Crash in `JOIN` with experimental analyzer

**Describe the bug**
[A link to the report
](https://s3.amazonaws.com/clickhouse-test-reports/43233/c383d1fdb18ce5c61ab3c1692b2dfdfc74060933/fuzzer_astfuzzerasan//report.html)

**How to reproduce**
```sql
DROP TABLE IF EXISTS test_table_join_1;

CREATE TABLE test_table_join_1
(
    `id` UInt8,
    `value` String
)
ENGINE = TinyLog;


DROP TABLE IF EXISTS test_table_join_2;

CREATE TABLE test_table_join_2
(
    `id` UInt16,
    `value` String
)
ENGINE = TinyLog;

SELECT
    toTypeName(t2_value),
    t2.value AS t2_value
FROM test_table_join_1 AS t1
INNER JOIN test_table_join_2 USING (id)
SETTINGS allow_experimental_analyzer = 0;

Received exception from server (version 22.11.1):
Code: 47. DB::Exception: Received from localhost:9000. DB::Exception: Missing columns: 't2.value' while processing query: 'SELECT toTypeName(t2.value AS t2_value), t2_value FROM test_table_join_1 AS t1 ALL INNER JOIN (SELECT * FROM test_table_join_2) AS test_table_join_2 USING (id) SETTINGS allow_experimental_analyzer = 0', required columns: 't2.value' 'id', maybe you meant: ['id'], joined columns: 'test_table_join_2.id' 'test_table_join_2.value'. (UNKNOWN_IDENTIFIER)

SELECT
    toTypeName(t2_value),
    t2.value AS t2_value
FROM test_table_join_1 AS t1
INNER JOIN test_table_join_2 USING (id)
SETTINGS allow_experimental_analyzer = 1;
```

```
2022.11.16 19:19:52.921094 [ 2351042 ] <Fatal> BaseDaemon: ########################################
2022.11.16 19:19:52.921198 [ 2351042 ] <Fatal> BaseDaemon: (version 22.11.1.1295 (official build), build id: 3C94F6F35B207654A5D0D928A9ECDB1662081D5B) (from thread 2350559) (query_id: 60db6d9b-a866-4acd-839f-9ed7bfa0e0bf) (query: SELECT toTypeName(t2_value), t2.value AS t2_value FROM test_table_join_1 AS t1 INNER JOIN test_table_join_2 USING (id) SETTINGS allow_experimental_analyzer = 1;) Received signal Segmentation fault (11)
2022.11.16 19:19:52.921245 [ 2351042 ] <Fatal> BaseDaemon: Address: NULL pointer. Access: read. Address not mapped to object.
2022.11.16 19:19:52.921284 [ 2351042 ] <Fatal> BaseDaemon: Stack trace: 0x130d0aba 0x130cc0ed 0x130e68d9 0x130cd35c 0x130cc0ed 0x130c5326 0x130c3200 0x130c1c25 0x131cad5a 0x1314414a 0x1351db00 0x1351b28d 0x1419cc6e 0x141b00b9 0x16fe57d4 0x16fe717b 0x17175f87 0x171739bd 0x7f2a2646b609 0x7f2a26390163
2022.11.16 19:19:52.966856 [ 2351042 ] <Fatal> BaseDaemon: 2.1. inlined from ./build_docker/../src/Analyzer/Passes/QueryAnalysisPass.cpp:1523: DB::(anonymous namespace)::QueryAnalyzer::collectScopeValidIdentifiersForTypoCorrection(DB::Identifier const&, DB::(anonymous namespace)::IdentifierResolveScope const&, bool, bool, bool, std::__1::unordered_set<DB::Identifier, std::__1::hash<DB::Identifier>, std::__1::equal_to<DB::Identifier>, std::__1::allocator<DB::Identifier>>&)
2022.11.16 19:19:52.966902 [ 2351042 ] <Fatal> BaseDaemon: 2.2. inlined from ./build_docker/../src/Analyzer/Passes/QueryAnalysisPass.cpp:1599: DB::(anonymous namespace)::QueryAnalyzer::collectScopeWithParentScopesValidIdentifiersForTypoCorrection(DB::Identifier const&, DB::(anonymous namespace)::IdentifierResolveScope const&, bool, bool, bool, std::__1::unordered_set<DB::Identifier, std::__1::hash<DB::Identifier>, std::__1::equal_to<DB::Identifier>, std::__1::allocator<DB::Identifier>>&)
2022.11.16 19:19:52.966934 [ 2351042 ] <Fatal> BaseDaemon: 2. ./build_docker/../src/Analyzer/Passes/QueryAnalysisPass.cpp:4634: DB::(anonymous namespace)::QueryAnalyzer::resolveExpressionNode(std::__1::shared_ptr<DB::IQueryTreeNode>&, DB::(anonymous namespace)::IdentifierResolveScope&, bool, bool) @ 0x130d0aba in /usr/lib/debug/usr/bin/clickhouse.debug
2022.11.16 19:19:53.007082 [ 2351042 ] <Fatal> BaseDaemon: 3. ./build_docker/../src/Analyzer/Passes/QueryAnalysisPass.cpp:4835: DB::(anonymous namespace)::QueryAnalyzer::resolveExpressionNodeList(std::__1::shared_ptr<DB::IQueryTreeNode>&, DB::(anonymous namespace)::IdentifierResolveScope&, bool, bool) @ 0x130cc0ed in /usr/lib/debug/usr/bin/clickhouse.debug
2022.11.16 19:19:53.071627 [ 2351042 ] <Fatal> BaseDaemon: 4. ./build_docker/../src/Analyzer/Passes/QueryAnalysisPass.cpp:3969: DB::(anonymous namespace)::QueryAnalyzer::resolveFunction(std::__1::shared_ptr<DB::IQueryTreeNode>&, DB::(anonymous namespace)::IdentifierResolveScope&) @ 0x130e68d9 in /usr/lib/debug/usr/bin/clickhouse.debug
2022.11.16 19:19:53.113088 [ 2351042 ] <Fatal> BaseDaemon: 5.1. inlined from ./build_docker/../contrib/libcxx/include/vector:543: std::__1::vector<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, std::__1::allocator<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>>>::empty[abi:v15003]() const
2022.11.16 19:19:53.113111 [ 2351042 ] <Fatal> BaseDaemon: 5. ./build_docker/../src/Analyzer/Passes/QueryAnalysisPass.cpp:4710: DB::(anonymous namespace)::QueryAnalyzer::resolveExpressionNode(std::__1::shared_ptr<DB::IQueryTreeNode>&, DB::(anonymous namespace)::IdentifierResolveScope&, bool, bool) @ 0x130cd35c in /usr/lib/debug/usr/bin/clickhouse.debug
2022.11.16 19:19:53.152961 [ 2351042 ] <Fatal> BaseDaemon: 6. ./build_docker/../src/Analyzer/Passes/QueryAnalysisPass.cpp:4835: DB::(anonymous namespace)::QueryAnalyzer::resolveExpressionNodeList(std::__1::shared_ptr<DB::IQueryTreeNode>&, DB::(anonymous namespace)::IdentifierResolveScope&, bool, bool) @ 0x130cc0ed in /usr/lib/debug/usr/bin/clickhouse.debug
2022.11.16 19:19:53.199241 [ 2351042 ] <Fatal> BaseDaemon: 7.1. inlined from ./build_docker/../contrib/libcxx/include/__memory/shared_ptr.h:815: std::__1::shared_ptr<DB::IQueryTreeNode>::operator->[abi:v15003]() const
2022.11.16 19:19:53.199294 [ 2351042 ] <Fatal> BaseDaemon: 7.2. inlined from ./build_docker/../src/Analyzer/Passes/QueryAnalysisPass.cpp:5005: DB::(anonymous namespace)::QueryAnalyzer::resolveProjectionExpressionNodeList(std::__1::shared_ptr<DB::IQueryTreeNode>&, DB::(anonymous namespace)::IdentifierResolveScope&)
2022.11.16 19:19:53.199316 [ 2351042 ] <Fatal> BaseDaemon: 7. ./build_docker/../src/Analyzer/Passes/QueryAnalysisPass.cpp:5858: DB::(anonymous namespace)::QueryAnalyzer::resolveQuery(std::__1::shared_ptr<DB::IQueryTreeNode> const&, DB::(anonymous namespace)::IdentifierResolveScope&) @ 0x130c5326 in /usr/lib/debug/usr/bin/clickhouse.debug
2022.11.16 19:19:53.236235 [ 2351042 ] <Fatal> BaseDaemon: 8.1. inlined from ./build_docker/../src/Analyzer/Passes/QueryAnalysisPass.cpp:987: DB::(anonymous namespace)::QueryAnalyzer::resolve(std::__1::shared_ptr<DB::IQueryTreeNode>, std::__1::shared_ptr<DB::IQueryTreeNode> const&, std::__1::shared_ptr<DB::Context const>)
2022.11.16 19:19:53.236269 [ 2351042 ] <Fatal> BaseDaemon: 8. ./build_docker/../src/Analyzer/Passes/QueryAnalysisPass.cpp:6176: DB::QueryAnalysisPass::run(std::__1::shared_ptr<DB::IQueryTreeNode>, std::__1::shared_ptr<DB::Context const>) @ 0x130c3200 in /usr/lib/debug/usr/bin/clickhouse.debug
2022.11.16 19:19:53.240345 [ 2351042 ] <Fatal> BaseDaemon: 9. ./build_docker/../src/Analyzer/QueryTreePassManager.cpp:97: DB::QueryTreePassManager::run(std::__1::shared_ptr<DB::IQueryTreeNode>) @ 0x130c1c25 in /usr/lib/debug/usr/bin/clickhouse.debug
2022.11.16 19:19:53.247430 [ 2351042 ] <Fatal> BaseDaemon: 10.1. inlined from ./build_docker/../contrib/libcxx/include/vector:434: ~vector
2022.11.16 19:19:53.247452 [ 2351042 ] <Fatal> BaseDaemon: 10.2. inlined from ./build_docker/../src/Analyzer/QueryTreePassManager.h:13: ~QueryTreePassManager
2022.11.16 19:19:53.247504 [ 2351042 ] <Fatal> BaseDaemon: 10.3. inlined from ./build_docker/../src/Interpreters/InterpreterSelectQueryAnalyzer.cpp:57: DB::(anonymous namespace)::buildQueryTreeAndRunPasses(std::__1::shared_ptr<DB::IAST> const&, std::__1::shared_ptr<DB::Context const> const&)
2022.11.16 19:19:53.247535 [ 2351042 ] <Fatal> BaseDaemon: 10. ./build_docker/../src/Interpreters/InterpreterSelectQueryAnalyzer.cpp:67: DB::InterpreterSelectQueryAnalyzer::InterpreterSelectQueryAnalyzer(std::__1::shared_ptr<DB::IAST> const&, DB::SelectQueryOptions const&, std::__1::shared_ptr<DB::Context const>) @ 0x131cad5a in /usr/lib/debug/usr/bin/clickhouse.debug
2022.11.16 19:19:53.255678 [ 2351042 ] <Fatal> BaseDaemon: 11.1. inlined from ./build_docker/../contrib/libcxx/include/__memory/unique_ptr.h:0: std::__1::__unique_if<DB::InterpreterSelectQueryAnalyzer>::__unique_single std::__1::make_unique[abi:v15003]<DB::InterpreterSelectQueryAnalyzer, std::__1::shared_ptr<DB::IAST>&, DB::SelectQueryOptions const&, std::__1::shared_ptr<DB::Context>&>(std::__1::shared_ptr<DB::IAST>&, DB::SelectQueryOptions const&, std::__1::shared_ptr<DB::Context>&)
2022.11.16 19:19:53.255722 [ 2351042 ] <Fatal> BaseDaemon: 11. ./build_docker/../src/Interpreters/InterpreterFactory.cpp:134: DB::InterpreterFactory::get(std::__1::shared_ptr<DB::IAST>&, std::__1::shared_ptr<DB::Context>, DB::SelectQueryOptions const&) @ 0x1314414a in /usr/lib/debug/usr/bin/clickhouse.debug
2022.11.16 19:19:53.279204 [ 2351042 ] <Fatal> BaseDaemon: 12. ./build_docker/../src/Interpreters/executeQuery.cpp:0: DB::executeQueryImpl(char const*, char const*, std::__1::shared_ptr<DB::Context>, bool, DB::QueryProcessingStage::Enum, DB::ReadBuffer*) @ 0x1351db00 in /usr/lib/debug/usr/bin/clickhouse.debug
2022.11.16 19:19:53.306451 [ 2351042 ] <Fatal> BaseDaemon: 13. ./build_docker/../src/Interpreters/executeQuery.cpp:1074: DB::executeQuery(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, std::__1::shared_ptr<DB::Context>, bool, DB::QueryProcessingStage::Enum) @ 0x1351b28d in /usr/lib/debug/usr/bin/clickhouse.debug
2022.11.16 19:19:53.333983 [ 2351042 ] <Fatal> BaseDaemon: 14. ./build_docker/../src/Server/TCPHandler.cpp:0: DB::TCPHandler::runImpl() @ 0x1419cc6e in /usr/lib/debug/usr/bin/clickhouse.debug
2022.11.16 19:19:53.375656 [ 2351042 ] <Fatal> BaseDaemon: 15. ./build_docker/../src/Server/TCPHandler.cpp:1904: DB::TCPHandler::run() @ 0x141b00b9 in /usr/lib/debug/usr/bin/clickhouse.debug
2022.11.16 19:19:53.377183 [ 2351042 ] <Fatal> BaseDaemon: 16. ./build_docker/../contrib/poco/Net/src/TCPServerConnection.cpp:57: Poco::Net::TCPServerConnection::start() @ 0x16fe57d4 in /usr/lib/debug/usr/bin/clickhouse.debug
2022.11.16 19:19:53.379590 [ 2351042 ] <Fatal> BaseDaemon: 17.1. inlined from ./build_docker/../contrib/libcxx/include/__memory/unique_ptr.h:48: std::__1::default_delete<Poco::Net::TCPServerConnection>::operator()[abi:v15003](Poco::Net::TCPServerConnection*) const
2022.11.16 19:19:53.379611 [ 2351042 ] <Fatal> BaseDaemon: 17.2. inlined from ./build_docker/../contrib/libcxx/include/__memory/unique_ptr.h:305: std::__1::unique_ptr<Poco::Net::TCPServerConnection, std::__1::default_delete<Poco::Net::TCPServerConnection>>::reset[abi:v15003](Poco::Net::TCPServerConnection*)
2022.11.16 19:19:53.379649 [ 2351042 ] <Fatal> BaseDaemon: 17.3. inlined from ./build_docker/../contrib/libcxx/include/__memory/unique_ptr.h:259: ~unique_ptr
2022.11.16 19:19:53.379691 [ 2351042 ] <Fatal> BaseDaemon: 17. ./build_docker/../contrib/poco/Net/src/TCPServerDispatcher.cpp:116: Poco::Net::TCPServerDispatcher::run() @ 0x16fe717b in /usr/lib/debug/usr/bin/clickhouse.debug
2022.11.16 19:19:53.382534 [ 2351042 ] <Fatal> BaseDaemon: 18. ./build_docker/../contrib/poco/Foundation/src/ThreadPool.cpp:213: Poco::PooledThread::run() @ 0x17175f87 in /usr/lib/debug/usr/bin/clickhouse.debug
2022.11.16 19:19:53.384856 [ 2351042 ] <Fatal> BaseDaemon: 19.1. inlined from ./build_docker/../contrib/poco/Foundation/include/Poco/SharedPtr.h:277: Poco::SharedPtr<Poco::Runnable, Poco::ReferenceCounter, Poco::ReleasePolicy<Poco::Runnable>>::get()
2022.11.16 19:19:53.384902 [ 2351042 ] <Fatal> BaseDaemon: 19.2. inlined from ./build_docker/../contrib/poco/Foundation/include/Poco/SharedPtr.h:156: Poco::SharedPtr<Poco::Runnable, Poco::ReferenceCounter, Poco::ReleasePolicy<Poco::Runnable>>::assign(Poco::Runnable*)
2022.11.16 19:19:53.384915 [ 2351042 ] <Fatal> BaseDaemon: 19.3. inlined from ./build_docker/../contrib/poco/Foundation/include/Poco/SharedPtr.h:208: Poco::SharedPtr<Poco::Runnable, Poco::ReferenceCounter, Poco::ReleasePolicy<Poco::Runnable>>::operator=(Poco::Runnable*)
2022.11.16 19:19:53.384944 [ 2351042 ] <Fatal> BaseDaemon: 19. ./build_docker/../contrib/poco/Foundation/src/Thread_POSIX.cpp:360: Poco::ThreadImpl::runnableEntry(void*) @ 0x171739bd in /usr/lib/debug/usr/bin/clickhouse.debug
2022.11.16 19:19:53.384976 [ 2351042 ] <Fatal> BaseDaemon: 20. ? @ 0x7f2a2646b609 in ?
2022.11.16 19:19:53.385007 [ 2351042 ] <Fatal> BaseDaemon: 21. __clone @ 0x7f2a26390163 in ?
2022.11.16 19:19:53.530036 [ 2351042 ] <Fatal> BaseDaemon: Integrity check of the executable successfully passed (checksum: AEC87B4F3DBF44C1BD933135837E6F59)
```

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Crash in `JOIN` with experimental analyzer #43305

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Crash in JOIN with experimental analyzer #43305

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Crash in `JOIN` with experimental analyzer #43305