Hi there, it seems that the combination of `ORDER BY WITH FILL`, `FROM TO` and `STEP INTERVAL` is causing the query to hang and eventually to timeout (ignoring session timeout limit). 

Sometimes the server hangs after few such queries and don't respond to KILL signal (had to restart the VM).

**How to reproduce**

```sql
SELECT 
    count() AS value,
    toStartOfMonth(d1) AS date
FROM (
    SELECT
        timestamp_add(toDateTime('2022-02-01'), INTERVAL number WEEK) AS d1
    FROM numbers(18) AS number
)
GROUP BY date
ORDER BY
    date
        WITH FILL 
        FROM toDateTime('2022-02-01')
        TO toDateTime('2022-06-01')
        STEP INTERVAL 1 MONTH
```

**Error message and/or stacktrace**

```
2022.05.30 12:24:11.784134 [ 45 ] {c3091464-f1ce-4657-8498-ba67743dac1c} <Error> executeQuery: Code: 159. DB::Exception: Timeout exceeded: elapsed 38.329806547 seconds, maximum: 5. (TIMEOUT_EXCEEDED) (version 22.5.1.2079 (official build)) (from 172.17.0.1:61118) (in query:  SELECT count() AS value, toStartOfMonth(d1) AS date FROM ( SELECT timestamp_add(toDateTime('2022-02-01'), INTERVAL number WEEK) AS d1 FROM numbers(18) AS number ) GROUP BY date ORDER BY date WITH FILL FROM toDateTime('2022-02-01') TO toDateTime('2022-06-01') STEP INTERVAL 1 MONTH FORMAT JSON ), Stack trace (when copying this message, always include the lines below):

0. DB::Exception::Exception(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, int, bool) @ 0xb4903fa in /usr/bin/clickhouse
1. DB::Exception::Exception<double, double>(int, fmt::v8::basic_format_string<char, fmt::v8::type_identity<double>::type, fmt::v8::type_identity<double>::type>, double&&, double&&) @ 0x15e7ebec in /usr/bin/clickhouse
2. DB::ExecutionSpeedLimits::checkTimeLimit(Stopwatch const&, DB::OverflowMode) const @ 0x15e7eacc in /usr/bin/clickhouse
3. DB::PipelineExecutor::finalizeExecution() @ 0x16d0c2a2 in /usr/bin/clickhouse
4. DB::CompletedPipelineExecutor::execute() @ 0x16d0a204 in /usr/bin/clickhouse
5. DB::executeQuery(DB::ReadBuffer&, DB::WriteBuffer&, bool, std::__1::shared_ptr<DB::Context>, std::__1::function<void (std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&)>, std::__1::optional<DB::FormatSettings> const&) @ 0x160dbc33 in /usr/bin/clickhouse
6. DB::HTTPHandler::processQuery(DB::HTTPServerRequest&, DB::HTMLForm&, DB::HTTPServerResponse&, DB::HTTPHandler::Output&, std::__1::optional<DB::CurrentThread::QueryScope>&) @ 0x16a42871 in /usr/bin/clickhouse
7. DB::HTTPHandler::handleRequest(DB::HTTPServerRequest&, DB::HTTPServerResponse&) @ 0x16a46f22 in /usr/bin/clickhouse
8. DB::HTTPServerConnection::run() @ 0x16ccddf3 in /usr/bin/clickhouse
9. Poco::Net::TCPServerConnection::start() @ 0x1b0bbc2f in /usr/bin/clickhouse
10. Poco::Net::TCPServerDispatcher::run() @ 0x1b0be081 in /usr/bin/clickhouse
11. Poco::PooledThread::run() @ 0x1b284169 in /usr/bin/clickhouse
12. Poco::ThreadImpl::runnableEntry(void*) @ 0x1b2814c0 in /usr/bin/clickhouse
13. ? @ 0x7f4927458609 in ?
14. __clone @ 0x7f492737d133 in ?

2022.05.30 12:24:11.784437 [ 45 ] {c3091464-f1ce-4657-8498-ba67743dac1c} <Error> DynamicQueryHandler: Code: 159. DB::Exception: Timeout exceeded: elapsed 38.329806547 seconds, maximum: 5. (TIMEOUT_EXCEEDED), Stack trace (when copying this message, always include the lines below):

0. DB::Exception::Exception(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, int, bool) @ 0xb4903fa in /usr/bin/clickhouse
1. DB::Exception::Exception<double, double>(int, fmt::v8::basic_format_string<char, fmt::v8::type_identity<double>::type, fmt::v8::type_identity<double>::type>, double&&, double&&) @ 0x15e7ebec in /usr/bin/clickhouse
2. DB::ExecutionSpeedLimits::checkTimeLimit(Stopwatch const&, DB::OverflowMode) const @ 0x15e7eacc in /usr/bin/clickhouse
3. DB::PipelineExecutor::finalizeExecution() @ 0x16d0c2a2 in /usr/bin/clickhouse
4. DB::CompletedPipelineExecutor::execute() @ 0x16d0a204 in /usr/bin/clickhouse
5. DB::executeQuery(DB::ReadBuffer&, DB::WriteBuffer&, bool, std::__1::shared_ptr<DB::Context>, std::__1::function<void (std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&)>, std::__1::optional<DB::FormatSettings> const&) @ 0x160dbc33 in /usr/bin/clickhouse
6. DB::HTTPHandler::processQuery(DB::HTTPServerRequest&, DB::HTMLForm&, DB::HTTPServerResponse&, DB::HTTPHandler::Output&, std::__1::optional<DB::CurrentThread::QueryScope>&) @ 0x16a42871 in /usr/bin/clickhouse
7. DB::HTTPHandler::handleRequest(DB::HTTPServerRequest&, DB::HTTPServerResponse&) @ 0x16a46f22 in /usr/bin/clickhouse
8. DB::HTTPServerConnection::run() @ 0x16ccddf3 in /usr/bin/clickhouse
9. Poco::Net::TCPServerConnection::start() @ 0x1b0bbc2f in /usr/bin/clickhouse
10. Poco::Net::TCPServerDispatcher::run() @ 0x1b0be081 in /usr/bin/clickhouse
11. Poco::PooledThread::run() @ 0x1b284169 in /usr/bin/clickhouse
12. Poco::ThreadImpl::runnableEntry(void*) @ 0x1b2814c0 in /usr/bin/clickhouse
13. ? @ 0x7f4927458609 in ?
14. __clone @ 0x7f492737d133 in ?
 (version 22.5.1.2079 (official build))
```

**Additional context**

I'm running latest stable version (22.5.1.2079) as a docker container on my laptop with default settings. but was able to reproduce it in play.clickhouse.com as well (sorry if it crashed anything 🙈)
const std::string & column_name_,
        int direction_ = 1,
        int nulls_direction_ = 1,
        const std::shared_ptr<Collator> & collator_ = nullptr,
        bool with_fill_ = false,
        const FillColumnDescription & fill_description_ = {})
        : column_name(column_name_)
        , direction(direction_)
        , nulls_direction(nulls_direction_)
        , collator(collator_)
        , with_fill(with_fill_)
        , fill_description(fill_description_)
    {
    }
    bool operator == (const SortColumnDescription & other) const
    {
        return column_name == other.column_name && direction == other.direction && nulls_direction == other.nulls_direction;
    }
    bool operator != (const SortColumnDescription & other) const
    {
        return !(*this == other);
    }
    std::string dump() const { return fmt::format("{}:dir {}nulls {}", column_name, direction, nulls_direction); }
    void explain(JSONBuilder::JSONMap & map) const;
};
struct SortColumnDescriptionWithColumnIndex
{
    SortColumnDescription base;
    size_t column_number;
    SortColumnDescriptionWithColumnIndex(SortColumnDescription description_, size_t column_number_)