diff --git a/src/client/src/tscSQLParser.c b/src/client/src/tscSQLParser.c
index f76a373f239b3623054cfec1327226743a6b42fc..e436ae0a444fa362d55c5963c812f8b264e2422e 100644
--- a/src/client/src/tscSQLParser.c
+++ b/src/client/src/tscSQLParser.c
@@ -6060,19 +6060,20 @@ int32_t doCheckForCreateTable(SSqlObj* pSql, int32_t subClauseIndex, SSqlInfo* p
   size_t numOfFields = taosArrayGetSize(pFieldList);
 
   for (; col < numOfFields; ++col) {
-    TAOS_FIELD* p = taosArrayGet(pTagList, col);
+    TAOS_FIELD* p = taosArrayGet(pFieldList, col);
     tscFieldInfoAppend(&pQueryInfo->fieldsInfo, p);
   }
 
   pCmd->numOfCols = (int16_t)numOfFields;
 
   if (pTagList != NULL) {  // create super table[optional]
-    for (int32_t i = 0; i < numOfFields; ++i) {
+    size_t numOfTags = taosArrayGetSize(pTagList);
+    for (int32_t i = 0; i < numOfTags; ++i) {
       TAOS_FIELD* p = taosArrayGet(pTagList, i);
       tscFieldInfoAppend(&pQueryInfo->fieldsInfo, p);
     }
 
-    pCmd->count = numOfFields;
+    pCmd->count = numOfTags;
   }
 
   return TSDB_CODE_SUCCESS;
diff --git a/src/query/inc/sql.y b/src/query/inc/sql.y
index e4021de22e7fa315392e76e634e67fda87b72888..e46df1827af2da9e74af437a364fed34621f7953 100644
--- a/src/query/inc/sql.y
+++ b/src/query/inc/sql.y
@@ -326,7 +326,7 @@ create_table_args(A) ::= AS select(S). {
 %type column{TAOS_FIELD}
 %type columnlist{SArray*}
 %destructor columnlist {taosArrayDestroy($$);}
-columnlist(A) ::= columnlist(X) COMMA column(Y).  {A = taosArrayPush(X, &Y);   }
+columnlist(A) ::= columnlist(X) COMMA column(Y).  {taosArrayPush(X, &Y); A = X;  }
 columnlist(A) ::= column(X).                      {A = taosArrayInit(4, sizeof(TAOS_FIELD)); taosArrayPush(A, &X);}
 
 // The information used for a column is the name and type of column:
@@ -481,7 +481,7 @@ fill_opt(N) ::= FILL LP ID(Y) COMMA tagitemlist(X) RP.      {
     toTSDBType(Y.type);
     tVariantCreate(&A, &Y);
 
-    taosArrayPush(X, &A);
+    tVariantListInsert(X, &A, -1, 0);
     N = X;
 }
 
@@ -553,11 +553,11 @@ having_opt(A) ::= HAVING expr(X).   {A = X;}
 //limit-offset subclause
 %type limit_opt {SLimitVal}
 limit_opt(A) ::= .                     {A.limit = -1; A.offset = 0;}
-limit_opt(A) ::= LIMIT signed(X).      {A.limit = X;  A.offset = 0;}
+limit_opt(A) ::= LIMIT signed(X).      {printf("aa1, %d\n", X); A.limit = X;  A.offset = 0;}
 limit_opt(A) ::= LIMIT signed(X) OFFSET signed(Y).
-                                       {A.limit = X;  A.offset = Y;}
+                                       {printf("aa2\n, %d\n", X); A.limit = X;  A.offset = Y;}
 limit_opt(A) ::= LIMIT signed(X) COMMA signed(Y).
-                                       {A.limit = Y;  A.offset = X;}
+                                       {printf("aa3\n, %d\n", X); A.limit = Y;  A.offset = X;}
 
 %type slimit_opt {SLimitVal}
 slimit_opt(A) ::= .                    {A.limit = -1; A.offset = 0;}
diff --git a/src/query/src/qFill.c b/src/query/src/qFill.c
index a4830f7d889351a13f56bba480167b888821cfdf..a8cab4ba2a188ffd8a15919c77927286ef39305f 100644
--- a/src/query/src/qFill.c
+++ b/src/query/src/qFill.c
@@ -37,26 +37,34 @@ static int32_t setTagColumnInfo(SFillInfo* pFillInfo, int32_t numOfCols, int32_t
 
     if (TSDB_COL_IS_TAG(pColInfo->flag)) {
       bool exists = false;
+      int32_t index = -1;
       for (int32_t j = 0; j < k; ++j) {
         if (pFillInfo->pTags[j].col.colId == pColInfo->col.colId) {
           exists = true;
+          index = j;
           break;
         }
       }
 
       if (!exists) {
-        pFillInfo->pTags[k].col.colId = pColInfo->col.colId;
+        SSchema* pSchema = &pFillInfo->pTags[k].col;
+        pSchema->colId = pColInfo->col.colId;
+        pSchema->type  = pColInfo->col.type;
+        pSchema->bytes = pColInfo->col.bytes;
+
         pFillInfo->pTags[k].tagVal = calloc(1, pColInfo->col.bytes);
         pColInfo->tagIndex = k;
 
         k += 1;
+      } else {
+        pColInfo->tagIndex = index;
       }
     }
 
     rowsize += pColInfo->col.bytes;
   }
 
-  assert(k < pFillInfo->numOfTags);
+  assert(k <= pFillInfo->numOfTags);
   return rowsize;
 }
 
diff --git a/src/query/src/sql.c b/src/query/src/sql.c
index 92756d380286e983abbf8c39e81ad9d71e319fca..a99ff2f05270d7359e36345ad4a4aacfe0bf3cd6 100644
--- a/src/query/src/sql.c
+++ b/src/query/src/sql.c
@@ -2365,7 +2365,7 @@ static void yy_reduce(
 }
         break;
       case 117: /* columnlist ::= columnlist COMMA column */
-{yylhsminor.yy347 = taosArrayPush(yymsp[-2].minor.yy347, &yymsp[0].minor.yy181);   }
+{taosArrayPush(yymsp[-2].minor.yy347, &yymsp[0].minor.yy181); yylhsminor.yy347 = yymsp[-2].minor.yy347;  }
   yymsp[-2].minor.yy347 = yylhsminor.yy347;
         break;
       case 118: /* columnlist ::= column */
@@ -2612,15 +2612,21 @@ static void yy_reduce(
 {yymsp[1].minor.yy188.limit = -1; yymsp[1].minor.yy188.offset = 0;}
         break;
       case 174: /* limit_opt ::= LIMIT signed */
-      case 178: /* slimit_opt ::= SLIMIT signed */ yytestcase(yyruleno==178);
-{yymsp[-1].minor.yy188.limit = yymsp[0].minor.yy271;  yymsp[-1].minor.yy188.offset = 0;}
+{printf("aa1, %d\n", yymsp[0].minor.yy271); yymsp[-1].minor.yy188.limit = yymsp[0].minor.yy271;  yymsp[-1].minor.yy188.offset = 0;}
         break;
       case 175: /* limit_opt ::= LIMIT signed OFFSET signed */
-      case 179: /* slimit_opt ::= SLIMIT signed SOFFSET signed */ yytestcase(yyruleno==179);
-{yymsp[-3].minor.yy188.limit = yymsp[-2].minor.yy271;  yymsp[-3].minor.yy188.offset = yymsp[0].minor.yy271;}
+{printf("aa2\n, %d\n", yymsp[-2].minor.yy271); yymsp[-3].minor.yy188.limit = yymsp[-2].minor.yy271;  yymsp[-3].minor.yy188.offset = yymsp[0].minor.yy271;}
         break;
       case 176: /* limit_opt ::= LIMIT signed COMMA signed */
-      case 180: /* slimit_opt ::= SLIMIT signed COMMA signed */ yytestcase(yyruleno==180);
+{printf("aa3\n, %d\n", yymsp[-2].minor.yy271); yymsp[-3].minor.yy188.limit = yymsp[0].minor.yy271;  yymsp[-3].minor.yy188.offset = yymsp[-2].minor.yy271;}
+        break;
+      case 178: /* slimit_opt ::= SLIMIT signed */
+{yymsp[-1].minor.yy188.limit = yymsp[0].minor.yy271;  yymsp[-1].minor.yy188.offset = 0;}
+        break;
+      case 179: /* slimit_opt ::= SLIMIT signed SOFFSET signed */
+{yymsp[-3].minor.yy188.limit = yymsp[-2].minor.yy271;  yymsp[-3].minor.yy188.offset = yymsp[0].minor.yy271;}
+        break;
+      case 180: /* slimit_opt ::= SLIMIT signed COMMA signed */
 {yymsp[-3].minor.yy188.limit = yymsp[0].minor.yy271;  yymsp[-3].minor.yy188.offset = yymsp[-2].minor.yy271;}
         break;
       case 183: /* expr ::= LP expr RP */
diff --git a/src/util/src/tarray.c b/src/util/src/tarray.c
index 56e75ff18b7c268641ccd45ab6abe2234cfd73a6..36b2bb9e172fb014c5b08da942c06b2b324a305e 100644
--- a/src/util/src/tarray.c
+++ b/src/util/src/tarray.c
@@ -194,6 +194,10 @@ void taosArrayDestroy(SArray* pArray) {
 }
 
 void taosArrayDestroyEx(SArray* pArray, void (*fp)(void*)) {
+  if (pArray == NULL) {
+    return;
+  }
+
   if (fp == NULL) {
     return taosArrayDestroy(pArray);
   }