**Describe the bug**
https://clickhouse-test-reports.s3.yandex.net/22328/43d9972f18d43c6736c08e67c01deb64b733109a/fuzzer_asan/server.log

**How to reproduce**
`SELECT * FROM (SELECT number AS l FROM system.numbers LIMIT 3) ANY LEFT JOIN (SELECT toLowCardinality(number) AS r FROM system.numbers LIMIT 1025) ON (l + 1025) = (r * 1)`

```
Changed settings: min_insert_block_size_rows = '0', min_insert_block_size_bytes = '0', max_threads = '16', totals_mode = 'after_having_auto', log_queries = '1', join_use_nulls = '0', joined_subquery_requires_alias = '0', max_rows_to_group_by = '100000', group_by_overflow_mode = 'any', max_bytes_in_join = '100', 

join_algorithm = 'auto', 

max_partitions_per_insert_block = '100', mutations_sync = '1', aggregate_functions_null_for_empty = '1'
```

Maybe the reason is the same as #22386.

PS. We should not encourage people to use merge join algorithm until the issue will be fixed.
{
    if (table_join->strictness() == ASTTableJoin::Strictness::All && (is_right || is_full))
        return std::make_shared<NonMergeJoinedBlockInputStream>(*this, result_sample_block, max_block_size);
    return {};
}
MergeJoin::RightBlockInfo::RightBlockInfo(std::shared_ptr<Block> block_, size_t block_number_, size_t & skip_, RowBitmaps * bitmaps_)
    : block(block_)
    , block_number(block_number_)
    , skip(skip_)
    , bitmaps(bitmaps_)
{}
MergeJoin::RightBlockInfo::~RightBlockInfo()
{
    if (used_bitmap)
        bitmaps->applyOr(block_number, std::move(*used_bitmap));
}
void MergeJoin::RightBlockInfo::setUsed(size_t start, size_t length)
{
    if (bitmaps)
    {
        if (!used_bitmap)
            used_bitmap = std::make_unique<std::vector<bool>>(block->rows(), false);
        for (size_t i = 0; i < length; ++i)
            (*used_bitmap)[start + i] = true;
    }
}
}