[BugFix] Null-safe SparseRangeIterator::has_more() to fix physical-split empty-tablet CN crash (#75203)

PhysicalSplitMorselQueue::_try_get_split_from_single_tablet() evaluates
_segment_range_iter.has_more() in its scan loop. On empty/edge tablets the iterator
can still be default-constructed (_range == nullptr) when has_more() is reached;
has_more() did an unconditional `_index < _range->_ranges.size()`, dereferencing the
null _range -> std::vector::size() at address 0 -> CN SIGSEGV @0x0. This is exactly
the reported crash stack (has_more() inlined into _try_get_split_from_single_tablet(),
per the addr2line in #75203). #70281 hardened _cur_rowset()/_cur_segment() but not
this iterator deref.

A default-constructed iterator has no ranges, so has_more() reports false instead of
dereferencing null. Verified under ASAN with a storage_primitive_test case: without
the guard it SEGVs at range.h in std::vector<Range>::size() (matching the issue's
addr2line); with the guard the test passes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Srihith Garlapati <srihith.garlapati@gmail.com>

Author: srihithg

be/src/storage_primitive/range.h

@@ -392,7 +392,12 @@ inline SparseRangeIterator<T>::SparseRangeIterator(const SparseRange<T>* r) : _r
 
 template <typename T>
 inline bool SparseRangeIterator<T>::has_more() const {
-    return _index < _range->_ranges.size();
+    // A default-constructed iterator (_range == nullptr) has no ranges to traverse.
+    // Guard the null before dereferencing: PhysicalSplitMorselQueue can reach
+    // _segment_range_iter.has_more() while the iterator is still default-constructed
+    // (empty/edge tablet, see issue #75203); without this check that dereferenced a
+    // null _range -> std::vector::size() at address 0 -> CN SIGSEGV @0x0.
+    return _range != nullptr && _index < _range->_ranges.size();
 }
 
 template <typename T>

be/test/storage_primitive/range_test.cpp

@@ -204,4 +204,22 @@ TEST(SparseRangeIteratorTest, intersect_test) {
     }
 }
 
+// Regression test for issue #75203: CN SIGSEGV @0x0 in
+// PhysicalSplitMorselQueue::_try_get_split_from_single_tablet().
+//
+// The physical-split loop evaluates `_segment_range_iter.has_more()` in its while
+// condition. On empty/edge tablets the iterator can still be default-constructed
+// (its _range pointer is null) when has_more() is reached. Before the fix has_more()
+// did an unconditional `_index < _range->_ranges.size()`, dereferencing the null
+// _range -> std::vector::size() read at address 0 -> SIGSEGV @0x0 (exactly the crash
+// stack in the issue: has_more() inlined into _try_get_split_from_single_tablet()).
+//
+// A default-constructed iterator has no ranges, so has_more() must report false
+// rather than dereference null. Without the fix this line is an ASAN
+// null/heap-buffer-overflow read; with it, it returns false.
+TEST(SparseRangeIteratorTest, has_more_on_default_constructed_is_null_safe) {
+    SparseRangeIterator<> iter; // default-constructed: _range == nullptr
+    EXPECT_FALSE(iter.has_more());
+}
+
 } // namespace starrocks