Run under MSan:

**Describe the bug**
https://clickhouse-test-reports.s3.yandex.net/29341/2b2bec3679df7965af908ce3f1e8e17e39bd12fe/fuzzer_msan/report.html#fail1

**How to reproduce**
```
SELECT number, nth_value(number, '10') OVER w AS secondValue, nth_value(number, 2147483647) OVER w AS thirdValue FROM numbers(1.) WINDOW w AS (ORDER BY number ASC) ORDER BY toInt64(2147483646 - intDiv(number, 2147483647), toInt64(number, NULL - intDiv(number, NULL), 100000002004087730000.)) ASC, number DESC NULLS FIRST
```

```
Changed settings: max_block_size = '1', max_threads = '1', receive_timeout = '10', receive_data_timeout_ms = '10000', max_rows_to_read = '3', engine_file_empty_if_not_exists = '0'
```
size_t function_index) override
    {
        IColumn & to = *transform->blockAt(transform->current_row)
            .output_columns[function_index];
        assert_cast<ColumnUInt64 &>(to).getData().push_back(
            transform->peer_group_number);
    }
};
struct WindowFunctionRowNumber final : public WindowFunction
{
    WindowFunctionRowNumber(const std::string & name_,
            const DataTypes & argument_types_, const Array & parameters_)
        : WindowFunction(name_, argument_types_, parameters_)
    {}
    DataTypePtr getReturnType() const override
    { return std::make_shared<DataTypeUInt64>(); }
    bool allocatesMemoryInArena() const override { return false; }
    void windowInsertResultInto(const WindowTransform * transform,
        size_t function_index) override
    {
        IColumn & to = *transform->blockAt(transform->current_row)
            .output_columns[function_index];
        assert_cast<ColumnUInt64 &>(to).getData().push_back(
            transform->current_row_number);
    }
};
template <bool is_lead>
struct WindowFunctionLagLeadInFrame final : public WindowFunction
{
    WindowFunctionLagLeadInFrame(const std::string & name_,