ABORT THROWN BY INTERNAL EXCEPTION: Positional reference expression could not be bound

[fuzzerofducks]

Issue found by DuckFuzz on git commit hash 4c362 using seed 399370261.

To Reproduce

create table all_types as select * exclude(small_enum, medium_enum, large_enum) from test_all_types();
SELECT NULL FROM all_types INNER JOIN (SELECT NULL LIMIT rank_dense() OVER (PARTITION BY #4, NULL, NULL, NULL ROWS BETWEEN c83 PRECEDING AND CURRENT ROW)) USING (c19)

Error Message

ABORT THROWN BY INTERNAL EXCEPTION: Positional reference expression could not be bound

Stack Trace

duckdb::StackTrace::GetStackTrace[abi:cxx11](unsigned long) 
duckdb::InternalException::InternalException(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) 
duckdb::ExpressionBinder::BindPositionalReference(duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&, unsigned long, bool) 
duckdb::ExpressionBinder::BindExpression(duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&, unsigned long, bool) 
duckdb::LateralBinder::BindExpression(duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&, unsigned long, bool) 
duckdb::ExpressionBinder::Bind(duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&, unsigned long, bool) 
duckdb::ExpressionBinder::BindChild(duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&, unsigned long, duckdb::ErrorData&) 
 
 
 
 
std::function<void (duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&)>::operator()(duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&) const 
duckdb::ParsedExpressionIterator::EnumerateChildren(duckdb::ParsedExpression&, std::function<void (duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&)> const&) 
duckdb::ExpressionBinder::BindUnsupportedExpression(duckdb::ParsedExpression&, unsigned long, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) 
duckdb::LateralBinder::BindExpression(duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&, unsigned long, bool) 
duckdb::ExpressionBinder::Bind(duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&, unsigned long, bool) 
duckdb::ExpressionBinder::BindCorrelatedColumns(duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&, duckdb::ErrorData) 
duckdb::ExpressionBinder::Bind(duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>&, duckdb::optional_ptr<duckdb::LogicalType, true>, bool) 
duckdb::Binder::BindLimitValue(duckdb::OrderBinder&, duckdb::unique_ptr<duckdb::ParsedExpression, std::default_delete<duckdb::ParsedExpression>, true>, bool, bool) 
duckdb::Binder::BindLimit(duckdb::OrderBinder&, duckdb::LimitModifier&) 
duckdb::Binder::PrepareModifiers(duckdb::OrderBinder&, duckdb::QueryNode&, duckdb::BoundQueryNode&) 
duckdb::Binder::BindSelectNode(duckdb::SelectNode&, duckdb::BoundStatement) 
duckdb::Binder::BindNode(duckdb::SelectNode&) 
duckdb::Binder::BindNode(duckdb::QueryNode&) 
duckdb::Binder::Bind(duckdb::SubqueryRef&) 
duckdb::Binder::Bind(duckdb::TableRef&) 
duckdb::Binder::BindJoin(duckdb::Binder&, duckdb::TableRef&) 
duckdb::Binder::Bind(duckdb::JoinRef&) 
duckdb::Binder::Bind(duckdb::TableRef&) 
duckdb::Binder::BindNode(duckdb::SelectNode&) 
duckdb::Binder::BindNode(duckdb::QueryNode&) 
duckdb::Binder::Bind(duckdb::QueryNode&) 
duckdb::Binder::Bind(duckdb::SelectStatement&) 
duckdb::Binder::Bind(duckdb::SQLStatement&) 
duckdb::Planner::CreatePlan(duckdb::SQLStatement&) 
duckdb::Planner::CreatePlan(duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>) 
duckdb::ClientContext::CreatePreparedStatementInternal(duckdb::ClientContextLock&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>, duckdb::PendingQueryParameters) 
duckdb::ClientContext::CreatePreparedStatement(duckdb::ClientContextLock&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>, duckdb::PendingQueryParameters, duckdb::PreparedStatementMode) 
duckdb::ClientContext::PendingStatementInternal(duckdb::ClientContextLock&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>, duckdb::PendingQueryParameters const&) 
duckdb::ClientContext::PendingStatementOrPreparedStatement(duckdb::ClientContextLock&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>, duckdb::shared_ptr<duckdb::PreparedStatementData, true>&, duckdb::PendingQueryParameters const&) 
duckdb::ClientContext::PendingStatementOrPreparedStatementInternal(duckdb::ClientContextLock&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>, duckdb::shared_ptr<duckdb::PreparedStatementData, true>&, duckdb::PendingQueryParameters const&) 
duckdb::ClientContext::PendingQueryInternal(duckdb::ClientContextLock&, duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>, duckdb::PendingQueryParameters const&, bool) 
duckdb::ClientContext::PendingQuery(duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>, std::unordered_map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, duckdb::BoundParameterData, duckdb::CaseInsensitiveStringHashFunction, duckdb::CaseInsensitiveStringEquality, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const, duckdb::BoundParameterData> > >&, duckdb::QueryParameters) 
duckdb::ClientContext::PendingQuery(duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>, duckdb::QueryParameters) 
duckdb::ClientContext::Query(duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>, duckdb::QueryParameters) 
duckdb::Connection::SendQuery(duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>, duckdb::QueryParameters) 
duckdb_shell::ShellState::ExecuteStatement(duckdb::unique_ptr<duckdb::SQLStatement, std::default_delete<duckdb::SQLStatement>, true>) 
duckdb_shell::ShellState::ExecuteSQL(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) 
duckdb_shell::ShellState::RunOneSqlLine(duckdb_shell::InputMode, char*) 
duckdb_shell::ShellState::ProcessInput(duckdb_shell::InputMode) 
main 
_start