**Describe the bug**
https://clickhouse-test-reports.s3.yandex.net/22328/43d9972f18d43c6736c08e67c01deb64b733109a/fuzzer_asan/server.log

**How to reproduce**
`SELECT * FROM (SELECT number AS l FROM system.numbers LIMIT 3) ANY LEFT JOIN (SELECT toLowCardinality(number) AS r FROM system.numbers LIMIT 1025) ON (l + 1025) = (r * 1)`

```
Changed settings: min_insert_block_size_rows = '0', min_insert_block_size_bytes = '0', max_threads = '16', totals_mode = 'after_having_auto', log_queries = '1', join_use_nulls = '0', joined_subquery_requires_alias = '0', max_rows_to_group_by = '100000', group_by_overflow_mode = 'any', max_bytes_in_join = '100', 

join_algorithm = 'auto', 

max_partitions_per_insert_block = '100', mutations_sync = '1', aggregate_functions_null_for_empty = '1'
```

Maybe the reason is the same as #22386.

PS. We should not encourage people to use merge join algorithm until the issue will be fixed.
{
    if (is_in_memory)
        mergeInMemoryRightBlocks();
    else
        mergeFlushedRightBlocks();
}
void MergeJoin::mergeInMemoryRightBlocks()
{
    std::unique_lock lock(rwlock);
    if (right_blocks.empty())
        return;
    auto stream = std::make_shared<BlocksListBlockInputStream>(std::move(right_blocks.blocks));
    Pipe source(std::make_shared<SourceFromInputStream>(std::move(stream)));
    right_blocks.clear();
    QueryPipeline pipeline;
    pipeline.init(std::move(source));
    
    pipeline.addTransform(std::make_shared<MergeSortingTransform>(pipeline.getHeader(), right_sort_description, max_rows_in_right_block, 0, 0, 0, 0, nullptr, 0));
    auto sorted_input = PipelineExecutingBlockInputStream(std::move(pipeline));
    while (Block block = sorted_input.read())
    {
        if (!block.rows())
            continue;
        if (skip_not_intersected)
            min_max_right_blocks.emplace_back(extractMinMax(block, right_table_keys));
        right_blocks.countBlockSize(block);
        loaded_right_blocks.emplace_back(std::make_shared<Block>(std::move(block)));
    }
}
void MergeJoin::mergeFlushedRightBlocks()