ClickHouse crushed on request to system.tables if has an incorrect "self-flushing" buffer table.

```
xxxx :) CREATE TABLE test (key UInt32) Engine=Buffer(default, test, 16, 10, 100, 10000, 1000000, 10000000, 100000000);


CREATE TABLE test
(
    `key` UInt32
)
ENGINE = Buffer(default, test, 16, 10, 100, 10000, 1000000, 10000000, 100000000)

Query id: a90ea965-ac7c-420f-a947-f900b6b0d014

Ok.

0 rows in set. Elapsed: 0.005 sec. 

xxxx :) select * from system.tables

SELECT *
FROM system.tables

Query id: bbb7d7eb-b782-4527-9803-ddc4f8703d5c

[xxxx] 2022.08.25 21:44:05.507879 [ 841325 ] <Fatal> BaseDaemon: ########################################
[xxxx] 2022.08.25 21:44:05.508036 [ 841325 ] <Fatal> BaseDaemon: (version 22.8.2.11 (official build), build id: F509FE73D83F8136) (from thread 841253) (query_id: bbb7d7eb-b782-4527-9803-ddc4f8703d5c) (query: select * from system.tables) Received signal Segmentation fault (11)
[xxxx] 2022.08.25 21:44:05.508105 [ 841325 ] <Fatal> BaseDaemon: Address: 0x7f06c12f7ff8 Access: write. Attempted access has violated the permissions assigned to the memory area.
[xxxx] 2022.08.25 21:44:05.508141 [ 841325 ] <Fatal> BaseDaemon: Stack trace: 0xa480065
[xxxx] 2022.08.25 21:44:05.508200 [ 841325 ] <Fatal> BaseDaemon: 2. ? @ 0xa480065 in /usr/bin/clickhouse
[xxxx] 2022.08.25 21:44:05.697982 [ 841325 ] <Fatal> BaseDaemon: Integrity check of the executable successfully passed (checksum: 26BBB329434F6C45E2D0312BCEE49FC1)
↘ Progress: 0.00 rows, 0.00 B (0.00 rows/s., 0.00 B/s.)                                                                                                                                                   Exception on client:
Code: 32. DB::Exception: Attempt to read after eof: while receiving packet from localhost:9000. (ATTEMPT_TO_READ_AFTER_EOF)

Connecting to localhost:9000 as user default.
Code: 210. DB::NetException: Connection reset by peer, while writing to socket ([::1]:9000). (NETWORK_ERROR)

```

Found on version 22.3.9.19, reproduced also on 22.8.2.11

if (query_info.order_optimizer)
                query_info.input_order_info = query_info.order_optimizer->getInputOrder(destination_metadata_snapshot, local_context);
            
            destination->read(
                query_plan, column_names, destination_snapshot, query_info,
                local_context, processed_stage, max_block_size, num_streams);
        }
        else
        {
            
            const Block header = metadata_snapshot->getSampleBlock();
            Names columns_intersection = column_names;
            Block header_after_adding_defaults = header;
            const auto & dest_columns = destination_metadata_snapshot->getColumns();
            const auto & our_columns = metadata_snapshot->getColumns();
            for (const String & column_name : column_names)
            {
                if (!dest_columns.hasPhysical(column_name))
                {
                    LOG_WARNING(log, "Destination table {} doesn't have column {}. The default values are used.", destination_id.getNameForLogs(), backQuoteIfNeed(column_name));
                    boost::range::remove_erase(columns_intersection, column_name);
                    continue;
                }
                const auto & dst_col = dest_columns.getPhysical(column_name);
                const auto & col = our_columns.getPhysical(column_name);
                if (!dst_col.type->equals(*col.type))
                {
                    LOG_WARNING(log, "Destination table {} has different type of column {} ({} != {}). Data from destination table are converted.", destination_id.getNameForLogs(), backQuoteIfNeed(column_name), dst_col.type->getName(), col.type->getName());
                    header_after_adding_defaults.getByName(column_name) = ColumnWithTypeAndName(dst_col.type, column_name);
                }