CREATE` followed by a bound-node path read causes a PostgreSQL backend segmentation fault

[YGY-001]

Docker image apache/age:release_PG18_1.7.0

Reproduction

LOAD 'age';
SET search_path = ag_catalog, public;
SELECT ag_catalog.create_graph('age_issue_case4');

SELECT *
FROM ag_catalog.cypher('age_issue_case4', $$
CREATE p0 = (n0:l0 {id: 18, klist: [-1797530023, 38833916]})
WITH n0.klist AS alias0, last(n0.klist) AS alias1,
     head(tail(keys(n0))) AS alias2, n0
WHERE ((((true AND false) OR ('61ov8bSZ' CONTAINS 'v8b'))
         OR (toFloat(n0.id) > id(n0)))
       AND (((true AND true) OR (false AND false))
            AND ('3pZv' STARTS WITH '3p')))
MATCH p1 = (n0)
WHERE true
RETURN collect(toString(n0.id)) AS alias3
SKIP 0
$$) AS (alias3 agtype);

Expected

The query returns the collected node id and leaves PostgreSQL available.

Actual

server closed the connection unexpectedly
client backend ... was terminated by signal 11: Segmentation fault

[gregfelice]

Confirmed still crashing on current master (4d9b2506, AGE 1.8.0, PostgreSQL 18.4).

Under gdb this stops at create_vertex, src/backend/executor/cypher_create.c:526, with the scan tuple slot NULL:

(gdb) p scanTupleSlot   $1 = (TupleTableSlot *) 0x0

That is the same failing dereference as #2501, #2508, #2527, #2530 and #2535 — five open issues with different-looking triggers that all reach one NULL pointer read. Root-cause analysis, the gdb evidence and the minimal five-line reproducer are written up in #2535; I would rather keep it in one place than repeat it here.

Not closing this as a duplicate — that is a maintainer's call, and #2501 is the earliest of the group if consolidation is wanted. Flagging it so the same bug does not get fixed five times.