Full-path `MERGE` followed by a `WITH` constant `STARTS WITH` predicate causes a PostgreSQL backend segmentation fault

[YGY-001]

Docker image `apache/age:release_PG18_1.7.0

Reproduction

LOAD 'age';
SET search_path = ag_catalog, public;
SELECT ag_catalog.create_graph('age_issue_case10');

SELECT *
FROM ag_catalog.cypher('age_issue_case10', $$
MERGE p = (:a)-[:r]->(n)
WITH 1 AS y
WHERE ('a' STARTS WITH 'a')
RETURN y
$$) AS (y agtype);

Expected

The query returns one row containing 1 and PostgreSQL remains available.

Actual

server closed the connection unexpectedly
client backend ... was terminated by signal 11: Segmentation fault

[gregfelice]

Confirmed still crashing on current master (4d9b2506, AGE 1.8.0, PostgreSQL 18.4).

Backtrace at the fault:

#0  0x000055a181fd8804 in ExecGetResultType ()
#1  0x00007fc0a258a598 in exec_cypher_merge (node=0x55a1935c6228) at src/backend/executor/cypher_merge.c:991
#2  0x000055a181ffd032 in ?? ()
#3  0x000055a181ffd032 in ?? ()

This faults in ExecGetResultType called from exec_cypher_merge at src/backend/executor/cypher_merge.c:991 — the MERGE executor, distinct from both the create_vertex group and the MERGE planner crash in #2534.

For context: I triaged the current fuzz-report backlog against master today. There are six distinct crash sites in it, not one — the largest group is five issues (#2501, #2508, #2527, #2530, #2535) that all share a single NULL dereference in create_vertex, written up in #2535. This issue is not part of that group; it is its own defect and needs its own fix.