**Describe the bug**
1. https://clickhouse-test-reports.s3.yandex.net/19736/68c542aec681bbf841f45fc879c1e97052449555/fuzzer_ubsan/server.log
2. https://clickhouse-test-reports.s3.yandex.net/19736/68c542aec681bbf841f45fc879c1e97052449555/fuzzer_asan/server.log
3. https://clickhouse-test-reports.s3.yandex.net/19736/68c542aec681bbf841f45fc879c1e97052449555/fuzzer_msan/server.log
4. https://clickhouse-test-reports.s3.yandex.net/19736/342326978f2bb2fe5c108c2801cdbabaf407fa68/fuzzer_debug/server.log
5. https://clickhouse-test-reports.s3.yandex.net/19736/342326978f2bb2fe5c108c2801cdbabaf407fa68/fuzzer_tsan/server.log

CC @zhang2014 
null_map_holder = extractNestedColumnsAndNullMap(key_columns, null_map);
    
    ColumnUInt8::MutablePtr filter;
    if (fill_set_elements)
        filter = ColumnUInt8::create(block.rows());
    switch (data.type)
    {
        case SetVariants::Type::EMPTY:
            break;
#define M(NAME) \
        case SetVariants::Type::NAME: \
            insertFromBlockImpl(*data.NAME, key_columns, rows, data, null_map, filter ? &filter->getData() : nullptr); \
            break;
        APPLY_FOR_SET_VARIANTS(M)
#undef M
    }
    if (fill_set_elements)
    {
        for (size_t i = 0; i < keys_size; ++i)
        {
            auto filtered_column = key_columns[i]->filter(filter->getData(), rows);
            if (set_elements[i]->empty())
                set_elements[i] = filtered_column;
            else
                set_elements[i]->insertRangeFrom(*filtered_column, 0, filtered_column->size());
        }
    }
    return limits.check(data.getTotalRowCount(), data.getTotalByteCount(), "IN-set", ErrorCodes::SET_SIZE_LIMIT_EXCEEDED);
}
ColumnPtr Set::execute(const Block & block, bool negative) const