apache / apache/age

Server crashes (segfault) when a MATCH pattern property-map value is a correlated `EXISTS { }` subquery containing an aggregate

Open
#2,507 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
C
Stars
4.8k
Forks
523
Avg merge
1d 2h
Merged PRs (30d)
9

Description

**Bug description**

Writing a Cypher `MATCH` pattern whose property-map value is a correlated `EXISTS { }` subquery — the subquery projects an aggregate through `WITH` and references the outer pattern variable — crashes the PostgreSQL backend with a segmentation fault. The backend process is terminated (`signal 11: Segmentation fault`) and the connection is dropped.

**Access method**

- Command line via `psql`, inside the official Docker container `apache/age:1.8.0`

**Data setup**

Only a single vertex is required — no labels, properties, or edges:

```pgsql
CREATE EXTENSION IF NOT EXISTS age;
LOAD 'age';
SET search_path = ag_catalog, "$user", public;
SELECT create_graph('graph_test');
SELECT * FROM cypher('graph_test', $$ CREATE (n) $$) AS (c agtype);
```

**Configuration**

- None beyond the stock AGE extension. No additional modules (no PostGIS, etc.), default `search_path` handling as shown above.

**Command that triggers the crash**

```pgsql
SELECT * FROM cypher('graph_test', $$ MATCH (x {n0: EXISTS { WITH sum(0) AS n1, x RETURN 0 }}) RETURN 0 $$) AS (c agtype);
```

```
server closed the connection unexpectedly
This probably means the server terminated abnormally
before or while processing the request.
connection to server was lost
```

The server log shows the backend being killed:

```
LOG: client backend (PID NNN) was terminated by signal 11: Segmentation fault
LOG: terminating any other active server processes
LOG: all server processes terminated; reinitializing
```

**Expected behavior**

The query is valid Cypher: an `EXISTS` subquery that always returns one row is used as the value of a pattern property map. It should either match nodes and return normally, or raise a normal Cypher error — it must not crash the backend process. The same correlated subquery placed in a `WHERE` clause instead of a property map executes correctly (returns `0`), so the crash is specific to the property-map context.

**Removing any one of the following makes the crash disappear:**

- The subquery referencing the outer variable `x` (correlation)
- An aggregate (e.g. `sum`) projected in the subquery's `WITH` clause
- The `EXISTS` subquery being used as a pattern property-map value (same subquery in `WHERE` does not crash)

**Environment**

- Version: 1.8.0 (official `apache/age:1.8.0` Docker image)
- PostgreSQL: 18.1 (Debian 18.1-1.pgdg13+2), x86_64

Contributor guide

Open the contributing guide

Research direction

Reproduce the exact SQL in psql inside the apache/age:1.8.0 Docker container, then compare it with the WHERE-clause variant and the three reduced cases listed. Trace the MATCH property-map and correlated EXISTS/aggregate handling; done means the query no longer segfaults and instead matches or raises a normal Cypher error, while the comparison cases retain their reported behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, docker, postgresql
Domain
backend, databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.