[I] Multi-row `CREATE` followed by full-path `MERGE` causes a PostgreSQL backend segmentation fault [age]

["YGY-001 (via GitHub)" <gi...@apache.org>]

YGY-001 opened a new issue, #2530:
URL: https://github.com/apache/age/issues/2530

   Docker image `apache/age:release_PG18_1.7.0`
   
   **Reproduction**
   
   ```sql
   LOAD 'age';
   SET search_path = ag_catalog, public;
   SELECT ag_catalog.create_graph('age_issue_case7');
   
   SELECT *
   FROM ag_catalog.cypher('age_issue_case7', $$
   UNWIND [1331056905,1685130911] AS alias0
   CREATE ({k0: true, k1: true, k3: false, k4: false, k5: 688047419, k11: 'Ad', k6: 'IZz', k10: -1671856916, k7: 't', k8: 644254522, k9: 'H2L3ye', id: 128, klist: [-693117962, 897437311, -1962790343]})
   WITH alias0 AS alias1, [item IN range(12, 7, -1) WHERE item IS NOT NULL | toString(item)] AS alias2
   WHERE ((('H0t' + 'KndeYYd') ENDS WITH 'ndeYYd') AND ((true AND true) AND true))
   CREATE (n0:l0 {k1: true, k2: false, k3: false, id: 129, k6: 'Y', k7: 'C', k8: 1382373095, k9: 'Q', klist: [131362279, -1851970601, -1506840787, 2047568719]})
          <-[r0:rt1 {k0: false, k1: false, k2: false, k3: true, k5: 1497504556, k11: 'ZCsD', id: 4, k10: 1255153251, k7: 'Y', k8: -900442765, k9: 'E', klist: []}]-
          ({k0: false, k2: false, k3: false, k4: false, k11: 'J', id: 130, k6: 'p', k10: -759664277, k7: 'V', k8: 129867760, k9: 'UsV8'})
   WITH *
   MERGE p0 = (n0) <-[r1:rt1 {k0: false, k1: true, k2: true, k3: false, k4: false, k5: 81415748, k11: 'B', k6: 'aYhBB0', k10: 1575911880, k7: 'F', k8: -2118834534, k9: 'yYD8Slu', id: 5, klist: [999780219]}]-
              ({k1: false, k2: false, k3: true, k4: false, k5: 1399012233, id: 131, k6: 'Q1wsEm', k10: 47426956, k8: -125428397, k9: 'r', klist: [-508132260, 1582656878]})
          -[:rt8 {k0: true, k1: false, k2: true, k3: true, k4: false, k5: 586226905, k11: 'b', k6: 'z', k10: -760765339, k7: 'z', k8: 96686575, k9: 'x', id: 6, klist: [-1109084786]}]->
          ({k0: false, k1: true, k3: false, k4: false, k11: 'dTdqpT', id: 132, k10: -1589249357, k8: 390800412, klist: [172296092, 878100138, -1047680138]})
   WITH alias2, r0.k9 AS alias3, round(toFloat(r0.k10)) AS alias4, n0 AS alias5, r0 AS alias6, r1 AS alias7, p0 AS alias8
   WITH alias3 AS alias9, alias4, alias2 AS alias10, alias6.k11 AS alias11, alias5.k3 AS alias12, last(tail(nodes(alias8))) AS alias13, alias5 AS alias14, alias6 AS alias15, alias8
   WITH *
   CREATE (:l8 {k0: true, k1: false, k2: true, k3: true, k4: true, k5: -775427475, id: 133, k6: 'EkvHmp42', k10: -2013887244, k9: 'I', klist: [1515249301]})
   RETURN alias14, alias15, alias8, alias11, alias13, alias4, alias12, atan(toFloat(alias14.id)) AS alias16, asin(toFloat(length(alias8))) AS alias17
   ORDER BY alias11 DESC, alias4 DESC, alias12 ASC, alias16 ASC, alias17 ASC
   LIMIT 15
   $$) AS (c1 agtype, c2 agtype, c3 agtype, c4 agtype, c5 agtype,
           c6 agtype, c7 agtype, c8 agtype, c9 agtype);
   ```
   
   **Expected**
   
   The valid query completes and leaves PostgreSQL available.
   
   **Actual**
   
   ```text
   server closed the connection unexpectedly
   client backend ... was terminated by signal 11: Segmentation fault


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@age.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Multi-row `CREATE` followed by full-path `MERGE` causes a PostgreSQL backend segmentation fault [age]

["gregfelice (via GitHub)" <gi...@apache.org>]

gregfelice commented on issue #2530:
URL: https://github.com/apache/age/issues/2530#issuecomment-5369732468

   Confirmed still crashing on current master (`4d9b2506`, AGE 1.8.0, PostgreSQL 18.4).
   
   Under gdb this stops at `create_vertex`, `src/backend/executor/cypher_create.c:526`, with the scan tuple slot NULL:
   
   ```
   (gdb) p scanTupleSlot   $1 = (TupleTableSlot *) 0x0
   ```
   
   Here the CREATE is reached through `exec_cypher_merge` (cypher_merge.c:695) rather than directly, and `node->prop_attr_num` is 2 rather than 1, but the failing dereference is the same one.
   
   That is the same failing dereference as #2501, #2508, #2527, #2530 and #2535 — five open issues with different-looking triggers that all reach one NULL pointer read. Root-cause analysis, the gdb evidence and the minimal five-line reproducer are written up in #2535; I would rather keep it in one place than repeat it here.
   
   Not closing this as a duplicate — that is a maintainer's call, and #2501 is the earliest of the group if consolidation is wanted. Flagging it so the same bug does not get fixed five times.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@age.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org