[BUG] Full GDSmith batch intermittently segfaults after repeated binder errors

[d1zzy126]

Describe the bug
Replaying one preserved GDSmith batch can eventually crash the NeuG worker process with signal 11 after a repeatable error cascade. Before the segfault, the same batch consistently produces repeated multi-label create failures, repeated schema-violation binder failures, Unsupported operator type for alias management: 17, and unordered_map::at.

Execution Logs
An upstream-friendly reproducer is available here:

https://gist.github.com/d1zzy126/4f61755360c8948f7d49759e541e01a1

It contains repro.py and batch.log, and can be run with:

python repro.py batch.log

The strongest local trigger path replays the batch once in the parent process and then replays it again in a forked child process.

Expected behavior
Even if the batch contains unsupported statements, NeuG should return normal query errors and keep the worker process alive.

Error Message
Observed precursor sequence from the original worker crash and local replay:

Create node n0 with multiple node labels is not supported
...
Query node ... violates schema
...
Unsupported operator type for alias management: 17
...
unordered_map::at
...
Received signal 11

The final signal 11 is still intermittent rather than strictly deterministic, but this replay path has reproduced the same crash locally.

[d1zzy126]

Follow-up after more replay work on the public reproducer.

I updated the public gist again so it no longer depends on the local db_neug.neug_client import path, and instead inlines a shorter public executor that still keeps the critical execution semantics (rewrite -> prepare -> observe -> execute -> cleanup, plus parent warmup followed by a forked child replay):

https://gist.github.com/d1zzy126/4f61755360c8948f7d49759e541e01a1

What changed from the previous report is mainly the surface symptom, not the underlying failure family:

• the stronger local / host-exact replay path can still reach the real Received signal 11
• the updated public gist does not always end with that exact final string
• but it still reliably drives NeuG into the same crashy path, including:
  • _Map_base::at
  • malloc(): unaligned tcache chunk detected
  • malloc_consolidate(): unaligned fastbin chunk detected

So at this point I do not think this is a parser-level false positive or an unrelated issue. It looks much more like different manifestations of the same underlying memory-corruption / crash problem, with the exact final symptom depending on how closely the replay matches the in-repo execution path and runtime state.

If useful, I can also upload a larger "more exact executor" version or additional bridge code that is even closer to the local authoritative execution path.

[liulx20]

Description

UNWIND fails on a mixed list literal such as [n.id, 12, n.id].

It looks like this expression is currently translated into ToTuple, which makes it non-list-like for UNWIND. As a result, UNWIND cannot iterate over it.

Reproduction

Use the following query:

MATCH (n:person)
UNWIND [n.id, 12, n.id] AS id
RETURN id

A minimal Python reproducer is:

import neug

db = neug.Database("/tmp/modern_graph")
conn = db.connect()

res = conn.execute("""
MATCH (n:person)
UNWIND [n.id, 12, n.id] AS id
RETURN id
""")

plan

{
  opr {
    scan {
      alias {
      }
      params {
        tables {
          id: 1
        }
      }
    }
  }
  meta_data {
    type {
      graph_type {
        graph_data_type {
          label {
            label: 1
          }
        }
      }
    }
  }
}
plan {
  opr {
    unfold {
      alias {
        value: 1
      }
      input_expr {
        operators {
          node_type {
            data_type {
              array {
                component_type {
                  primitive_type: DT_SIGNED_INT64
                }
              }
            }
          }
          to_tuple {
            fields {
              operators {
                var {
                  tag {
                    id: 0
                  }
                  property {
                    key {
                      name: "id"
                    }
                  }
                  node_type {
                    data_type {
                      primitive_type: DT_SIGNED_INT64
                    }
                  }
                }
                node_type {
                  data_type {
                    primitive_type: DT_SIGNED_INT64
                  }
                }
              }
            }
            fields {
              operators {
                const {
                  i64: 12
                }
              }
            }
            fields {
              operators {
                var {
                  tag {
                    id: 0
                  }
                  property {
                    key {
                      name: "id"
                    }
                  }
                  node_type {
                    data_type {
                      primitive_type: DT_SIGNED_INT64
                    }
                  }
                }
                node_type {
                  data_type {
                    primitive_type: DT_SIGNED_INT64
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}
plan {
  opr {
    project {
      mappings {
        expr {
          operators {
            var {
              tag {
                id: 1
              }
              node_type {
                data_type {
                  primitive_type: DT_SIGNED_INT64
                }
              }
            }
            node_type {
              data_type {
                primitive_type: DT_SIGNED_INT64
              }
            }
          }
        }
        alias {
          value: 1
        }
      }
    }
  }
  meta_data {
    type {
      data_type {
        primitive_type: DT_SIGNED_INT64
      }
    }
    alias: 1
  }
}
plan {
  opr {
    sink {
    }
  }
}
flag {
  read: true
}}