Repository: duckdb/duckdb (language: python)

Issue:
DuckDB Internal Error: Unexpected child of pivot source - not a ColumnRef
### What happens?

The latest version of the DuckDB (latest main: v1.1.4-dev3057 1db3def66e and released version: v1.1.3 19864453f7) triggers Internal Error when running the following SQL statement: 

```sql
CREATE TABLE v00 (c01 INT);
PIVOT v00 AS ta01 FULL JOIN v00 AS ta02 USING ( c01 ) ON c01;
```

Stacktrace from the latest main (1db3def66e):

```
#0  duckdb::InternalException::InternalException (this=0x41084b00, Python Exception <class 'gdb.error'> There is no member named _M_dataplus.:
msg=) at /home/duckdb/duckdb/src/common/exception.cpp:333
#1  0x00000000027ef8d4 in duckdb::ConstructInitialGrouping (ref=..., all_columns=..., handled_columns=std::unordered_set with 1 element = {...})
    at /home/duckdb/duckdb/src/planner/binder/tableref/bind_pivot.cpp:101
#2  0x00000000027a2f2c in duckdb::PivotFilteredAggregate (context=..., ref=..., all_columns=..., handled_columns=std::unordered_set with 1 element = {...},
    pivot_values=...) at /home/duckdb/duckdb/src/planner/binder/tableref/bind_pivot.cpp:126
#3  duckdb::Binder::BindPivot (this=0x41082930, ref=..., all_columns=...) at /home/duckdb/duckdb/src/planner/binder/tableref/bind_pivot.cpp:484
#4  0x00000000027beec0 in duckdb::Binder::Bind (this=<optimized out>, ref=...) at /home/duckdb/duckdb/src/planner/binder/tableref/bind_pivot.cpp:723
#5  0x00000000028f71c8 in duckdb::Binder::Bind (this=0x41082930, ref=...) at /home/duckdb/duckdb/src/planner/binder.cpp:416
#6  0x0000000004b14db0 in duckdb::Binder::BindNode (this=0x41082930, statement=...)
    at /home/duckdb/duckdb/src/planner/binder/query_node/bind_select_node.cpp:372
#7  0x00000000028f4d0c in duckdb::Binder::BindNode (this=0x41082930, node=...) at /home/duckdb/duckdb/src/planner/binder.cpp:328
#8  0x00000000028f5698 in duckdb::Binder::Bind (this=0x41082930, node=...) at /home/duckdb/duckdb/src/planner/binder.cpp:365
#9  0x00000000028eff68 in duckdb::Binder::Bind (this=0x41082930, statement=...) at /home/duckdb/duckdb/src/planner/binder.cpp:150
#10 0x00000000029203c0 in duckdb::Planner::CreatePlan (this=0xffffe5e73c50, statement=...) at /home/duckdb/duckdb/src/planner/planner.cpp:43
#11 0x0000000001890fc8 in duckdb::ClientContext::CreatePreparedStatementInternal (this=<optimized out>, lock=..., Python Exception <class 'gdb.error'> There is no member named _M_dataplus.:
query=, statement=..., values=...)
    at /home/duckdb/duckdb/src/main/client_context.cpp:340
#12 0x0000000001895214 in duckdb::ClientContext::CreatePreparedStatement (this=<optimized out>, lock=..., Python Exception <class 'gdb.error'> There is no member named _M_dataplus.:
query=, statement=..., values=...,
    mode=duckdb::PreparedStatementMode::PREPARE_AND_EXECUTE) at /home/duckdb/duckdb/src/main/client_context.cpp:426
#13 0x00000000018ab804 in duckdb::ClientContext::PendingStatementInternal (this=0x40ee7710, lock=..., Python Exception <class 'gdb.error'> There is no member named _M_dataplus.:
query=, statement=..., parameters=...)
    at /home/duckdb/duckdb/src/main/client_context.cpp:745
#14 0x00000000018b50d0 in duckdb::ClientContext::PendingStatementOrPreparedStatement (this=<optimized out>, lock=..., Python Exception <class 'gdb.error'> There is no member named _M_dataplus.:
query=, statement=..., prepared=...,
    parameters=...) at /home/duckdb/duckdb/src/main/client_context.cpp:863
#15 0x00000000018a93d4 in duckdb::ClientContext::PendingStatementOrPreparedStatementInternal (this=0x40ee7710, lock=..., Python Exception <class 'gdb.error'> There is no member named _M_dataplus.:
query=, statement=...,
    prepared=..., parameters=...) at /home/duckdb/duckdb/src/main/client_context.cpp:837
#16 0x00000000018adc34 in duckdb::ClientContext::PendingQueryInternal (this=0x40ee7710, lock=..., statement=..., parameters=..., verify=<optimized out>)
    at /home/duckdb/duckdb/src/main/client_context.cpp:1054
#17 0x00000000018be110 in duckdb::ClientContext::PendingQuery (this=0x40ee7710, statement=..., values=std::unordered_map with 0 elements,
    allow_stream_result=<optimized out>) at /home/duckdb/duckdb/src/main/client_context.cpp:1041
#18 0x00000000018b7dfc in duckdb::ClientContext::PendingQuery (this=0x2ad8, statement=..., allow_stream_result=false)
    at /home/duckdb/duckdb/src/main/client_context.cpp:1001
#19 0x00000000018ec7d4 in duckdb::Connection::PendingQuery (this=<optimized out>, statement=..., allow_stream_result=false)
    at /home/duckdb/duckdb/src/main/connection.cpp:140
#20 0x00000000004b40f0 in duckdb_shell_sqlite3_prepare_v2 (db=0x40e45b90, zSql=<optimized out>, nByte=<optimized out>, ppStmt=<optimized out>,
    pzTail=<optimized out>) at ../../tools/sqlite3_api_wrapper/sqlite3_api_wrapper.cpp:224
#21 0x000000000046f9dc in duckdb_shell::ShellState::ExecuteSQL (this=<optimized out>,
    zSql=0x40e20830 "PIVOT v00 AS ta66500 FULL JOIN v00 AS ta01 USING ( c01 ) ON c01;", pzErrMsg=<optimized out>) at ../../tools/shell/shell.cpp:1762
#22 0x0000000000485b74 in duckdb_shell::ShellState::RunOneSqlLine (this=0xffffe5e74f08,
    zSql=0x40e20830 "PIVOT v00 AS ta66500 FULL JOIN v00 AS ta01 USING ( c01 ) ON c01;") at ../../tools/shell/shell.cpp:4353
#23 0x0000000000480480 in duckdb_shell::ShellState::ProcessInput (this=<optimized out>) at ../../tools/shell/shell.cpp:4468
#24 0x0000000000489dac in main (argc=1, argv=0xffffe5e75258) at ../../tools/shell/shell.cpp:5076
```

### To Reproduce

1. Clone the DuckDB Git from the official repo.
2. Checkout to the latest main (1db3def66e).
3. Compile the DuckDB binary by using `make relassert`.
4. Run the compiled DuckDB and input the following SQL:

```sql
CREATE TABLE v00 (c01 INT);
PIVOT v00 AS ta01 FULL JOIN v00 AS ta02 USING ( c01 ) ON c01;
```

### OS:

Ubuntu 24.04 LTS

### DuckDB Version:

1.1.3 and latest main: 1db3def

### DuckDB Client:

cli

### Hardware:

_No response_

### Full Name:

Yu Liang

### Affiliation:

The Pennsylvania State University

### What is the latest build you tested with? If possible, we recommend testing with the latest nightly build.

I have tested with a stable release

### Did you include all relevant data sets for reproducing the issue?

Yes

### Did you include all code required to reproduce the issue?

- [X] Yes, I have

### Did you include all relevant configuration (e.g., CPU architecture, Python version, Linux distribution) to reproduce the issue?

- [X] Yes, I have
DuckDB Internal Error: Unexpected child of pivot source - not a ColumnRef
### What happens?

The latest version of the DuckDB (latest main: v1.1.4-dev3057 1db3def66e and released version: v1.1.3 19864453f7) triggers Internal Error when running the following SQL statement: 

```sql
CREATE TABLE v00 (c01 INT);
PIVOT v00 AS ta01 FULL JOIN v00 AS ta02 USING ( c01 ) ON c01;
```

Stacktrace from the latest main (1db3def66e):

```
#0  duckdb::InternalException::InternalException (this=0x41084b00, Python Exception <class 'gdb.error'> There is no member named _M_dataplus.:
msg=) at /home/duckdb/duckdb/src/common/exception.cpp:333
#1  0x00000000027ef8d4 in duckdb::ConstructInitialGrouping (ref=..., all_columns=..., handled_columns=std::unordered_set with 1 element = {...})
    at /home/duckdb/duckdb/src/planner/binder/tableref/bind_pivot.cpp:101
#2  0x00000000027a2f2c in duckdb::PivotFilteredAggregate (context=..., ref=..., all_columns=..., handled_columns=std::unordered_set with 1 element = {...},
    pivot_values=...) at /home/duckdb/duckdb/src/planner/binder/tableref/bind_pivot.cpp:126
#3  duckdb::Binder::BindPivot (this=0x41082930, ref=..., all_columns=...) at /home/duckdb/duckdb/src/planner/binder/tableref/bind_pivot.cpp:484
#4  0x00000000027beec0 in duckdb::Binder::Bind (this=<optimized out>, ref=...) at /home/duckdb/duckdb/src/planner/binder/tableref/bind_pivot.cpp:723
#5  0x00000000028f71c8 in duckdb::Binder::Bind (this=0x41082930, ref=...) at /home/duckdb/duckdb/src/planner/binder.cpp:416
#6  0x0000000004b14db0 in duckdb::Binder::BindNode (this=0x41082930, statement=...)
    at /home/duckdb/duckdb/src/planner/binder/query_node/bind_select_node.cpp:372
#7  0x00000000028f4d0c in duckdb::Binder::BindNode (this=0x41082930, node=...) at /home/duckdb/duckdb/src/planner/binder.cpp:328
#8  0x00000000028f5698 in duckdb::Binder::Bind (this=0x41082930, node=...) at /home/duckdb/duckdb/src/planner/binder.cpp:365
#9  0x00000000028eff68 in duckdb::Binder::Bind (this=0x41082930, statement=...) at /home/duckdb/duckdb/src/planner/binder.cpp:150
#10 0x00000000029203c0 in duckdb::Planner::CreatePlan (this=0xffffe5e73c50, statement=...) at /home/duckdb/duckdb/src/planner/planner.cpp:43
#11 0x0000000001890fc8 in duckdb::ClientContext::CreatePreparedStatementInternal (this=<optimized out>, lock=..., Python Exception <class 'gdb.error'> There is no member named _M_dataplus.:
query=, statement=..., values=...)
    at /home/duckdb/duckdb/src/main/client_context.cpp:340
#12 0x0000000001895214 in duckdb::ClientContext::CreatePreparedStatement (this=<optimized out>, lock=..., Python Exception <class 'gdb.error'> There is no member named _M_dataplus.:
query=, statement=..., values=...,
    mode=duckdb::PreparedStatementMode::PREPARE_AND_EXECUTE) at /home/duckdb/duckdb/src/main/client_context.cpp:426
#13 0x00000000018ab804 in duckdb::ClientContext::PendingStatementInternal (this=0x40ee7710, lock=..., Python Exception <class 'gdb.error'> There is no member named _M_dataplus.:
query=, statement=..., parameters=...)
    at /home/duckdb/duckdb/src/main/client_context.cpp:745
#14 0x00000000018b50d0 in duckdb::ClientContext::PendingStatementOrPreparedStatement (this=<optimized out>, lock=..., Python Exception <class 'gdb.error'> There is no member named _M_dataplus.:
query=, statement=..., prepared=...,
    parameters=...) at /home/duckdb/duckdb/src/main/client_context.cpp:863
#15 0x00000000018a93d4 in duckdb::ClientContext::PendingStatementOrPreparedStatementInternal (this=0x40ee7710, lock=..., Python Exception <class 'gdb.error'> There is no member named _M_dataplus.:
query=, statement=...,
    prepared=..., parameters=...) at /home/duckdb/duckdb/src/main/client_context.cpp:837
#16 0x00000000018adc34 in duckdb::ClientContext::PendingQueryInternal (this=0x40ee7710, lock=..., statement=..., parameters=..., verify=<optimized out>)
    at /home/duckdb/duckdb/src/main/client_context.cpp:1054
#17 0x00000000018be110 in duckdb::ClientContext::PendingQuery (this=0x40ee7710, statement=..., values=std::unordered_map with 0 elements,
    allow_stream_result=<optimized out>) at /home/duckdb/duckdb/src/main/client_context.cpp:1041
#18 0x00000000018b7dfc in duckdb::ClientContext::PendingQuery (this=0x2ad8, statement=..., allow_stream_result=false)
    at /home/duckdb/duckdb/src/main/client_context.cpp:1001
#19 0x00000000018ec7d4 in duckdb::Connection::PendingQuery (this=<optimized out>, statement=..., allow_stream_result=false)
    at /home/duckdb/duckdb/src/main/connection.cpp:140
#20 0x00000000004b40f0 in duckdb_shell_sqlite3_prepare_v2 (db=0x40e45b90, zSql=<optimized out>, nByte=<optimized out>, ppStmt=<optimized out>,
    pzTail=<optimized out>) at ../../tools/sqlite3_api_wrapper/sqlite3_api_wrapper.cpp:224
#21 0x000000000046f9dc in duckdb_shell::ShellState::ExecuteSQL (this=<optimized out>,
    zSql=0x40e20830 "PIVOT v00 AS ta66500 FULL JOIN v00 AS ta01 USING ( c01 ) ON c01;", pzErrMsg=<optimized out>) at ../../tools/shell/shell.cpp:1762
#22 0x0000000000485b74 in duckdb_shell::ShellState::RunOneSqlLine (this=0xffffe5e74f08,
    zSql=0x40e20830 "PIVOT v00 AS ta66500 FULL JOIN v00 AS ta01 USING ( c01 ) ON c01;") at ../../tools/shell/shell.cpp:4353
#23 0x0000000000480480 in duckdb_shell::ShellState::ProcessInput (this=<optimized out>) at ../../tools/shell/shell.cpp:4468
#24 0x0000000000489dac in main (argc=1, argv=0xffffe5e75258) at ../../tools/shell/shell.cpp:5076
```

### To Reproduce

1. Clone the DuckDB Git from the official repo.
2. Checkout to the latest main (1db3def66e).
3. Compile the DuckDB binary by using `make relassert`.
4. Run the compiled DuckDB and input the following SQL:

```sql
CREATE TABLE v00 (c01 INT);
PIVOT v00 AS ta01 FULL JOIN v00 AS ta02 USING ( c01 ) ON c01;
```

### OS:

Ubuntu 24.04 LTS

### DuckDB Version:

1.1.3 and latest main: 1db3def

### DuckDB Client:

cli

### Hardware:

_No response_

### Full Name:

Yu Liang

### Affiliation:

The Pennsylvania State University

### What is the latest build you tested with? If possible, we recommend testing with the latest nightly build.

I have tested with a stable release

### Did you include all relevant data sets for reproducing the issue?

Yes

### Did you include all code required to reproduce the issue?

- [X] Yes, I have

### Did you include all relevant configuration (e.g., CPU architecture, Python version, Linux distribution) to reproduce the issue?

- [X] Yes, I have


Discussion / hints:

Fix patch:
diff --git a/src/execution/expression_executor/execute_cast.cpp b/src/execution/expression_executor/execute_cast.cpp
index c0cca5889084..eb3a93fc4bce 100644
--- a/src/execution/expression_executor/execute_cast.cpp
+++ b/src/execution/expression_executor/execute_cast.cpp
@@ -12,7 +12,8 @@ unique_ptr<ExpressionState> ExpressionExecutor::InitializeState(const BoundCastE
 	result->Finalize();
 
 	if (expr.bound_cast.init_local_state) {
-		CastLocalStateParameters parameters(root.executor->GetContext(), expr.bound_cast.cast_data);
+		auto context_ptr = root.executor->HasContext() ? &root.executor->GetContext() : nullptr;
+		CastLocalStateParameters parameters(context_ptr, expr.bound_cast.cast_data);
 		result->local_state = expr.bound_cast.init_local_state(parameters);
 	}
 	return std::move(result);
diff --git a/src/include/duckdb/planner/binder.hpp b/src/include/duckdb/planner/binder.hpp
index 7da3b6c5d87f..0cd7c0e6a803 100644
--- a/src/include/duckdb/planner/binder.hpp
+++ b/src/include/duckdb/planner/binder.hpp
@@ -213,6 +213,8 @@ class Binder : public enable_shared_from_this<Binder> {
 	CatalogEntryRetriever &EntryRetriever() {
 		return entry_retriever;
 	}
+	//! Returns a ColumnRefExpression after it was resolved (i.e. past the STAR expression/USING clauses)
+	static optional_ptr<ParsedExpression> GetResolvedColumnExpression(ParsedExpression &root_expr);
 
 	void SetCanContainNulls(bool can_contain_nulls);
 	void SetAlwaysRequireRebind();
diff --git a/src/planner/bind_context.cpp b/src/planner/bind_context.cpp
index 5b4c3a10907c..bb7786f9360c 100644
--- a/src/planner/bind_context.cpp
+++ b/src/planner/bind_context.cpp
@@ -718,6 +718,25 @@ vector<BindingAlias> BindContext::GetBindingAliases() {
 
 void BindContext::RemoveContext(const vector<BindingAlias> &aliases) {
 	for (auto &alias : aliases) {
+		// remove the binding from any USING columns
+		for (auto &using_sets : using_columns) {
+			for (auto &using_set_ref : using_sets.second) {
+				auto &using_set = using_set_ref.get();
+				auto it = std::remove_if(using_set.bindings.begin(), using_set.bindings.end(),
+				                         [&](const BindingAlias &using_alias) { return using_alias == alias; });
+				using_set.bindings.erase(it, using_set.bindings.end());
+				if (using_set.bindings.empty()) {
+					throw InternalException(
+					    "BindContext::RemoveContext - no more tables that refer to this using binding");
+				}
+				if (using_set.primary_binding == alias) {
+					throw InternalException(
+					    "BindContext::RemoveContext - cannot remove primary binding from using binding");
+				}
+			}
+		}
+
+		// remove the binding from the list of bindings
 		auto it = std::remove_if(bindings_list.begin(), bindings_list.end(),
 		                         [&](unique_ptr<Binding> &x) { return x->alias == alias; });
 		bindings_list.erase(it, bindings_list.end());
diff --git a/src/planner/binder/expression/bind_star_expression.cpp b/src/planner/binder/expression/bind_star_expression.cpp
index ddf7dd5baae6..2a15d0c8d4ad 100644
--- a/src/planner/binder/expression/bind_star_expression.cpp
+++ b/src/planner/binder/expression/bind_star_expression.cpp
@@ -185,6 +185,22 @@ void TryTransformStarLike(unique_ptr<ParsedExpression> &root) {
 	root = std::move(columns_expr);
 }
 
+optional_ptr<ParsedExpression> Binder::GetResolvedColumnExpression(ParsedExpression &root_expr) {
+	optional_ptr<ParsedExpression> expr = &root_expr;
+	while (expr) {
+		if (expr->type == ExpressionType::COLUMN_REF) {
+			break;
+		}
+		if (expr->type == ExpressionType::OPERATOR_COALESCE) {
+			expr = expr->Cast<OperatorExpression>().children[0].get();
+		} else {
+			// unknown expression
+			return nullptr;
+		}
+	}
+	return expr;
+}
+
 void Binder::ExpandStarExpression(unique_ptr<ParsedExpression> expr,
                                   vector<unique_ptr<ParsedExpression>> &new_select_list) {
 	TryTransformStarLike(expr);
@@ -232,7 +248,11 @@ void Binder::ExpandStarExpression(unique_ptr<ParsedExpression> expr,
 			}
 			vector<unique_ptr<ParsedExpression>> new_list;
 			for (idx_t i = 0; i < star_list.size(); i++) {
-				auto &colref = star_list[i]->Cast<ColumnRefExpression>();
+				auto child_expr = GetResolvedColumnExpression(*star_list[i]);
+				if (!child_expr) {
+					continue;
+				}
+				auto &colref = child_expr->Cast<ColumnRefExpression>();
 				if (!RE2::PartialMatch(colref.GetColumnName(), *regex)) {
 					continue;
 				}
@@ -297,18 +317,7 @@ void Binder::ExpandStarExpression(unique_ptr<ParsedExpression> expr,
 		auto new_expr = expr->Copy();
 		ReplaceStarExpression(new_expr, star_list[i]);
 		if (StarExpression::IsColumns(*star)) {
-			optional_ptr<ParsedExpression> expr = star_list[i].get();
-			while (expr) {
-				if (expr->type == ExpressionType::COLUMN_REF) {
-					break;
-				}
-				if (expr->type == ExpressionType::OPERATOR_COALESCE) {
-					expr = expr->Cast<OperatorExpression>().children[0].get();
-				} else {
-					// unknown expression
-					expr = nullptr;
-				}
-			}
+			auto expr = GetResolvedColumnExpression(*star_list[i]);
 			if (expr) {
 				auto &colref = expr->Cast<ColumnRefExpression>();
 				if (new_expr->alias.empty()) {
diff --git a/src/planner/binder/query_node/bind_select_node.cpp b/src/planner/binder/query_node/bind_select_node.cpp
index ea16c02045ac..590da7ae4ba9 100644
--- a/src/planner/binder/query_node/bind_select_node.cpp
+++ b/src/planner/binder/query_node/bind_select_node.cpp
@@ -310,7 +310,6 @@ void Binder::BindModifiers(BoundQueryNode &result, idx_t table_index, const vect
 		switch (bound_mod->type) {
 		case ResultModifierType::DISTINCT_MODIFIER: {
 			auto &distinct = bound_mod->Cast<BoundDistinctModifier>();
-			D_ASSERT(!distinct.target_distincts.empty());
 			// set types of distinct targets
 			for (auto &expr : distinct.target_distincts) {
 				expr = FinalizeBindOrderExpression(std::move(expr), table_index, names, sql_types, bind_state);
diff --git a/src/planner/binder/query_node/plan_query_node.cpp b/src/planner/binder/query_node/plan_query_node.cpp
index 97678d2271e0..c448f2f111a9 100644
--- a/src/planner/binder/query_node/plan_query_node.cpp
+++ b/src/planner/binder/query_node/plan_query_node.cpp
@@ -13,6 +13,9 @@ unique_ptr<LogicalOperator> Binder::VisitQueryNode(BoundQueryNode &node, unique_
 		switch (mod->type) {
 		case ResultModifierType::DISTINCT_MODIFIER: {
 			auto &bound = mod->Cast<BoundDistinctModifier>();
+			if (bound.target_distincts.empty()) {
+				break;
+			}
 			auto distinct = make_uniq<LogicalDistinct>(std::move(bound.target_distincts), bound.distinct_type);
 			distinct->AddChild(std::move(root));
 			root = std::move(distinct);
diff --git a/src/planner/binder/statement/bind_insert.cpp b/src/planner/binder/statement/bind_insert.cpp
index 509b3d2a26c0..5e3903049414 100644
--- a/src/planner/binder/statement/bind_insert.cpp
+++ b/src/planner/binder/statement/bind_insert.cpp
@@ -148,7 +148,6 @@ void ReplaceColumnBindings(Expression &expr, idx_t source, idx_t dest) {
 void Binder::BindDoUpdateSetExpressions(const string &table_alias, LogicalInsert &insert, UpdateSetInfo &set_info,
                                         TableCatalogEntry &table, TableStorageInfo &storage_info) {
 	D_ASSERT(insert.children.size() == 1);
-	D_ASSERT(insert.children[0]->type == LogicalOperatorType::LOGICAL_PROJECTION);
 
 	vector<column_t> logical_column_ids;
 	vector<string> column_names;
@@ -495,6 +494,9 @@ BoundStatement Binder::Bind(InsertStatement &stmt) {
 		if (values_list) {
 			throw BinderException("INSERT BY NAME can only be used when inserting from a SELECT statement");
 		}
+		if (stmt.default_values) {
+			throw BinderException("INSERT BY NAME cannot be combined with with DEFAULT VALUES");
+		}
 		if (!stmt.columns.empty()) {
 			throw BinderException("INSERT BY NAME cannot be combined with an explicit column list");
 		}
diff --git a/src/planner/binder/tableref/bind_pivot.cpp b/src/planner/binder/tableref/bind_pivot.cpp
index e673c6011bbd..a1b9789adf26 100644
--- a/src/planner/binder/tableref/bind_pivot.cpp
+++ b/src/planner/binder/tableref/bind_pivot.cpp
@@ -97,10 +97,11 @@ static unique_ptr<SelectNode> ConstructInitialGrouping(PivotRef &ref, vector<uni
 	if (ref.groups.empty()) {
 		// if rows are not specified any columns that are not pivoted/aggregated on are added to the GROUP BY clause
 		for (auto &entry : all_columns) {
-			if (entry->type != ExpressionType::COLUMN_REF) {
+			auto column_entry = Binder::GetResolvedColumnExpression(*entry);
+			if (!column_entry) {
 				throw InternalException("Unexpected child of pivot source - not a ColumnRef");
 			}
-			auto &columnref = entry->Cast<ColumnRefExpression>();
+			auto &columnref = column_entry->Cast<ColumnRefExpression>();
 			if (handled_columns.find(columnref.GetColumnName()) == handled_columns.end()) {
 				// not handled - add to grouping set
 				subquery->groups.group_expressions.push_back(make_uniq<ConstantExpression>(
diff --git a/src/planner/subquery/flatten_dependent_join.cpp b/src/planner/subquery/flatten_dependent_join.cpp
index bbd98b2cf71a..d6070a6e93e4 100644
--- a/src/planner/subquery/flatten_dependent_join.cpp
+++ b/src/planner/subquery/flatten_dependent_join.cpp
@@ -750,6 +750,8 @@ unique_ptr<LogicalOperator> FlattenDependentJoins::PushDownDependentJoinInternal
 	}
 	case LogicalOperatorType::LOGICAL_SAMPLE:
 		throw BinderException("Sampling in correlated subqueries is not (yet) supported");
+	case LogicalOperatorType::LOGICAL_POSITIONAL_JOIN:
+		throw BinderException("Positional join in correlated subqueries is not (yet) supported");
 	default:
 		throw InternalException("Logical operator type \"%s\" for dependent join", LogicalOperatorToString(plan->type));
 	}


Test patch:
diff --git a/test/fuzzer/public/cast_index_expression.test b/test/fuzzer/public/cast_index_expression.test
new file mode 100644
index 000000000000..f707d71bf1a1
--- /dev/null
+++ b/test/fuzzer/public/cast_index_expression.test
@@ -0,0 +1,14 @@
+# name: test/fuzzer/public/cast_index_expression.test
+# description: Test CREATE INDEX using an index expression that triggers a cast
+# group: [public]
+
+statement ok
+pragma enable_verification
+
+statement ok
+CREATE TABLE v00 (c01 INT, c02 STRING);
+
+statement error
+CREATE INDEX i_index ON v00 USING ART ( NULLIF ( v00, 'string' ) );
+----
+Invalid type for index key
diff --git a/test/fuzzer/public/columns_using.test b/test/fuzzer/public/columns_using.test
new file mode 100644
index 000000000000..7cb4bbb570a0
--- /dev/null
+++ b/test/fuzzer/public/columns_using.test
@@ -0,0 +1,20 @@
+# name: test/fuzzer/public/columns_using.test
+# description: Test COLUMNS regex in combination with the USING clause for a FULL join
+# group: [public]
+
+statement ok
+pragma enable_verification
+
+statement ok
+CREATE TABLE v00 (c01 INT);
+
+statement error
+SELECT COLUMNS('v00')
+FROM v00 AS t1 FULL JOIN v00 AS t2 USING (c01) ;
+----
+No matching columns found
+
+query I
+SELECT COLUMNS('c01')
+FROM v00 AS t1 FULL JOIN v00 AS t2 USING (c01) ;
+----
diff --git a/test/fuzzer/public/distinct_on_non_integer_literal.test b/test/fuzzer/public/distinct_on_non_integer_literal.test
new file mode 100644
index 000000000000..2d82b0305452
--- /dev/null
+++ b/test/fuzzer/public/distinct_on_non_integer_literal.test
@@ -0,0 +1,14 @@
+# name: test/fuzzer/public/distinct_on_non_integer_literal.test
+# description: Test DISTINCT ON non-integer literal
+# group: [public]
+
+statement ok
+pragma enable_verification
+
+statement ok
+SET order_by_non_integer_literal=true;
+
+query I
+SELECT DISTINCT ON ('string') 'x' AS c02;
+----
+x
diff --git a/test/fuzzer/public/insert_by_name_default.test b/test/fuzzer/public/insert_by_name_default.test
new file mode 100644
index 000000000000..4c16987f45d9
--- /dev/null
+++ b/test/fuzzer/public/insert_by_name_default.test
@@ -0,0 +1,14 @@
+# name: test/fuzzer/public/insert_by_name_default.test
+# description: Insert by name + default values
+# group: [public]
+
+statement ok
+pragma enable_verification
+
+statement ok
+CREATE TABLE t0(i INT)
+
+statement error
+INSERT INTO t0 BY NAME DEFAULT VALUES;
+----
+INSERT BY NAME cannot be combined with with DEFAULT VALUES
diff --git a/test/fuzzer/public/insert_or_replace_default_values.test b/test/fuzzer/public/insert_or_replace_default_values.test
new file mode 100644
index 000000000000..0d0febe535b3
--- /dev/null
+++ b/test/fuzzer/public/insert_or_replace_default_values.test
@@ -0,0 +1,41 @@
+# name: test/fuzzer/public/insert_or_replace_default_values.test
+# description: Test INSERT OR REPLACE with DEFAULT VALUES
+# group: [public]
+
+statement ok
+pragma enable_verification
+
+statement ok
+CREATE SEQUENCE seq
+
+statement ok
+CREATE TABLE tbl(id INTEGER PRIMARY KEY DEFAULT 1, payload INTEGER DEFAULT nextval('seq'));
+
+statement ok
+INSERT OR REPLACE INTO tbl DEFAULT VALUES;
+
+query II
+FROM tbl
+----
+1	1
+
+statement ok
+INSERT OR REPLACE INTO tbl DEFAULT VALUES;
+
+query II
+FROM tbl
+----
+1	2
+
+statement ok
+INSERT OR IGNORE INTO tbl DEFAULT VALUES;
+
+query II
+FROM tbl
+----
+1	2
+
+statement error
+INSERT INTO tbl DEFAULT VALUES;
+----
+constraint
diff --git a/test/fuzzer/public/pivot_full_join_using.test b/test/fuzzer/public/pivot_full_join_using.test
new file mode 100644
index 000000000000..4c0764f4b500
--- /dev/null
+++ b/test/fuzzer/public/pivot_full_join_using.test
@@ -0,0 +1,16 @@
+# name: test/fuzzer/public/pivot_full_join_using.test
+# description: Test pivoting on a USING column that comes from a FULL JOIN
+# group: [public]
+
+statement ok
+pragma enable_verification
+
+statement ok
+CREATE TABLE t1 (c01 INT, c02 INT);
+
+statement ok
+CREATE TABLE t2 (c01 INT, c03 INT);
+
+query II
+PIVOT t1 FULL JOIN t2 USING ( c01 ) ON c01;
+----
diff --git a/test/fuzzer/public/positional_join_correlated_subquery.test b/test/fuzzer/public/positional_join_correlated_subquery.test
new file mode 100644
index 000000000000..82e93fe8aaa9
--- /dev/null
+++ b/test/fuzzer/public/positional_join_correlated_subquery.test
@@ -0,0 +1,15 @@
+# name: test/fuzzer/public/positional_join_correlated_subquery.test
+# description: Test positional join in correlated subqueries
+# group: [public]
+
+statement ok
+pragma enable_verification
+
+statement ok
+CREATE TABLE v00 (c01 INT, c02 STRING);
+
+statement error
+SELECT (SELECT 42 FROM (SELECT c01) POSITIONAL JOIN (SELECT c02))
+FROM v00;
+----
+not (yet) supported
diff --git a/test/fuzzer/public/semi_join_using.test b/test/fuzzer/public/semi_join_using.test
new file mode 100644
index 000000000000..2f91c6a7448d
--- /dev/null
+++ b/test/fuzzer/public/semi_join_using.test
@@ -0,0 +1,33 @@
+# name: test/fuzzer/public/semi_join_using.test
+# description: Test SEMI JOIN with USING clause
+# group: [public]
+
+statement ok
+pragma enable_verification
+
+statement ok
+CREATE TABLE v00 (c01 INT, c02 STRING);
+
+statement error
+SELECT c02
+FROM (
+	v00 AS t1
+	NATURAL JOIN
+	v00 AS t2 ),
+	( v00 AS ta04
+	SEMI JOIN v00 AS ta05
+	USING ( c02 ) ) ;
+----
+Ambiguous column reference
+
+
+query III
+SELECT t1.c02, t2.c02, ta04.c02
+FROM (
+	v00 AS t1
+	NATURAL JOIN
+	v00 AS t2 ),
+	( v00 AS ta04
+	SEMI JOIN v00 AS ta05
+	USING ( c02 ) ) ;
+----