Found with MSan [1], the following query triggers null dereference:

```sql
SELECT
    Y.id - 1
FROM X
RIGHT JOIN Y ON (X.id + 1) = Y.id
SETTINGS join_use_nulls=1; -- { serverError 53 }
```

```
Received signal 11
(version 21.3.1.5916, build id: 2E9E84AA32AEAAC7C8B6EB45DA3EC0B4F15E9ED4) (from thread 100) (query_id: 9ab8cb0d-be8d-445e-8498-930a7268488b) Received signal Segmentation fault (11)
Address: 0x10 Access: read. Address not mapped to object.
Stack trace: 0x2d079d65 0x29bf1f30 0x12b12220 0x12b13098 0x12b17b08 0x12b20459 0x2ae37913 0x2ae352d9 0x2c746072 0x2c7585dd 0x2c7483e3 0x2c74e63d 0x2c7483e3 0x2c74e63d 0x2c7483e3 0x2c74e63d 0x2c7483e3 0x2c74e63d 0x2c7483e3 0x2c74e63d 0x2c7483e3 0x2c74e63d 0x2c7483e3 0x2c74e63d 0x2c7483e3 0x2c74e63d 0x2c7483e3 0x2c74e63d
4. ./obj-x86_64-linux-gnu/../contrib/boost/boost/smart_ptr/intrusive_ptr.hpp:0: DB::ColumnConst::ColumnConst(COW<DB::IColumn>::immutable_ptr<DB::IColumn> const&, unsigned long) @ 0x2d079d65 in /workspace/clickhouse
5. ./obj-x86_64-linux-gnu/../src/Common/COW.h:0: DB::createBlockWithNestedColumns(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&) @ 0x29bf1f30 in /workspace/clickhouse
6. DB::FunctionOverloadResolverAdaptor::getReturnTypeDefaultImplementationForNulls(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&, std::__1::function<std::__1::shared_ptr<DB::IDataType const> (std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&)> const&) @ 0x12b12220 in /workspace/clickhouse
7. DB::FunctionOverloadResolverAdaptor::getReturnTypeWithoutLowCardinality(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&) const @ 0x12b13098 in /workspace/clickhouse
8. DB::FunctionOverloadResolverAdaptor::getReturnType(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&) const @ 0x12b17b08 in /workspace/clickhouse
9. DB::FunctionOverloadResolverAdaptor::build(std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> > const&) const @ 0x12b20459 in /workspace/clickhouse
```

  [1]: https://clickhouse-test-reports.s3.yandex.net/19451/64c0bf98290362fa216c05b070aa122a12af3c25/fuzzer_msan/report.html#fail1

UBsan report the following [1], when query does not contains any columns
from the dictionary:

```sql
SELECT
    toUInt32(toUInt32(NULL, toUInt32(NULL, inf, NULL), NULL)),
    toUInt32(toUInt32(toUInt32(toUInt32(toUInt32(NULL, 1., NULL)), toUInt32(toUInt32(NULL, 0.5, NULL)), toUInt32(NULL, NULL)), toUInt32(toUInt32(NULL, 1., NULL)), toUInt32(NULL, NULL)), toUInt32(toUInt32(toUInt32(toUInt32(NULL, 1000.0001220703125, NULL)), toUInt32(toUInt32(NULL, 10.000100135803223, NULL)), toUInt32(NULL, NULL)), NULL, NULL, NULL))
FROM somedict
```

```
std::__1::vector<DB::ColumnWithTypeAndName, std::__1::allocator<DB::ColumnWithTypeAndName> >::back() @ 0x128c07a6 in /workspace/clickhouse
./obj-x86_64-linux-gnu/../src/Dictionaries/RangeDictionaryBlockInputStream.h:0: DB::RangeDictionaryBlockInputStream<DB::RangeHashedDictionary, unsigned short, unsigned long>::fillBlock(DB::PODArray<unsigned long, 4096ul, Allocator<false, false>, 15ul, 16ul> const&, DB::PODArray<unsigned short, 4096ul, Allocator<false, false>, 15ul, 16ul> const&, DB::PODArray<unsigned short, 4096ul, Allocator<false, false>, 15ul, 16ul> const&) const @ 0x1692335e in /workspace/clickhouse
./obj-x86_64-linux-gnu/../src/Dictionaries/RangeDictionaryBlockInputStream.h:0: DB::RangeDictionaryBlockInputStream<DB::RangeHashedDictionary, unsigned short, unsigned long>::getBlock(unsigned long, unsigned long) const @ 0x16922f96 in /workspace/clickhouse
./obj-x86_64-linux-gnu/../src/Dictionaries/DictionaryBlockInputStreamBase.cpp:23: DB::DictionaryBlockInputStreamBase::getHeader() const @ 0x166ab57c in /workspace/clickhouse
```

  [1]: https://clickhouse-test-reports.s3.yandex.net/19451/64c0bf98290362fa216c05b070aa122a12af3c25/fuzzer_ubsan/report.html#fail1

For flaky checker

It is possible to execute DROP just before an INSERT will acquire the
lock for the underlying table, and then the test will fail [1]:

    2021-02-09 13:03:27 00738_lock_for_inner_table:                                             [ FAIL ] 3.18 sec. - having stderror:
    2021-02-09 13:03:27 [3eff0fc65d1a] 2021.02.09 13:03:27.440841 [ 220384 ] {test_00738} <Error> executeQuery: Code: 60, e.displayText() = DB::Exception: Table default.`.inner_id.00000738-1000-4000-8000-000000000001` (9647fbaa-a80d-420e-9240-30f5719a84e7) doesn't exist (version 21.3.1.5956) (from [::1]:56964) (comment: '/usr/share/clickhouse-test/queries/0_stateless/01701_if_tuple_segfault.sql') (in query: INSERT INTO tab_00738 SELECT number FROM numbers(10000000)), Stack trace (when copying this message, always include the lines below):
    2021-02-09 13:03:27
    2021-02-09 13:03:27 0. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/exception:133: std::exception::capture() @ 0x10d0a908 in /usr/bin/clickhouse
    2021-02-09 13:03:27 1. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/exception:111: std::exception::exception() @ 0x10d0a8d5 in /usr/bin/clickhouse
    2021-02-09 13:03:27 2. ./obj-x86_64-linux-gnu/../contrib/poco/Foundation/src/Exception.cpp:27: Poco::Exception::Exception(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, int) @ 0x1e5b4943 in /usr/bin/clickhouse
    2021-02-09 13:03:27 3. ./obj-x86_64-linux-gnu/../src/Common/Exception.cpp:54: DB::Exception::Exception(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, int, bool) @ 0x10cec720 in /usr/bin/clickhouse
    2021-02-09 13:03:27 4. ./obj-x86_64-linux-gnu/../src/Common/Exception.h:38: DB::Exception::Exception<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >(int, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >&&) @ 0x10e82041 in /usr/bin/clickhouse
    2021-02-09 13:03:27 5. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/optional:324: void std::__1::__optional_storage_base<DB::Exception, false>::__construct<int const&, char const (&) [23], std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >(int const&, char const (&) [23], std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >&&) @ 0x19940df9 in /usr/bin/clickhouse
    2021-02-09 13:03:27 6. ./obj-x86_64-linux-gnu/../contrib/libcxx/include/optional:830: DB::Exception& std::__1::optional<DB::Exception>::emplace<int const&, char const (&) [23], std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, void>(int const&, char const (&) [23], std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >&&) @ 0x19939b7a in /usr/bin/clickhouse
    2021-02-09 13:03:27 7. ./obj-x86_64-linux-gnu/../src/Interpreters/DatabaseCatalog.cpp:233: DB::DatabaseCatalog::getTableImpl(DB::StorageID const&, DB::Context const&, std::__1::optional<DB::Exception>*) const @ 0x1992efcf in /usr/bin/clickhouse
    2021-02-09 13:03:27 8. ./obj-x86_64-linux-gnu/../src/Interpreters/DatabaseCatalog.cpp:641: DB::DatabaseCatalog::getTable(DB::StorageID const&, DB::Context const&) const @ 0x19932fba in /usr/bin/clickhouse
    2021-02-09 13:03:27 9. ./obj-x86_64-linux-gnu/../src/Storages/StorageMaterializedView.cpp:376: DB::StorageMaterializedView::getTargetTable() const @ 0x1a5fe2bf in /usr/bin/clickhouse
    2021-02-09 13:03:27 10. ./obj-x86_64-linux-gnu/../src/DataStreams/PushingToViewsBlockOutputStream.cpp:88: DB::PushingToViewsBlockOutputStream::PushingToViewsBlockOutputStream(std::__1::shared_ptr<DB::IStorage> const&, std::__1::shared_ptr<DB::StorageInMemoryMetadata const> const&, DB::Context const&, std::__1::shared_ptr<DB::IAST> const&, bool) @ 0x19e26530 in /usr/bin/clickhouse

And if you will take a look at the 88 line, you will see that this is
just a timing issue.

  [1]: https://clickhouse-test-reports.s3.yandex.net/19673/7bddaba9208232f54095712f0cbfa44c6a5e2564/functional_stateless_tests_(antlr_debug).html#fail1

https://clickhouse-test-reports.s3.yandex.net/20301/3adadeb12bb7d2f4c9405927a28f9f7a49617d46/functional_stateless_tests_flaky_check_(address).html#fail1

https://clickhouse-test-reports.s3.yandex.net/20301/b6dc721e332e30c7e6dde40282441dd59cfa276e/functional_stateless_tests_flaky_check_(address).html#fail1

$ gg -e 'numbers(toUInt64' -e 'numbers_mt(toUInt64' | cut -d: -f1 | sort -u | xargs sed -i -E 's#numbers(_mt|)\(toUInt64\(([^()]*)\)\)#numbers\1(\2)#'

This is to make the syntax simpler, i.e. avoid explicit cast to UInt64
if you want to use scientific notation (i.e. 1e9 over 1 000 000 000).

v2: use plain evaluateConstantExpression() over
evaluateConstantExpressionOrIdentifierAsLiteral() since identifier will
not work anyway

* [WIP]

* Update skip-list

* Update ci_config.json

* Do not sync inserts for test

* Fix more tests

* Fix another test

* Enable one more test

* More fixed tests

* More test fixes

* Do not absolutize server path for now

* More test fixes

* Unset CLICKHOUSE_LOG_COMMENT where necessary

* Remove debugging set -e

* Fix more tests

* Fix test reference

* Fix style check