Fix logical error in correlated subqueries with group_by_use_nulls

A correlated scalar subquery referencing an outer `GROUP BY` key that
becomes `Nullable` via `group_by_use_nulls` (`GROUPING SETS` / `ROLLUP` /
`CUBE` / `WITH TOTALS`) aborted with:

  Logical error: Unexpected return type from toString. Expected String. Got Nullable(String)

The `group_by_use_nulls` nullability walk in `resolveExpressionNode`
stops at the subquery's own query scope, so a correlated column kept its
non-`Nullable` type while decorrelation fed in the real `Nullable`
column, mismatching a baked function result type (`toString` -> `String`
vs `Nullable(String)`).

Continue the walk past a subquery's query boundary for correlated
columns and convert the column to `Nullable` in place, preserving the
node identity shared with the subquery's correlated-columns set (which
the planner matches by identity).

Discovered by the AST fuzzer in the `amd_msan` stress test:
https://github.com/ClickHouse/ClickHouse/actions/runs/28286443407/job/83839128485?pr=108685
Related: ClickHouse#108685

Author: coderashed

src/Analyzer/Resolve/QueryAnalyzer.cpp

@@ -3075,6 +3075,24 @@ ProjectionNames QueryAnalyzer::resolveLambda(const QueryTreeNodePtr & lambda_nod
   *
   * 4. If node has alias, update its value in scope alias map. Deregister alias from expression_aliases_in_resolve_process.
   */
+
+/** Return true if `scope` owns the source of the column `node`, i.e. the column's source table
+  * expression is registered (or being resolved) in this scope's FROM section. A column whose
+  * source is not owned by `scope` but by an ancestor query scope is a correlated column.
+  *
+  * Read-only: unlike `checkCorrelatedColumn`, this does not register the column in any
+  * `addCorrelatedColumn` set; it only inspects scope ownership.
+  */
+static bool scopeOwnsColumnSource(const IdentifierResolveScope * scope, const QueryTreeNodePtr & node)
+{
+    if (node->getNodeType() != QueryTreeNodeType::COLUMN)
+        return true;
+
+    const auto column_source = node->as<ColumnNode>()->getColumnSource();
+    return scope->registered_table_expression_nodes.contains(column_source)
+        || scope->table_expressions_in_resolve_process.contains(column_source.get());
+}
+
 ProjectionNames QueryAnalyzer::resolveExpressionNode(
     QueryTreeNodePtr & node,
     IdentifierResolveScope & scope,
@@ -3519,27 +3537,54 @@ ProjectionNames QueryAnalyzer::resolveExpressionNode(
 
     if (!in_aggregate_or_grouping_function_scope)
     {
+        /// Set once the scope walk passes a subquery's own query scope to reach the outer query
+        /// that owns a correlated column's source. Distinguishes a correlated reference (handled
+        /// in place below) from an ordinary one (cloned).
+        bool crossed_query_boundary = false;
         for (const auto * scope_ptr = &scope; scope_ptr; scope_ptr = scope_ptr->parent_scope)
         {
             if (!scope_ptr->nullable_group_by_keys.empty())
             {
                 auto it = scope_ptr->nullable_group_by_keys.find(node);
                 if (it != scope_ptr->nullable_group_by_keys.end())
                 {
-                    /// Clone the GROUP BY key and convert it to Nullable. For a constant we clone the
-                    /// matched node itself rather than the stored key `it->second`: two constants equal
-                    /// in value and type but with different source expressions share a single map entry,
-                    /// and the source expression determines the action node name (hence which aggregation
-                    /// key column the projection reads), so the matched node's own one must be preserved.
-                    node = (node->getNodeType() == QueryTreeNodeType::CONSTANT ? node : it->second)->clone();
-                    node->convertToNullable();
+                    if (crossed_query_boundary)
+                    {
+                        /// Correlated column referencing an outer nullable GROUP BY key. Convert it
+                        /// in place: the same node object is shared with the subquery's
+                        /// correlated-columns set (populated during identifier resolution), and the
+                        /// planner matches that set against the decorrelated input by identity.
+                        /// Cloning here (as in the ordinary case) would desynchronize the set from
+                        /// the usage and break decorrelation ("Not found column ...").
+                        node->convertToNullable();
+                    }
+                    else
+                    {
+                        /// Clone the GROUP BY key and convert it to Nullable. For a constant we clone the
+                        /// matched node itself rather than the stored key `it->second`: two constants equal
+                        /// in value and type but with different source expressions share a single map entry,
+                        /// and the source expression determines the action node name (hence which aggregation
+                        /// key column the projection reads), so the matched node's own one must be preserved.
+                        node = (node->getNodeType() == QueryTreeNodeType::CONSTANT ? node : it->second)->clone();
+                        node->convertToNullable();
+                    }
                     break;
                 }
             }
 
-            /// Check parent scopes until find current query scope.
+            /// Normally we stop at the current query scope: a column belonging to this query must
+            /// not pick up an ancestor query's GROUP BY nullability. A correlated column is the
+            /// exception — its source lives in an outer query, so `group_by_use_nulls` on that
+            /// outer GROUP BY makes the correlated value Nullable and we must keep walking up to
+            /// the scope that owns it. Without this, a correlated reference to an outer nullable
+            /// GROUP BY key stays non-Nullable while the decorrelated plan feeds in the real
+            /// Nullable column, producing a type mismatch ("Unexpected return type ...").
             if (scope_ptr->scope_node->getNodeType() == QueryTreeNodeType::QUERY)
-                break;
+            {
+                if (scopeOwnsColumnSource(scope_ptr, node))
+                    break;
+                crossed_query_boundary = true;
+            }
         }
     }
 

tests/queries/0_stateless/04413_correlated_subquery_group_by_use_nulls.reference

@@ -0,0 +1,20 @@
+Nullable(String)
+0	s0
+1	s1
+2	s2
+0	s0
+1	s1
+2	s2
+
+\N	\N
+0	0
+1	1
+2	2
+\N	\N
+0	0
+1	1
+\N	\N
+0	42
+1	42
+2	42
+\N	42

tests/queries/0_stateless/04413_correlated_subquery_group_by_use_nulls.sql

@@ -0,0 +1,46 @@
+-- Regression test: a correlated scalar subquery that references an outer GROUP BY key
+-- used to abort with a logical error
+--   "Unexpected return type from toString. Expected String. Got Nullable(String)"
+-- when `group_by_use_nulls = 1` made the grouping key Nullable (GROUPING SETS / ROLLUP /
+-- CUBE / WITH TOTALS). The correlated column stayed non-Nullable while the decorrelated
+-- plan fed in the real Nullable column, so the baked result type no longer matched.
+
+SET enable_analyzer = 1;
+SET allow_experimental_correlated_subqueries = 1;
+SET group_by_use_nulls = 1;
+
+-- The correlated column must be Nullable, hence toString over it must be Nullable(String).
+SELECT DISTINCT toTypeName((SELECT toString(number))) AS t
+FROM numbers(3)
+GROUP BY GROUPING SETS ((number));
+
+-- GROUPING SETS
+SELECT number, concat('s', (SELECT toString(number))) AS c
+FROM numbers(3)
+GROUP BY GROUPING SETS ((number))
+ORDER BY number;
+
+-- GROUPING SETS WITH TOTALS
+SELECT number, concat('s', (SELECT toString(number))) AS c
+FROM numbers(3)
+GROUP BY GROUPING SETS ((number))
+WITH TOTALS
+ORDER BY number;
+
+-- ROLLUP: the super-aggregate row has number = NULL, so the correlated value is NULL.
+SELECT number, (SELECT toString(number)) AS c
+FROM numbers(3)
+GROUP BY number WITH ROLLUP
+ORDER BY number NULLS LAST;
+
+-- CUBE
+SELECT number, (SELECT toString(number)) AS c
+FROM numbers(2)
+GROUP BY number WITH CUBE
+ORDER BY number NULLS LAST;
+
+-- A non-correlated subquery in the same shape must be unaffected by group_by_use_nulls.
+SELECT number, (SELECT 42) AS c
+FROM numbers(3)
+GROUP BY number WITH ROLLUP
+ORDER BY number NULLS LAST;