From https://github.com/ClickHouse/ClickHouse/pull/27816 CI fuzzer
https://clickhouse-test-reports.s3.yandex.net/27816/08b9f75e966a360fb2963dd5b7aa91839c3811de/fuzzer_debug/report.html#fail1

Minimized:
```sql
    SELECT
        if(number % -2, toFixedString(toString(number), NULL), toFixedString(toString(-number), 65536)) AS x
    FROM system.numbers
    LIMIT 3
```

Assertion:
```
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:00.928373 [ 268 ] {70e80805-74ef-4b12-9ef0-64fd78480273} <Fatal> : Logical error: 'Too many bytes in mask'.
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:00.929758 [ 288 ] <Fatal> BaseDaemon: ########################################
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:00.929981 [ 288 ] <Fatal> BaseDaemon: (version 21.9.1.7811, build id: 53E2D6CF5BD31F68345DA6F7A2ABF780843916CB) (from thread 268) (query_id: 70e80805-74ef-4b12-9ef0-64fd78480273) Received signal Aborted (6)
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:00.930155 [ 288 ] <Fatal> BaseDaemon: 
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:00.930401 [ 288 ] <Fatal> BaseDaemon: Stack trace: 0x7fe3b781218b 0x7fe3b77f1859 0x1369c966 0x1369ca75 0x1f12fc2f 0x1a21d468 0x1a21b201 0x1631a77e 0x1dc56e8d 0x1dc579d4 0x1e542a82 0x1e541ef6 0x1ffeaf49 0x1bc53825 0x1fc48848 0x1fcb5d1c 0x1fcb5c7f 0x1fcb5c1d 0x1fcb5bdd 0x1fcb5bb5 0x1fcb5b7d 0x136eb7a9 0x136ea8d5 0x1fcb456d 0x1fcb4f59 0x1fcb2e04 0x1fcb20f3 0x1fcd4037 0x1fcd3f66 0x1fcd3edd 0x1fcd3e81 0x1fcd3d92 0x1fcd3c8c 0x1fcd3b9d 0x1fcd3b5d 0x1fcd3b35 0x1fcd3b00 0x136eb7a9 0x136ea8d5 0x1371196e 0x13719024
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:00.930703 [ 288 ] <Fatal> BaseDaemon: 4. raise @ 0x4618b in /usr/lib/x86_64-linux-gnu/libc-2.31.so
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:00.930855 [ 288 ] <Fatal> BaseDaemon: 5. abort @ 0x25859 in /usr/lib/x86_64-linux-gnu/libc-2.31.so
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:01.213913 [ 288 ] <Fatal> BaseDaemon: 6. ./obj-x86_64-linux-gnu/../src/Common/Exception.cpp:53: DB::handle_error_code(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, int, bool, std::__1::vector<void*, std::__1::allocator<void*> > const&) @ 0x1369c966 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:01.493926 [ 288 ] <Fatal> BaseDaemon: 7. ./obj-x86_64-linux-gnu/../src/Common/Exception.cpp:60: DB::Exception::Exception(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, int, bool) @ 0x1369ca75 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:01.647100 [ 288 ] <Fatal> BaseDaemon: 8. ./obj-x86_64-linux-gnu/../src/Columns/ColumnFixedString.cpp:360: DB::ColumnFixedString::expand(DB::PODArray<char8_t, 4096ul, Allocator<false, false>, 15ul, 16ul> const&, bool) @ 0x1f12fc2f in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:02.315645 [ 288 ] <Fatal> BaseDaemon: 9. ./obj-x86_64-linux-gnu/../src/Functions/if.cpp:902: DB::(anonymous namespace)::FunctionIf::executeForNullThenElse(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const @ 0x1a21d468 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:02.978943 [ 288 ] <Fatal> BaseDaemon: 10. ./obj-x86_64-linux-gnu/../src/Functions/if.cpp:1034: DB::(anonymous namespace)::FunctionIf::executeImpl(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const @ 0x1a21b201 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:03.083469 [ 288 ] <Fatal> BaseDaemon: 11. ./obj-x86_64-linux-gnu/../src/Functions/IFunctionAdaptors.h:21: DB::FunctionToExecutableFunctionAdaptor::executeImpl(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long) const @ 0x1631a77e in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:03.413299 [ 288 ] <Fatal> BaseDaemon: 12. ./obj-x86_64-linux-gnu/../src/Functions/IFunction.cpp:217: DB::IExecutableFunction::executeWithoutLowCardinalityColumns(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const @ 0x1dc56e8d in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:03.737926 [ 288 ] <Fatal> BaseDaemon: 13. ./obj-x86_64-linux-gnu/../src/Functions/IFunction.cpp:260: DB::IExecutableFunction::execute(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::shared_ptr<DB::IDataType const> const&, unsigned long, bool) const @ 0x1dc579d4 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:04.377409 [ 288 ] <Fatal> BaseDaemon: 14. ./obj-x86_64-linux-gnu/../src/Interpreters/ExpressionActions.cpp:601: DB::executeAction(DB::ExpressionActions::Action const&, DB::(anonymous namespace)::ExecutionContext&, bool) @ 0x1e542a82 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:04.926734 [ 288 ] <Fatal> BaseDaemon: 15. ./obj-x86_64-linux-gnu/../src/Interpreters/ExpressionActions.cpp:718: DB::ExpressionActions::execute(DB::Block&, unsigned long&, bool) const @ 0x1e541ef6 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:05.103233 [ 288 ] <Fatal> BaseDaemon: 16. ./obj-x86_64-linux-gnu/../src/Processors/Transforms/ExpressionTransform.cpp:23: DB::ExpressionTransform::transform(DB::Chunk&) @ 0x1ffeaf49 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:05.374215 [ 288 ] <Fatal> BaseDaemon: 17. ./obj-x86_64-linux-gnu/../src/Processors/ISimpleTransform.h:43: DB::ISimpleTransform::transform(DB::Chunk&, DB::Chunk&) @ 0x1bc53825 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:05.502076 [ 288 ] <Fatal> BaseDaemon: 18. ./obj-x86_64-linux-gnu/../src/Processors/ISimpleTransform.cpp:89: DB::ISimpleTransform::work() @ 0x1fc48848 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:06.013628 [ 288 ] <Fatal> BaseDaemon: 19. ./obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:88: DB::executeJob(DB::IProcessor*) @ 0x1fcb5d1c in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:06.518688 [ 288 ] <Fatal> BaseDaemon: 20. ./obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:105: DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0::operator()() const @ 0x1fcb5c7f in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:07.032405 [ 288 ] <Fatal> BaseDaemon: 21. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3676: decltype(std::__1::forward<DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&>(fp)()) std::__1::__invoke<DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&>(DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&) @ 0x1fcb5c1d in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:07.522096 [ 288 ] <Fatal> BaseDaemon: 22. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/__functional_base:349: void std::__1::__invoke_void_return_wrapper<void>::__call<DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&>(DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0&) @ 0x1fcb5bdd in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:08.013799 [ 288 ] <Fatal> BaseDaemon: 23. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:1608: std::__1::__function::__default_alloc_func<DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0, void ()>::operator()() @ 0x1fcb5bb5 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:08.506159 [ 288 ] <Fatal> BaseDaemon: 24. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2089: void std::__1::__function::__policy_invoker<void ()>::__call_impl<std::__1::__function::__default_alloc_func<DB::PipelineExecutor::addJob(DB::ExecutingGraph::Node*)::$_0, void ()> >(std::__1::__function::__policy_storage const*) @ 0x1fcb5b7d in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:08.754163 [ 288 ] <Fatal> BaseDaemon: 25. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2221: std::__1::__function::__policy_func<void ()>::operator()() const @ 0x136eb7a9 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:09.000065 [ 288 ] <Fatal> BaseDaemon: 26. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2560: std::__1::function<void ()>::operator()() const @ 0x136ea8d5 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:09.476803 [ 288 ] <Fatal> BaseDaemon: 27. ./obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:600: DB::PipelineExecutor::executeStepImpl(unsigned long, unsigned long, std::__1::atomic<bool>*) @ 0x1fcb456d in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:09.957124 [ 288 ] <Fatal> BaseDaemon: 28. ./obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:485: DB::PipelineExecutor::executeSingleThread(unsigned long, unsigned long) @ 0x1fcb4f59 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:10.415315 [ 288 ] <Fatal> BaseDaemon: 29. ./obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:824: DB::PipelineExecutor::executeImpl(unsigned long) @ 0x1fcb2e04 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:10.898254 [ 288 ] <Fatal> BaseDaemon: 30. ./obj-x86_64-linux-gnu/../src/Processors/Executors/PipelineExecutor.cpp:407: DB::PipelineExecutor::execute(unsigned long) @ 0x1fcb20f3 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:11.303097 [ 288 ] <Fatal> BaseDaemon: 31. ./obj-x86_64-linux-gnu/../src/Processors/Executors/PullingAsyncPipelineExecutor.cpp:80: DB::threadFunction(DB::PullingAsyncPipelineExecutor::Data&, std::__1::shared_ptr<DB::ThreadGroupStatus>, unsigned long) @ 0x1fcd4037 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:11.699627 [ 288 ] <Fatal> BaseDaemon: 32. ./obj-x86_64-linux-gnu/../src/Processors/Executors/PullingAsyncPipelineExecutor.cpp:108: DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0::operator()() const @ 0x1fcd3f66 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:12.094405 [ 288 ] <Fatal> BaseDaemon: 33. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3682: decltype(std::__1::forward<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&>(fp)()) std::__1::__invoke_constexpr<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&) @ 0x1fcd3edd in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:12.488310 [ 288 ] <Fatal> BaseDaemon: 34. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/tuple:1415: decltype(auto) std::__1::__apply_tuple_impl<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&, std::__1::tuple<>&>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&, std::__1::tuple<>&, std::__1::__tuple_indices<>) @ 0x1fcd3e81 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:12.880922 [ 288 ] <Fatal> BaseDaemon: 35. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/tuple:1424: decltype(auto) std::__1::apply<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&, std::__1::tuple<>&>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&, std::__1::tuple<>&) @ 0x1fcd3d92 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:13.277191 [ 288 ] <Fatal> BaseDaemon: 36. ./obj-x86_64-linux-gnu/../src/Common/ThreadPool.h:183: ThreadFromGlobalPool::ThreadFromGlobalPool<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&&)::'lambda'()::operator()() @ 0x1fcd3c8c in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:13.669550 [ 288 ] <Fatal> BaseDaemon: 37. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/type_traits:3676: decltype(std::__1::forward<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0>(fp)()) std::__1::__invoke<ThreadFromGlobalPool::ThreadFromGlobalPool<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&&)::'lambda'()&>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&&) @ 0x1fcd3b9d in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:14.062313 [ 288 ] <Fatal> BaseDaemon: 38. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/__functional_base:349: void std::__1::__invoke_void_return_wrapper<void>::__call<ThreadFromGlobalPool::ThreadFromGlobalPool<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&&)::'lambda'()&>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&&...) @ 0x1fcd3b5d in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:14.460004 [ 288 ] <Fatal> BaseDaemon: 39. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:1608: std::__1::__function::__default_alloc_func<ThreadFromGlobalPool::ThreadFromGlobalPool<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&&)::'lambda'(), void ()>::operator()() @ 0x1fcd3b35 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:14.864839 [ 288 ] <Fatal> BaseDaemon: 40. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2089: void std::__1::__function::__policy_invoker<void ()>::__call_impl<std::__1::__function::__default_alloc_func<ThreadFromGlobalPool::ThreadFromGlobalPool<DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0>(DB::PullingAsyncPipelineExecutor::pull(DB::Chunk&, unsigned long)::$_0&&)::'lambda'(), void ()> >(std::__1::__function::__policy_storage const*) @ 0x1fcd3b00 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:15.120158 [ 288 ] <Fatal> BaseDaemon: 41. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2221: std::__1::__function::__policy_func<void ()>::operator()() const @ 0x136eb7a9 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:15.372076 [ 288 ] <Fatal> BaseDaemon: 42. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/functional:2560: std::__1::function<void ()>::operator()() const @ 0x136ea8d5 in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:15.462576 [ 288 ] <Fatal> BaseDaemon: 43. ./obj-x86_64-linux-gnu/../src/Common/ThreadPool.cpp:269: ThreadPoolImpl<std::__1::thread>::worker(std::__1::__list_iterator<std::__1::thread, void*>) @ 0x1371196e in /workspace/clickhouse
[linux-ubuntu-16-04-xenial] 2021.08.18 17:57:15.563145 [ 288 ] <Fatal> BaseDaemon: 44. ./obj-x86_64-linux-gnu/../src/Common/ThreadPool.cpp:136: void ThreadPoolImpl<std::__1::thread>::scheduleImpl<void>(std::__1::function<void ()>, int, std::__1::optional<unsigned long>)::'lambda0'()::operator()() const @ 0x13719024 in /workspace/clickhouse
```


A build from 2 days ago is fine and master/HEAD fails so it's fairly recent. Likely introduced by https://github.com/ClickHouse/ClickHouse/pull/23367 cc/ @Avogar 


{
    if (getOffsets().empty())
        return ColumnArray::create(data);
    auto res = ColumnArray::create(data->cloneEmpty());
    auto & res_elems = assert_cast<ColumnVector<T> &>(res->getData()).getData();
    Offsets & res_offsets = res->getOffsets();
    filterArraysImpl<T>(assert_cast<const ColumnVector<T> &>(*data).getData(), getOffsets(), res_elems, res_offsets, filt, result_size_hint);
    return res;
}
ColumnPtr ColumnArray::filterString(const Filter & filt, ssize_t result_size_hint) const