ABORT THROWN BY INTERNAL EXCEPTION: Positional reference expression could not be bound ../duckdb(+0x18d9a2d8) [0x55ce7604e2d8] ../duckdb(+0x18c6eefd) [0x55ce75f22efd] ../duckdb(+0x1b42c7b8) [0x55ce786e07b8] ../duckdb(+0x1b79c64b) [0x55ce78...

[fuzzerofducks]

Issue found by DuckFuzz on git commit hash using seed 800666629.

To Reproduce

call dbgen(sf = 0.1);

SELECT
	DISTINCT c7,
	(c3 < NULL),
	c9
FROM
	(
		SELECT
			DISTINCT c8,
			c2,
			rank() OVER (
				ORDER BY
					c6 RANGE BETWEEN CURRENT ROW
					AND c2 FOLLOWING
			)
		FROM
			nation AS t5(c1, c2, c3, c4) ASOF
			INNER JOIN (
				SELECT
					DISTINCT c1
				FROM
					nation AS t10(c6, c7, c8, c9)
				HAVING
					nth_value(
						c8,
						#8) OVER (RANGE BETWEEN '24:00:00-15:59:59'::TIME WITH TIME ZONE PRECEDING AND 'c7607984-ed9f-4f50-a6e3-62b94b3a6e9c' PRECEDING) USING SAMPLE 19% (System) ORDER BY * DESC NULLS FIRST) AS t11 ON (8252) WHERE 'enum_299' HAVING c2 ORDER BY *) AS t12 ORDER BY * ASC;

Error Message

INTERNAL Error:
Positional reference expression could not be bound

Stack Trace:

0        Exception::Exception(ExceptionType, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&) + 64
1        InternalException::InternalException(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&) + 20
2        ExpressionBinder::BindPositionalReference(unique_ptr<ParsedExpression, std::__1::default_delete<ParsedExpression>, true>&, unsigned long long, bool) + 236
3        ExpressionBinder::BindExpression(unique_ptr<ParsedExpression, std::__1::default_delete<ParsedExpression>, true>&, unsigned long long, bool) + 180
4        ExpressionBinder::Bind(unique_ptr<ParsedExpression, std::__1::default_delete<ParsedExpression>, true>&, unsigned long long, bool) + 176
5        ExpressionBinder::BindChild(unique_ptr<ParsedExpression, std::__1::default_delete<ParsedExpression>, true>&, unsigned long long, ErrorData&) + 44
6        ParsedExpressionIterator::EnumerateChildren(ParsedExpression&, std::__1::function<void (unique_ptr<ParsedExpression, std::__1::default_delete<ParsedExpression>, true>&)> const&) + 380
7        ExpressionBinder::BindUnsupportedExpression(ParsedExpression&, unsigned long long, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&) + 120
8        LateralBinder::BindExpression(unique_ptr<ParsedExpression, std::__1::default_delete<ParsedExpression>, true>&, unsigned long long, bool) + 236
9        ExpressionBinder::Bind(unique_ptr<ParsedExpression, std::__1::default_delete<ParsedExpression>, true>&, unsigned long long, bool) + 176
10       ExpressionBinder::BindCorrelatedColumns(unique_ptr<ParsedExpression, std::__1::default_delete<ParsedExpression>, true>&, ErrorData) + 396
11       ExpressionBinder::Bind(unique_ptr<ParsedExpression, std::__1::default_delete<ParsedExpression>, true>&, optional_ptr<LogicalType, true>, bool) + 216
12       Binder::BindSelectNode(SelectNode&, unique_ptr<BoundTableRef, std::__1::default_delete<BoundTableRef>, true>) + 3480
13       Binder::BindNode(SelectNode&) + 96
14       Binder::BindNode(QueryNode&) + 128
15       Binder::Bind(SubqueryRef&) + 116
16       Binder::Bind(TableRef&) + 256
17       Binder::Bind(JoinRef&) + 692
18       Binder::Bind(TableRef&) + 444
19       Binder::BindNode(SelectNode&) + 68
20       Binder::BindNode(QueryNode&) + 128
21       Binder::Bind(SubqueryRef&) + 116
22       Binder::Bind(TableRef&) + 256
23       Binder::BindNode(SelectNode&) + 68
24       Binder::BindNode(QueryNode&) + 128
25       Binder::Bind(QueryNode&) + 48
26       Planner::CreatePlan(SQLStatement&) + 148
27       ClientContext::CreatePreparedStatementInternal(ClientContextLock&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, unique_ptr<SQLStatement, std::__1::default_delete<SQLStatement>, true>, optional_ptr<std::__1::unordered_map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, BoundParameterData, CaseInsensitiveStringHashFunction, CaseInsensitiveStringEquality, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const, BoundParameterData>>>, true>) + 448
28       ClientContext::CreatePreparedStatement(ClientContextLock&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, unique_ptr<SQLStatement, std::__1::default_delete<SQLStatement>, true>, optional_ptr<std::__1::unordered_map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, BoundParameterData, CaseInsensitiveStringHashFunction, CaseInsensitiveStringEquality, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const, BoundParameterData>>>, true>, PreparedStatementMode) + 1032
29       ClientContext::PendingStatementInternal(ClientContextLock&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, unique_ptr<SQLStatement, std::__1::default_delete<SQLStatement>, true>, PendingQueryParameters const&) + 128
30       ClientContext::PendingStatementOrPreparedStatement(ClientContextLock&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, unique_ptr<SQLStatement, std::__1::default_delete<SQLStatement>, true>, shared_ptr<PreparedStatementData, true>&, PendingQueryParameters const&) + 304
31       ClientContext::PendingStatementOrPreparedStatementInternal(ClientContextLock&, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const&, unique_ptr<SQLStatement, std::__1::default_delete<SQLStatement>, true>, shared_ptr<PreparedStatementData, true>&, PendingQueryParameters const&) + 1580
32       ClientContext::PendingQueryInternal(ClientContextLock&, unique_ptr<SQLStatement, std::__1::default_delete<SQLStatement>, true>, PendingQueryParameters const&, bool) + 132
33       ClientContext::PendingQuery(unique_ptr<SQLStatement, std::__1::default_delete<SQLStatement>, true>, std::__1::unordered_map<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>>, BoundParameterData, CaseInsensitiveStringHashFunction, CaseInsensitiveStringEquality, std::__1::allocator<std::__1::pair<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char>> const, BoundParameterData>>>&, bool) + 220
34       ClientContext::PendingQuery(unique_ptr<SQLStatement, std::__1::default_delete<SQLStatement>, true>, bool) + 60
35       Connection::PendingQuery(unique_ptr<SQLStatement, std::__1::default_delete<SQLStatement>, true>, bool) + 64
36       duckdb_shell_sqlite3_prepare_v2 + 992
37       duckdb_shell::ShellState::ExecuteSQL(char const*, char**) + 108
38       duckdb_shell::ShellState::RunOneSqlLine(duckdb_shell::InputMode, char*) + 260
39       duckdb_shell::ShellState::ProcessInput(duckdb_shell::InputMode) + 1056
40       main + 4072
41       start + 6076

This error signals an assertion failure within DuckDB. This usually occurs due to unexpected conditions or errors in the program's logic.
For more information, see https://duckdb.org/docs/stable/dev/internal_errors

[c-herrewijn]

Issue reproducible on: DuckDB v1.5.0-dev722 (Development Version) b3c8acdc0e

[hawkfish]

Window functions can't appear in HAVING clauses as they are evaluated after aggregation. Probably just need to check in the parser or something.

[hawkfish]

We do. Then the caller ignores the error...