**Describe the bug**
https://s3.amazonaws.com/clickhouse-test-reports/43308/9ecda9f45c911047e04e8a089741a19ee49fe16a/fuzzer_astfuzzerubsan//report.html

**How to reproduce**
```
milovidov-desktop :) SET allow_experimental_analyzer = 1

SET allow_experimental_analyzer = 1

Query id: 16b87806-ef86-4541-8632-b85496fe92fb

Ok.

0 rows in set. Elapsed: 0.000 sec. 

milovidov-desktop :) SELECT uniqCombined(tuple('')) FROM numbers(1.)

SELECT uniqCombined(tuple(''))
FROM numbers(1.)

Query id: f2027937-5fbc-4e47-b1b3-4b224e3a0495

Aborted (core dumped)
```

#include <Analyzer/Passes/UniqInjectiveFunctionsEliminationPass.h>
#include <Functions/IFunction.h>
#include <Analyzer/InDepthQueryTreeVisitor.h>
#include <Analyzer/FunctionNode.h>
namespace DB
{
namespace
{
bool isUniqFunction(const String & function_name)
{
    return function_name == "uniq" ||
        function_name == "uniqExact" ||
        function_name == "uniqHLL12" ||
        function_name == "uniqCombined" ||
        function_name == "uniqCombined64" ||
        function_name == "uniqTheta";
}
class UniqInjectiveFunctionsEliminationVisitor : public InDepthQueryTreeVisitor<UniqInjectiveFunctionsEliminationVisitor>
{
public:
    static void visitImpl(QueryTreeNodePtr & node)