Repository: duckdb/duckdb (language: python)

Issue:
DuckDB Internal Error: Attempting to initialize state of expression of unknown type
### What happens?

The latest version of the DuckDB (latest main: v1.1.4-dev3139 07780a0d22 and released version v1.1.3 19864453f7
) triggers Internal Error when running the following SQL statement: 

```sql
CREATE TABLE v00 (c01 INT, c02 STRING);
PIVOT ( v00 AS ta03 INNER JOIN ( SELECT c02 ) ON 'any_string' IN ARRAY ( SELECT 'abc' ) ) ta04 USING c02;
```

Here is the stack trace from v1.1.4-dev3139 07780a0d22: 

```
#0  duckdb::InternalException::InternalException (this=0x60d0000170d0, Python Exception <class 'gdb.error'> There is no member named _M_dataplus.: 
msg=) at /home/duckdb/duckdb/src/common/exception.cpp:333
#1  0x0000000002e4be16 in duckdb::ExpressionExecutor::InitializeState (expr=..., state=...) at /home/duckdb/duckdb/src/execution/expression_executor.cpp:166
#2  0x0000000002e4a032 in duckdb::ExpressionExecutor::Initialize (this=0xefae18ffa44, expression=..., state=...)
    at /home/duckdb/duckdb/src/execution/expression_executor.cpp:67
#3  0x0000000002e471b2 in duckdb::ExpressionExecutor::AddExpression (this=<optimized out>, expr=...)
    at /home/duckdb/duckdb/src/execution/expression_executor.cpp:60
#4  0x0000000002e4775f in duckdb::ExpressionExecutor::ExpressionExecutor (this=0x60b000075cc8, context=..., expression=...)
    at /home/duckdb/duckdb/src/execution/expression_executor.cpp:21
#5  0x0000000009ee961a in duckdb::FilterState::FilterState (this=0x60b000075cb0, context=..., expr=...)
    at /home/duckdb/duckdb/src/execution/operator/filter/physical_filter.cpp:26
#6  0x0000000009ee65ce in duckdb::make_uniq<duckdb::FilterState, duckdb::ExecutionContext&, duckdb::Expression&> (args=..., args=...)
    at ../../src/include/duckdb/common/helper.hpp:65
#7  0x0000000009ee49b9 in duckdb::PhysicalFilter::GetOperatorState (this=<optimized out>, context=...)
    at /home/duckdb/duckdb/src/execution/operator/filter/physical_filter.cpp:39
#8  0x0000000003aa3520 in duckdb::PipelineExecutor::PipelineExecutor (this=<optimized out>, context_p=..., pipeline_p=...)
    at /home/duckdb/duckdb/src/parallel/pipeline_executor.cpp:40
#9  0x0000000003ae077e in duckdb::make_uniq<duckdb::PipelineExecutor, duckdb::ClientContext&, duckdb::Pipeline&> (args=..., args=...)
    at ../../src/include/duckdb/common/helper.hpp:65
#10 0x0000000003a8ba9c in duckdb::PipelineTask::ExecuteTask (this=0x607000087550, mode=<optimized out>) at /home/duckdb/duckdb/src/parallel/pipeline.cpp:34
#11 0x0000000003a5acec in duckdb::ExecutorTask::Execute (this=0x607000087550, mode=<optimized out>) at /home/duckdb/duckdb/src/parallel/executor_task.cpp:49
#12 0x0000000003ac2c3f in duckdb::TaskScheduler::ExecuteForever (this=<optimized out>, marker=<optimized out>)
    at /home/duckdb/duckdb/src/parallel/task_scheduler.cpp:189
#13 0x000077d7121c9df4 in ?? () from /lib/x86_64-linux-gnu/libstdc++.so.6
#14 0x000077d7122dd609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#15 0x000077d711eaa353 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
```

### To Reproduce

1. Clone the DuckDB Git from the official repo.
2. Checkout to the latest main (07780a0d22).
3. Compile the DuckDB binary by using `make relassert`.
4. Run the compiled DuckDB and input the following SQL:

```sql
CREATE TABLE v00 (c01 INT, c02 STRING);
PIVOT ( v00 AS ta03 INNER JOIN ( SELECT c02 ) ON 'any_string' IN ARRAY ( SELECT 'abc' ) ) ta04 USING c02;
```

### OS:

Ubuntu 24.04 LTS

### DuckDB Version:

latest main: v1.1.4-dev3139 07780a0d22 and released version v1.1.3 19864453f7

### DuckDB Client:

cli

### Hardware:

_No response_

### Full Name:

Yu Liang

### Affiliation:

The Pennsylvania State University

### What is the latest build you tested with? If possible, we recommend testing with the latest nightly build.

I have tested with a stable release

### Did you include all relevant data sets for reproducing the issue?

Yes

### Did you include all code required to reproduce the issue?

- [X] Yes, I have

### Did you include all relevant configuration (e.g., CPU architecture, Python version, Linux distribution) to reproduce the issue?

- [X] Yes, I have
DuckDB Internal Error: Attempting to initialize state of expression of unknown type
### What happens?

The latest version of the DuckDB (latest main: v1.1.4-dev3139 07780a0d22 and released version v1.1.3 19864453f7
) triggers Internal Error when running the following SQL statement: 

```sql
CREATE TABLE v00 (c01 INT, c02 STRING);
PIVOT ( v00 AS ta03 INNER JOIN ( SELECT c02 ) ON 'any_string' IN ARRAY ( SELECT 'abc' ) ) ta04 USING c02;
```

Here is the stack trace from v1.1.4-dev3139 07780a0d22: 

```
#0  duckdb::InternalException::InternalException (this=0x60d0000170d0, Python Exception <class 'gdb.error'> There is no member named _M_dataplus.: 
msg=) at /home/duckdb/duckdb/src/common/exception.cpp:333
#1  0x0000000002e4be16 in duckdb::ExpressionExecutor::InitializeState (expr=..., state=...) at /home/duckdb/duckdb/src/execution/expression_executor.cpp:166
#2  0x0000000002e4a032 in duckdb::ExpressionExecutor::Initialize (this=0xefae18ffa44, expression=..., state=...)
    at /home/duckdb/duckdb/src/execution/expression_executor.cpp:67
#3  0x0000000002e471b2 in duckdb::ExpressionExecutor::AddExpression (this=<optimized out>, expr=...)
    at /home/duckdb/duckdb/src/execution/expression_executor.cpp:60
#4  0x0000000002e4775f in duckdb::ExpressionExecutor::ExpressionExecutor (this=0x60b000075cc8, context=..., expression=...)
    at /home/duckdb/duckdb/src/execution/expression_executor.cpp:21
#5  0x0000000009ee961a in duckdb::FilterState::FilterState (this=0x60b000075cb0, context=..., expr=...)
    at /home/duckdb/duckdb/src/execution/operator/filter/physical_filter.cpp:26
#6  0x0000000009ee65ce in duckdb::make_uniq<duckdb::FilterState, duckdb::ExecutionContext&, duckdb::Expression&> (args=..., args=...)
    at ../../src/include/duckdb/common/helper.hpp:65
#7  0x0000000009ee49b9 in duckdb::PhysicalFilter::GetOperatorState (this=<optimized out>, context=...)
    at /home/duckdb/duckdb/src/execution/operator/filter/physical_filter.cpp:39
#8  0x0000000003aa3520 in duckdb::PipelineExecutor::PipelineExecutor (this=<optimized out>, context_p=..., pipeline_p=...)
    at /home/duckdb/duckdb/src/parallel/pipeline_executor.cpp:40
#9  0x0000000003ae077e in duckdb::make_uniq<duckdb::PipelineExecutor, duckdb::ClientContext&, duckdb::Pipeline&> (args=..., args=...)
    at ../../src/include/duckdb/common/helper.hpp:65
#10 0x0000000003a8ba9c in duckdb::PipelineTask::ExecuteTask (this=0x607000087550, mode=<optimized out>) at /home/duckdb/duckdb/src/parallel/pipeline.cpp:34
#11 0x0000000003a5acec in duckdb::ExecutorTask::Execute (this=0x607000087550, mode=<optimized out>) at /home/duckdb/duckdb/src/parallel/executor_task.cpp:49
#12 0x0000000003ac2c3f in duckdb::TaskScheduler::ExecuteForever (this=<optimized out>, marker=<optimized out>)
    at /home/duckdb/duckdb/src/parallel/task_scheduler.cpp:189
#13 0x000077d7121c9df4 in ?? () from /lib/x86_64-linux-gnu/libstdc++.so.6
#14 0x000077d7122dd609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#15 0x000077d711eaa353 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
```

### To Reproduce

1. Clone the DuckDB Git from the official repo.
2. Checkout to the latest main (07780a0d22).
3. Compile the DuckDB binary by using `make relassert`.
4. Run the compiled DuckDB and input the following SQL:

```sql
CREATE TABLE v00 (c01 INT, c02 STRING);
PIVOT ( v00 AS ta03 INNER JOIN ( SELECT c02 ) ON 'any_string' IN ARRAY ( SELECT 'abc' ) ) ta04 USING c02;
```

### OS:

Ubuntu 24.04 LTS

### DuckDB Version:

latest main: v1.1.4-dev3139 07780a0d22 and released version v1.1.3 19864453f7

### DuckDB Client:

cli

### Hardware:

_No response_

### Full Name:

Yu Liang

### Affiliation:

The Pennsylvania State University

### What is the latest build you tested with? If possible, we recommend testing with the latest nightly build.

I have tested with a stable release

### Did you include all relevant data sets for reproducing the issue?

Yes

### Did you include all code required to reproduce the issue?

- [X] Yes, I have

### Did you include all relevant configuration (e.g., CPU architecture, Python version, Linux distribution) to reproduce the issue?

- [X] Yes, I have


Discussion / hints:

Fix patch:
diff --git a/src/planner/binder/query_node/plan_subquery.cpp b/src/planner/binder/query_node/plan_subquery.cpp
index 4b5857f573e7..6e3f551be4cd 100644
--- a/src/planner/binder/query_node/plan_subquery.cpp
+++ b/src/planner/binder/query_node/plan_subquery.cpp
@@ -457,6 +457,9 @@ unique_ptr<LogicalOperator> Binder::PlanLateralJoin(unique_ptr<LogicalOperator>
 	vector<JoinCondition> conditions;
 	vector<unique_ptr<Expression>> arbitrary_expressions;
 	if (condition) {
+		if (condition->HasSubquery()) {
+			throw BinderException(*condition, "Subqueries are not supported in LATERAL join conditions");
+		}
 		// extract join conditions, if there are any
 		LogicalComparisonJoin::ExtractJoinConditions(context, join_type, JoinRefType::REGULAR, left, right,
 		                                             std::move(condition), conditions, arbitrary_expressions);


Test patch:
diff --git a/test/fuzzer/public/lateral_join_subquery.test b/test/fuzzer/public/lateral_join_subquery.test
new file mode 100644
index 000000000000..30a2ce2f3acc
--- /dev/null
+++ b/test/fuzzer/public/lateral_join_subquery.test
@@ -0,0 +1,14 @@
+# name: test/fuzzer/public/lateral_join_subquery.test
+# description: Subqueries in the join condition of lateral joins
+# group: [public]
+
+statement ok
+pragma enable_verification
+
+statement ok
+CREATE TABLE t1 (c1 INT);
+
+statement error
+FROM t1 INNER JOIN (SELECT t1.c1) ON (SELECT 42);
+----
+Subqueries are not supported in LATERAL join conditions