aafbd8bc7d164c83a721354f0b61f2971ec9 100644
--- a/src/query/src/qSqlParser.c
+++ b/src/query/src/qSqlParser.c
@@ -788,7 +788,6 @@ void destroySqlNode(SSqlNode *pSqlNode) {
   }
 
   tSqlExprListDestroy(pSqlNode->pSelNodeList);
-  
   pSqlNode->pSelNodeList = NULL;
 
   tSqlExprDestroy(pSqlNode->pWhere);
@@ -805,6 +804,7 @@ void destroySqlNode(SSqlNode *pSqlNode) {
   taosArrayDestroyEx(pSqlNode->fillType, freeVariant);
   pSqlNode->fillType = NULL;
 
+  tSqlExprDestroy(pSqlNode->pHaving);
   free(pSqlNode);
 }
 
diff --git a/tests/tsim/src/simSystem.c b/tests/tsim/src/simSystem.c
index d2494eddbbbb1756e4daf63e7532fdb466a4824e..0879e371ef62fee81786728e2b980442567fbaa1 100644
--- a/tests/tsim/src/simSystem.c
+++ b/tests/tsim/src/simSystem.c
@@ -164,10 +164,9 @@ void *simExecuteScript(void *inputScript) {
     }
 
     if (script->killed || script->linePos >= script->numOfLines) {
-      printf("killed ---------------------->\n");
       script = simProcessCallOver(script);
       if (script == NULL) {
-        printf("abort now!\n");
+        simDebug("sim test abort now!");
         break;
       }
     } else {