SegmentReaderPoolManager::isSegmentReader may panic while cons or decons

Bug Report

Please answer these questions before submitting your issue. Thanks!

1. Minimal reproduce step (Required)

This could be confusing if there are many seg faults.

The first segfault

2023-10-29 15:55:00 | [2023/10/29 07:55:00.338 +00:00] [ERROR] [BaseDaemon.cpp:422] ["Address not mapped to object."] [source=BaseDaemon] [thread_id=4761]
-- | --
  |   | 2023-10-29 15:55:00 | [2023/10/29 07:55:00.338 +00:00] [ERROR] [BaseDaemon.cpp:407] ["Address: 0x40"] [source=BaseDaemon] [thread_id=4761]
  |   | 2023-10-29 15:55:00 | [2023/10/29 07:55:00.338 +00:00] [ERROR] [BaseDaemon.cpp:377] ["(from thread 3895) Received signal Segmentation fault(11)."] [source=BaseDaemon] [thread_id=4761]
  |   | 2023-10-29 15:55:00 | [2023/10/29 07:55:00.338 +00:00] [ERROR] [BaseDaemon.cpp:376] [########################################] [source=BaseDaemon] [thread_id=4761]
  |   | 2023-10-29 15:55:00 | [2023/10/29 07:55:00.329 +00:00] [ERROR] [BaseDaemon.cpp:569] ["\n       0x684f2e0\tfaultSignalHandler(int, siginfo_t*, void*) [tiflash+109376224]\n                \tlibs/libdaemon/src/BaseDaemon.cpp:220\n  0xffffb51bc81c\t<unknown symbol> [linux-vdso.so.1+2076]\n       0x73f41b8\tDB::MPPTask::runImpl() [tiflash+121586104]\n                \tdbms/src/Flash/Mpp/MPPTask.cpp:427\n       0x19d249c\tauto DB::wrapInvocable<std::__1::function<void ()> >(bool, std::__1::function<void ()>&&)::'lambda'()::operator()() [tiflash+27075740]\n                \tdbms/src/Common/wrapInvocable.h:36\n       0x18f1094\tDB::DynamicThreadPool::executeTask(std::__1::unique_ptr<DB::IExecutableTask, std::__1::default_delete<DB::IExecutableTask> >&) [tiflash+26153108]\n                \tdbms/src/Common/DynamicThreadPool.cpp:101\n       0x18f05b8\tDB::DynamicThreadPool::fixedWork(unsigned long) [tiflash+26150328]\n                \tdbms/src/Common/DynamicThreadPool.cpp:115\n       0x18f1c7c\tvoid* std::__1::__thread_proxy<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, std::__1::thread DB::ThreadFactory::newThread<void (DB::DynamicThreadPool::*)(unsigned long), DB::DynamicThreadPool*, unsigned long&>(bool, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >, void (DB::DynamicThreadPool::*&&)(unsigned long), DB::DynamicThreadPool*&&, unsigned long&)::'lambda'(auto&&...), DB::DynamicThreadPool*, unsigned long> >(void*) [tiflash+26156156]\n                \t/usr/local/bin/../include/c++/v1/thread:291\n  0xffffb112aa28\tstart_thread [libc.so.6+535080]"] [source=BaseDaemon] [thread_id=4761]

The second segfault

2023-10-29 15:55:00 | [2023/10/29 07:55:00.349 +00:00] [ERROR] [BaseDaemon.cpp:422] ["Address not mapped to object."] [source=BaseDaemon] [thread_id=4761]
-- | --
  |   | 2023-10-29 15:55:00 | [2023/10/29 07:55:00.349 +00:00] [ERROR] [BaseDaemon.cpp:407] ["Address: 0x48"] [source=BaseDaemon] [thread_id=4761]
  |   | 2023-10-29 15:55:00 | [2023/10/29 07:55:00.349 +00:00] [ERROR] [BaseDaemon.cpp:377] ["(from thread 762) Received signal Segmentation fault(11)."] [source=BaseDaemon] [thread_id=4761]
  |   | 2023-10-29 15:55:00 | [2023/10/29 07:55:00.349 +00:00] [ERROR] [BaseDaemon.cpp:376] [########################################] [source=BaseDaemon] [thread_id=4761]
  |   | 2023-10-29 15:55:00 | [2023/10/29 07:55:00.338 +00:00] [ERROR] [BaseDaemon.cpp:569] ["\n       0x684f2e0\tfaultSignalHandler(int, siginfo_t*, void*) [tiflash+109376224]\n                \tlibs/libdaemon/src/BaseDaemon.cpp:220\n  0xffffb51bc81c\t<unknown symbol> [linux-vdso.so.1+2076]\n       0x682779c\tstd::__1::__hash_const_iterator<std::__1::__hash_node<std::__1::__thread_id, void*>*> std::__1::__hash_table<std::__1::__thread_id, std::__1::hash<std::__1::__thread_id>, std::__1::equal_to<std::__1::__thread_id>, std::__1::allocator<std::__1::__thread_id> >::find<std::__1::__thread_id>(std::__1::__thread_id const&) const [tiflash+109213596]\n                \t/usr/local/bin/../include/c++/v1/__hash_table:2425\n       0x679f99c\tDB::DM::DMFileBlockInputStreamBuilder::build(std::__1::shared_ptr<DB::DM::DMFile> const&, std::__1::vector<DB::DM::ColumnDefine, std::__1::allocator<DB::DM::ColumnDefine> > const&, std::__1::vector<DB::DM::RowKeyRange, std::__1::allocator<DB::DM::RowKeyRange> > const&, std::__1::shared_ptr<DB::DM::ScanContext> const&) [tiflash+108657052]\n                \tdbms/src/Storages/DeltaMerge/File/DMFileBlockInputStream.cpp:55\n       0x674e830\tDB::DM::StableValueSpace::Snapshot::getInputStream(DB::DM::DMContext const&, std::__1::vector<DB::DM::ColumnDefine, std::__1::allocator<DB::DM::ColumnDefine> > const&, std::__1::vector<DB::DM::RowKeyRange, std::__1::allocator<DB::DM::RowKeyRange> > const&, std::__1::shared_ptr<DB::DM::RSOperator> const&, unsigned long, unsigned long, bool, bool, bool, std::__1::vector<std::__1::shared_ptr<std::__1::set<unsigned long, std::__1::less<unsigned long>, std::__1::allocator<unsigned long> > >, std::__1::allocator<std::__1::shared_ptr<std::__1::set<unsigned long, std::__1::less<unsigned long>, std::__1::allocator<unsigned long> > > > > const&, bool) [tiflash+108324912]\n                \tdbms/src/Storages/DeltaMerge/StableValueSpace.cpp:461\n       0x6725150\tstd::__1::shared_ptr<DB::DM::SkippableBlockInputStream> DB::DM::Segment::getPlacedStream<true, DB::DM::DTCompactedEntries<55ul, 20ul, 3ul>::Iterator>(DB::DM::DMContext const&, std::__1::vector<DB::DM::ColumnDefine, std::__1::allocator<DB::DM::ColumnDefine> > const&, std::__1::vector<DB::DM::RowKeyRange, std::__1::allocator<DB::DM::RowKeyRange> > const&, std::__1::shared_ptr<DB::DM::RSOperator> const&, std::__1::shared_ptr<DB::DM::StableValueSpace::Snapshot> const&, std::__1::shared_ptr<DB::DM::DeltaValueReader> const&, DB::DM::DTCompactedEntries<55ul, 20ul, 3ul>::Iterator const&, DB::DM::DTCompactedEntries<55ul, 20ul, 3ul>::Iterator const&, unsigned long, unsigned long, bool) [tiflash+108155216]\n                \tdbms/src/Storages/DeltaMerge/Segment.cpp:2197\n       0x66fad8c\tDB::DM::Segment::ensurePlace(DB::DM::DMContext const&, std::__1::shared_ptr<DB::DM::StableValueSpace::Snapshot> const&, std::__1::shared_ptr<DB::DM::DeltaValueReader> const&, std::__1::vector<DB::DM::RowKeyRange, std::__1::allocator<DB::DM::RowKeyRange> > const&, unsigned long) const [tiflash+107982220]\n                \tdbms/src/Storages/DeltaMerge/Segment.cpp:2271\n       0x66e74a4\tDB::DM::Segment::getReadInfo(DB::DM::DMContext const&, std::__1::vector<DB::DM::ColumnDefine, std::__1::allocator<DB::DM::ColumnDefine> > const&, std::__1::shared_ptr<DB::DM::SegmentSnapshot> const&, std::__1::vector<DB::DM::RowKeyRange, std::__1::allocator<DB::DM::RowKeyRange> > const&, unsigned long) const [tiflash+107902116]\n                \tdbms/src/Storages/DeltaMerge/Segment.cpp:2138\n       0x66f87b8\tDB::DM::Segment::placeDeltaIndex(DB::DM::DMContext&, std::__1::shared_ptr<DB::DM::SegmentSnapshot> const&) const [tiflash+107972536]\n                \tdbms/src/Storages/DeltaMerge/Segment.cpp:2041\n       0x669b278\tDB::DM::DeltaMergeStore::handleBackgroundTask(bool) [tiflash+107590264]\n                \tdbms/src/Storages/DeltaMerge/DeltaMergeStore_InternalBg.cpp:392\n       0x700e09c\tvoid* std::__1::__thread_proxy<std::__1::tuple<std::__1::unique_ptr<std::__1::__thread_struct, std::__1::default_delete<std::__1::__thread_struct> >, DB::BackgroundProcessingPool::BackgroundProcessingPool(int, std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> >)::$_1> >(void*) [tiflash+117498012]\n                \t/usr/local/bin/../include/c++/v1/thread:291\n  0xffffb112aa28\tstart_thread [libc.so.6+535080]"] [source=BaseDaemon] [thread_id=4761]

2. What did you expect to see? (Required)

3. What did you see instead (Required)

4. What is your TiFlash version? (Required)

Start with SegmentReaderPoolManager::isSegmentReader and compare its behavior with the reported stack traces in dbms/src/Storages/DeltaMerge/File/DMFileBlockInputStream.cpp, StableValueSpace.cpp, and Segment.cpp. Reproduce the segmentation fault during concurrent segment construction or destruction, then verify that the affected path no longer panics under that workload.