Bug report: Strange error message "Unknown identifier '_subquery2062' " while processing SELECT query

[JZuming]

Describe the bug

I used my fuzzing tool to test ClickHouse (v21.5.6.6-stable), and found that it returned stange error message when processing a sql.

Does it reproduce on recent release?

v21.5.6.6-stable

How to reproduce

• ClickHouse server version: v21.5.6.6-stable
• Installation:

1. mkdir build; cd build
2. cmake ..  \
        -DCMAKE_BUILD_TYPE=Debug     \
        -DENABLE_CLICKHOUSE_ALL=OFF     \
        -DENABLE_CLICKHOUSE_SERVER=ON     \
        -DENABLE_CLICKHOUSE_CLIENT=ON     \
        -DENABLE_LIBRARIES=OFF     \
        -DUSE_UNWIND=ON     \
        -DENABLE_UTILS=OFF     \
        -DENABLE_TESTS=OFF -DSANITIZE=address
3. sudo make install

• Test command:

1. clickhouse-server &

2. clickhouse-client --query '
create table t_tfhsjq (
c_nv8klrpdo INTEGER ,
c_dfyx TEXT ,
primary key(c_nv8klrpdo)
) engine = MergeTree();'

3. clickhouse-client --query '
select distinct
  0
from
  (select
        min((select c_nv8klrpdo from t_tfhsjq order by c_nv8klrpdo limit 1 offset 1)) as c7
      from
        t_tfhsjq as ref_0
      where 1 < (
          select
              ref_2.c_nv8klrpdo as c0
            from
              t_tfhsjq as ref_2
            )
  ) as subq_0;'

Expected behavior

Normally run without any error message

Error message and/or stacktrace

Received exception from server (version 21.5.6):
Code: 47. DB::Exception: Received from localhost:9000. DB::Exception: Unknown identifier '_subquery2062' in aggregate function 'min(NULL AS _subquery2062) AS c7'.

Additional context

When I use the following SELECT query whose subqeury does not have where clause, it succeed. So I suspect there is bug.

clickhouse-client --query '
select distinct
  0
from
  (select
        min((select c_nv8klrpdo from t_tfhsjq order by c_nv8klrpdo limit 1 offset 1)) as c7
      from
        t_tfhsjq as ref_0
  ) as subq_0
;'

[alexey-milovidov]

Reproduced on master.

[alexey-milovidov]

We need more fuzzing tools for ClickHouse.
Is there any chance to make your tool available for us?

[alexey-milovidov]

This issue can be held until #23194

[JZuming]

Thanks for the confirmation. My fuzzing is still under development and it is for one of my research project. I hope it can be used publicly in the future.

We need more fuzzing tools for ClickHouse.
Is there any chance to make your tool available for us?

[alexey-milovidov]

I will close this issue in favor of #23194.