Multi-row `CREATE` followed by full-path `MERGE` causes a PostgreSQL backend segmentation fault

[YGY-001]

Docker image apache/age:release_PG18_1.7.0

Reproduction

LOAD 'age';
SET search_path = ag_catalog, public;
SELECT ag_catalog.create_graph('age_issue_case7');

SELECT *
FROM ag_catalog.cypher('age_issue_case7', $$
UNWIND [1331056905,1685130911] AS alias0
CREATE ({k0: true, k1: true, k3: false, k4: false, k5: 688047419, k11: 'Ad', k6: 'IZz', k10: -1671856916, k7: 't', k8: 644254522, k9: 'H2L3ye', id: 128, klist: [-693117962, 897437311, -1962790343]})
WITH alias0 AS alias1, [item IN range(12, 7, -1) WHERE item IS NOT NULL | toString(item)] AS alias2
WHERE ((('H0t' + 'KndeYYd') ENDS WITH 'ndeYYd') AND ((true AND true) AND true))
CREATE (n0:l0 {k1: true, k2: false, k3: false, id: 129, k6: 'Y', k7: 'C', k8: 1382373095, k9: 'Q', klist: [131362279, -1851970601, -1506840787, 2047568719]})
       <-[r0:rt1 {k0: false, k1: false, k2: false, k3: true, k5: 1497504556, k11: 'ZCsD', id: 4, k10: 1255153251, k7: 'Y', k8: -900442765, k9: 'E', klist: []}]-
       ({k0: false, k2: false, k3: false, k4: false, k11: 'J', id: 130, k6: 'p', k10: -759664277, k7: 'V', k8: 129867760, k9: 'UsV8'})
WITH *
MERGE p0 = (n0) <-[r1:rt1 {k0: false, k1: true, k2: true, k3: false, k4: false, k5: 81415748, k11: 'B', k6: 'aYhBB0', k10: 1575911880, k7: 'F', k8: -2118834534, k9: 'yYD8Slu', id: 5, klist: [999780219]}]-
           ({k1: false, k2: false, k3: true, k4: false, k5: 1399012233, id: 131, k6: 'Q1wsEm', k10: 47426956, k8: -125428397, k9: 'r', klist: [-508132260, 1582656878]})
       -[:rt8 {k0: true, k1: false, k2: true, k3: true, k4: false, k5: 586226905, k11: 'b', k6: 'z', k10: -760765339, k7: 'z', k8: 96686575, k9: 'x', id: 6, klist: [-1109084786]}]->
       ({k0: false, k1: true, k3: false, k4: false, k11: 'dTdqpT', id: 132, k10: -1589249357, k8: 390800412, klist: [172296092, 878100138, -1047680138]})
WITH alias2, r0.k9 AS alias3, round(toFloat(r0.k10)) AS alias4, n0 AS alias5, r0 AS alias6, r1 AS alias7, p0 AS alias8
WITH alias3 AS alias9, alias4, alias2 AS alias10, alias6.k11 AS alias11, alias5.k3 AS alias12, last(tail(nodes(alias8))) AS alias13, alias5 AS alias14, alias6 AS alias15, alias8
WITH *
CREATE (:l8 {k0: true, k1: false, k2: true, k3: true, k4: true, k5: -775427475, id: 133, k6: 'EkvHmp42', k10: -2013887244, k9: 'I', klist: [1515249301]})
RETURN alias14, alias15, alias8, alias11, alias13, alias4, alias12, atan(toFloat(alias14.id)) AS alias16, asin(toFloat(length(alias8))) AS alias17
ORDER BY alias11 DESC, alias4 DESC, alias12 ASC, alias16 ASC, alias17 ASC
LIMIT 15
$$) AS (c1 agtype, c2 agtype, c3 agtype, c4 agtype, c5 agtype,
        c6 agtype, c7 agtype, c8 agtype, c9 agtype);

Expected

The valid query completes and leaves PostgreSQL available.

Actual

server closed the connection unexpectedly
client backend ... was terminated by signal 11: Segmentation fault

[gregfelice]

Confirmed still crashing on current master (4d9b2506, AGE 1.8.0, PostgreSQL 18.4).

Under gdb this stops at create_vertex, src/backend/executor/cypher_create.c:526, with the scan tuple slot NULL:

(gdb) p scanTupleSlot   $1 = (TupleTableSlot *) 0x0

Here the CREATE is reached through exec_cypher_merge (cypher_merge.c:695) rather than directly, and node->prop_attr_num is 2 rather than 1, but the failing dereference is the same one.

That is the same failing dereference as #2501, #2508, #2527, #2530 and #2535 — five open issues with different-looking triggers that all reach one NULL pointer read. Root-cause analysis, the gdb evidence and the minimal five-line reproducer are written up in #2535; I would rather keep it in one place than repeat it here.

Not closing this as a duplicate — that is a maintainer's call, and #2501 is the earliest of the group if consolidation is wanted. Flagging it so the same bug does not get fixed five times.