The PoC is generated by my DBMS fuzzer. It can also be reproduced in the latest branch.
```SQL
CREATE TABLE v0 ( v1 INT , v2 INT ) ;
 CREATE VIEW v3 AS SELECT * FROM v0 GROUP BY 'x' ;
 INSERT INTO v3 VALUES ( -1 , 127 ) ;
 SELECT v2 + v1 FROM v3 WHERE v2 IN ( 127 ) AND v1 NOT IN ( SELECT DISTINCT v1 / 67 , 96 FROM v0 GROUP BY NULL , 'x' , 'x' , 'x' ) ORDER BY 13647422.000000 / -1 / v2 + v1 + v2 ;
```

backtrace:
```c
#0 0x425944 (chash_array+0x834)
#1 0x427618 (gb_values+0xed8)
#2 0x42d6da (setp_chash_run+0x4aa)
#3 0x43125a (setp_chash_group+0x44a)
#4 0x63c338 (setp_node_run+0x658)
#5 0x63cc23 (setp_node_input+0x33)
#6 0x7af05e (qn_input+0x3ce)
#7 0x7af05e (qn_input+0x3ce)
#8 0x7af78f (qn_ts_send_output+0x23f)
#9 0x7b509e (table_source_input+0x16ee)
#10 0x7af05e (qn_input+0x3ce)
#11 0x7bc82b (fun_ref_node_input+0x36b)
#12 0x7af05e (qn_input+0x3ce)
#13 0x751d38 (subq_next+0x258)
#14 0x821acb (subq_node_vec_input+0x2eb)
#15 0x7af05e (qn_input+0x3ce)
#16 0x7bc82b (fun_ref_node_input+0x36b)
#17 0x7af05e (qn_input+0x3ce)
#18 0x7af4c6 (qn_send_output+0x236)
#19 0x8214bd (set_ctr_vec_input+0x99d)
#20 0x7af05e (qn_input+0x3ce)
#21 0x7c084b (qr_exec+0x11db)
#22 0x7ce1d6 (sf_sql_execute+0x11a6)
#23 0x7cecde (sf_sql_execute_w+0x17e)
#24 0x7d799d (sf_sql_execute_wrapper+0x3d)
#25 0xe214bc (future_wrapper+0x3fc)
#26 0xe28dbe (_thread_boot+0x11e)
#27 0x7ff4ccfae609 (start_thread+0xd9)
#28 0x7ff4ccd7e133 (clone+0x43)
```

ways to reproduce (write poc to the file /tmp/test.sql first):
```bash
# remove the old one
docker container rm virtdb_test -f
# start virtuoso through docker
docker run --name virtdb_test -itd --env DBA_PASSWORD=dba openlink/virtuoso-opensource-7:7.2.11
# wait the server starting
sleep 10
# check whether the simple query works
echo "SELECT 1;" | docker exec -i virtdb_test isql 1111 dba
# run the poc
cat /tmp/test.sql | docker exec -i virtdb_test isql 1111 dba
```
Fuzzer: Virtuoso 7.2.11 crashed at `chash_array`
This is a GitHub Issue
repo:virtuoso-opensource
owner:openlink
Title : Fuzzer: Virtuoso 7.2.11 crashed at `chash_array`
Issue date:

--- start body ---
The PoC is generated by my DBMS fuzzer. It can also be reproduced in the latest branch.
```SQL
CREATE TABLE v0 ( v1 INT , v2 INT ) ;
 CREATE VIEW v3 AS SELECT * FROM v0 GROUP BY 'x' ;
 INSERT INTO v3 VALUES ( -1 , 127 ) ;
 SELECT v2 + v1 FROM v3 WHERE v2 IN ( 127 ) AND v1 NOT IN ( SELECT DISTINCT v1 / 67 , 96 FROM v0 GROUP BY NULL , 'x' , 'x' , 'x' ) ORDER BY 13647422.000000 / -1 / v2 + v1 + v2 ;
```

backtrace:
```c
#0 0x425944 (chash_array+0x834)
#1 0x427618 (gb_values+0xed8)
#2 0x42d6da (setp_chash_run+0x4aa)
#3 0x43125a (setp_chash_group+0x44a)
#4 0x63c338 (setp_node_run+0x658)
#5 0x63cc23 (setp_node_input+0x33)
#6 0x7af05e (qn_input+0x3ce)
#7 0x7af05e (qn_input+0x3ce)
#8 0x7af78f (qn_ts_send_output+0x23f)
#9 0x7b509e (table_source_input+0x16ee)
#10 0x7af05e (qn_input+0x3ce)
#11 0x7bc82b (fun_ref_node_input+0x36b)
#12 0x7af05e (qn_input+0x3ce)
#13 0x751d38 (subq_next+0x258)
#14 0x821acb (subq_node_vec_input+0x2eb)
#15 0x7af05e (qn_input+0x3ce)
#16 0x7bc82b (fun_ref_node_input+0x36b)
#17 0x7af05e (qn_input+0x3ce)
#18 0x7af4c6 (qn_send_output+0x236)
#19 0x8214bd (set_ctr_vec_input+0x99d)
#20 0x7af05e (qn_input+0x3ce)
#21 0x7c084b (qr_exec+0x11db)
#22 0x7ce1d6 (sf_sql_execute+0x11a6)
#23 0x7cecde (sf_sql_execute_w+0x17e)
#24 0x7d799d (sf_sql_execute_wrapper+0x3d)
#25 0xe214bc (future_wrapper+0x3fc)
#26 0xe28dbe (_thread_boot+0x11e)
#27 0x7ff4ccfae609 (start_thread+0xd9)
#28 0x7ff4ccd7e133 (clone+0x43)
```

ways to reproduce (write poc to the file /tmp/test.sql first):
```bash
# remove the old one
docker container rm virtdb_test -f
# start virtuoso through docker
docker run --name virtdb_test -itd --env DBA_PASSWORD=dba openlink/virtuoso-opensource-7:7.2.11
# wait the server starting
sleep 10
# check whether the simple query works
echo "SELECT 1;" | docker exec -i virtdb_test isql 1111 dba
# run the poc
cat /tmp/test.sql | docker exec -i virtdb_test isql 1111 dba
```
--- end body ---
