[I] Server crashes (segfault) on `cypher(CREATE ...)` inside SQL `WHERE NOT EXISTS` with a nested `cypher(MATCH ...)` subquery [age]

["hkjiang26 (via GitHub)" <gi...@apache.org>]

hkjiang26 opened a new issue, #2501:
URL: https://github.com/apache/age/issues/2501

   **Bug description**
   
   Writing a Cypher `CREATE` in the outer query of a `SELECT ... WHERE NOT EXISTS (...)` statement, where the `NOT EXISTS` subquery contains another `cypher(MATCH ...)` call, crashes the PostgreSQL backend with a segmentation fault. The backend process is terminated (`signal 11: Segmentation fault`) and the connection is dropped. 
   
   **Access method**
   
   - Command line via `psql`, inside the official Docker container `apache/age:1.8.0`
   
   **Data setup**
   
   No data is required — the crash reproduces on an empty graph. Only the graph itself must exist:
   
   ```pgsql
   CREATE EXTENSION IF NOT EXISTS age;
   LOAD 'age';
   SET search_path = ag_catalog, "$user", public;
   SELECT create_graph('graph_test');
   ```
   
   **Configuration**
   
   - None beyond the stock AGE extension. No additional modules (no PostGIS, etc.), default `search_path` handling as shown above.
   
   **Command that triggers the crash**
   
   ```pgsql
   SELECT * FROM cypher('graph_test', $$ CREATE () $$) AS (a agtype)
   WHERE NOT EXISTS (SELECT * FROM cypher('graph_test', $$ MATCH () RETURN 1 $$) AS (b agtype));
   ```
   
   ```
   server closed the connection unexpectedly
   	This probably means the server terminated abnormally
   	before or while processing the request.
   The connection to the server was lost. Attempting reset: Failed.
   The connection to the server was lost. Attempting reset: Failed.
   Time: 2171.760 ms (00:02.172)
   ```
   
   The server log shows the backend being killed:
   
   ```
   LOG:  client backend (PID NNN) was terminated by signal 11: Segmentation fault
   LOG:  terminating any other active server processes
   LOG:  all server processes terminated; reinitializing
   ```
   
   **Expected behavior**
   
   The statement is a legal combination of two individually-valid Cypher queries glued together with SQL's `WHERE NOT EXISTS`. It should either execute normally (creating the node and returning a row) or raise a normal SQL error — it must not crash the backend process.
   
   **Environment**
   
   - Version: 1.8.0 (official `apache/age:1.8.0` Docker image)
   - PostgreSQL: 18.1 (Debian 18.1-1.pgdg13+2), x86_64
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@age.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Server crashes (segfault) on `cypher(CREATE ...)` inside SQL `WHERE NOT EXISTS` with a nested `cypher(MATCH ...)` subquery [age]

["gregfelice (via GitHub)" <gi...@apache.org>]

gregfelice commented on issue #2501:
URL: https://github.com/apache/age/issues/2501#issuecomment-5369732173

   Confirmed still crashing on current master (`4d9b2506`, AGE 1.8.0, PostgreSQL 18.4).
   
   Under gdb this stops at `create_vertex`, `src/backend/executor/cypher_create.c:526`, with the scan tuple slot NULL:
   
   ```
   (gdb) p scanTupleSlot   $1 = (TupleTableSlot *) 0x0
   ```
   
   
   
   That is the same failing dereference as #2501, #2508, #2527, #2530 and #2535 — five open issues with different-looking triggers that all reach one NULL pointer read. Root-cause analysis, the gdb evidence and the minimal five-line reproducer are written up in #2535; I would rather keep it in one place than repeat it here.
   
   Not closing this as a duplicate — that is a maintainer's call, and #2501 is the earliest of the group if consolidation is wanted. Flagging it so the same bug does not get fixed five times.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@age.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org