MonetDB server crashes in exp_ref

[fuboat]

Describe the bug
MonetDB server crashes in exp_ref.

To Reproduce

CREATE TABLE v0 ( v1 DOUBLE );
 DELETE FROM v0 WHERE ( v1 ) IS NULL OR ( SELECT DENSE_RANK ( ) OVER ( PARTITION BY count ( * ) ORDER BY v1 % 10 ) WHERE 0 BETWEEN v1 AND v1 ) < 4;

Backtrace of the Crash

#0 0x7f71aba63ccf (exp_ref+0x3f)
#1 0x7f71abaa0211 (rel_unnest_dependent+0x4941)
#2 0x7f71aba9bcba (rel_unnest_dependent+0x3ea)
#3 0x7f71aba9cc6c (rel_unnest_dependent+0x139c)
#4 0x7f71aba9bcba (rel_unnest_dependent+0x3ea)
#5 0x7f71aba9cc6c (rel_unnest_dependent+0x139c)
#6 0x7f71aba9bcba (rel_unnest_dependent+0x3ea)
#7 0x7f71aba9cc6c (rel_unnest_dependent+0x139c)
#8 0x7f71aba9bcba (rel_unnest_dependent+0x3ea)
#9 0x7f71aba9cc6c (rel_unnest_dependent+0x139c)
#10 0x7f71aba9bcba (rel_unnest_dependent+0x3ea)
#11 0x7f71aba9d3e7 (rel_unnest_dependent+0x1b17)
#12 0x7f71aba9bcba (rel_unnest_dependent+0x3ea)
#13 0x7f71aba9cc6c (rel_unnest_dependent+0x139c)
#14 0x7f71aba92ab7 (_rel_unnest+0x4d7)
#15 0x7f71aba80c97 (rel_visitor_bottomup+0x3e7)
#16 0x7f71aba80b87 (rel_visitor_bottomup+0x2d7)
#17 0x7f71aba80b87 (rel_visitor_bottomup+0x2d7)
#18 0x7f71aba80b28 (rel_visitor_bottomup+0x278)
#19 0x7f71aba8bb16 (rel_unnest+0xd6)
#20 0x7f71aba07eef (sql_processrelation+0x4f)
#21 0x7f71ab811e1b (sql_symbol2relation+0x1bb)
#22 0x7f71ab83eb84 (SQLparser+0x624)
#23 0x7f71ab83dcbc (SQLengine_+0xa5c)
#24 0x7f71ab83b4fe (SQLengine+0x3e)
#25 0x7f71abdb92cf (runScenario+0x6f)
#26 0x7f71abdba4de (MSscheduleClient+0xb6e)
#27 0x7f71abef1182 (doChallenge+0x132)
#28 0x7f71acc1a8a7 (thread_starter+0xc7)
#29 0x7f71ab735609 (start_thread+0xd9)
#30 0x7f71ab658133 (clone+0x43)

Software versions

• MonetDB version number: v11.49.1 (Dec2023)
• OS and version: Ubuntu 20.04
• From docker image monetdb/monetdb:Dec2023

An example of steps to reproduce in docker container (write the poc into /tmp/test.sql first):

docker container rm monetdb_test -f
docker run -e MDB_DB_ADMIN_PASS=monetdb --name monetdb_test -itd monetdb/monetdb:Dec2023
docker exec monetdb_test bash -c 'echo -n -e "user=monetdb\npassword=monetdb\n" > /root/.monetdb'

sleep 10
cat /tmp/test.sql | timeout 5s docker exec -i monetdb_test mclient monetdb     # run test case

if docker exec monetdb_test bash -c "grep '[m]server5' /proc/*/cmdline -lR"; then
    echo "[INFO] Server normal."
else
    echo "[CRASH] Mserver5 process does NOT exist."
fi

It can also be reproduced on the docker image monetdb/dev-builds:default.

Issue labeling
bug