**Describe the bug**
https://clickhouse-test-reports.s3.yandex.net/22328/43d9972f18d43c6736c08e67c01deb64b733109a/fuzzer_asan/server.log

**How to reproduce**
`SELECT * FROM (SELECT number AS l FROM system.numbers LIMIT 3) ANY LEFT JOIN (SELECT toLowCardinality(number) AS r FROM system.numbers LIMIT 1025) ON (l + 1025) = (r * 1)`

```
Changed settings: min_insert_block_size_rows = '0', min_insert_block_size_bytes = '0', max_threads = '16', totals_mode = 'after_having_auto', log_queries = '1', join_use_nulls = '0', joined_subquery_requires_alias = '0', max_rows_to_group_by = '100000', group_by_overflow_mode = 'any', max_bytes_in_join = '100', 

join_algorithm = 'auto', 

max_partitions_per_insert_block = '100', mutations_sync = '1', aggregate_functions_null_for_empty = '1'
```

Maybe the reason is the same as #22386.

PS. We should not encourage people to use merge join algorithm until the issue will be fixed.
}
    }
    if constexpr (has_right_nulls)
    {
        if (const auto * right_nullable = checkAndGetColumn<ColumnNullable>(right_column))
        {
            if (right_column.isNullAt(rhs_pos))
                return -null_direction_hint;
            return left_column.compareAt(lhs_pos, rhs_pos, right_nullable->getNestedColumn(), null_direction_hint);
        }
    }
    return left_column.compareAt(lhs_pos, rhs_pos, right_column, null_direction_hint);
}
Block extractMinMax(const Block & block, const Block & keys)
{
    if (block.rows() == 0)
        throw Exception("Unexpected empty block", ErrorCodes::LOGICAL_ERROR);
    Block min_max = keys.cloneEmpty();
    MutableColumns columns = min_max.mutateColumns();
    for (size_t i = 0; i < columns.size(); ++i)
    {
        const auto & src_column = block.getByName(keys.getByPosition(i).name);
        columns[i]->insertFrom(*src_column.column, 0);
        columns[i]->insertFrom(*src_column.column, block.rows() - 1);
    }
    min_max.setColumns(std::move(columns));
    return min_max;
}
}
class RowBitmaps