**Describe the bug**
https://clickhouse-test-reports.s3.yandex.net/22328/43d9972f18d43c6736c08e67c01deb64b733109a/fuzzer_asan/server.log

**How to reproduce**
`SELECT * FROM (SELECT number AS l FROM system.numbers LIMIT 3) ANY LEFT JOIN (SELECT toLowCardinality(number) AS r FROM system.numbers LIMIT 1025) ON (l + 1025) = (r * 1)`

```
Changed settings: min_insert_block_size_rows = '0', min_insert_block_size_bytes = '0', max_threads = '16', totals_mode = 'after_having_auto', log_queries = '1', join_use_nulls = '0', joined_subquery_requires_alias = '0', max_rows_to_group_by = '100000', group_by_overflow_mode = 'any', max_bytes_in_join = '100', 

join_algorithm = 'auto', 

max_partitions_per_insert_block = '100', mutations_sync = '1', aggregate_functions_null_for_empty = '1'
```

Maybe the reason is the same as #22386.

PS. We should not encourage people to use merge join algorithm until the issue will be fixed.
{
        if (end() == 0 || min_max.rows() != 2)
            throw Exception("Unexpected block size", ErrorCodes::LOGICAL_ERROR);
        size_t last_position = end() - 1;
        int first_vs_max = 0;
        int last_vs_min = 0;
        for (size_t i = 0; i < impl.sort_columns_size; ++i)
        {
            const auto & left_column = *impl.sort_columns[i];
            const auto & right_column = *min_max.getByName(key_names[i]).column; 
            if (!first_vs_max)
                first_vs_max = nullableCompareAt<true, true>(left_column, right_column, position(), 1);
            if (!last_vs_min)
                last_vs_min = nullableCompareAt<true, true>(left_column, right_column, last_position, 0);
        }
        if (first_vs_max > 0)
            return 1;
        if (last_vs_min < 0)
            return -1;
        return 0;
    }
private:
    SortCursorImpl impl;
    bool has_left_nullable = false;
    bool has_right_nullable = false;
    template <bool left_nulls, bool right_nulls>
    Range getNextEqualRangeImpl(MergeJoinCursor & rhs)