Robust lifetime model for delta ensembles, stages 1-3

[magnesj]

Stages 1–3 of the staged redesign in #1031. Together they retire the use-after-free behind OPM#14423 structurally, rather than working around it at one call site. Stages 4–7, which cover the silent-wrong-state defects, are not included.

Part of #1031.

Base

The first commit is a cherry-pick of e16238f331, the band-aid from the open OPM#14424, so the regression test it introduced is present for stage 3 to build on. Stage 3 then removes the band-aid itself. If OPM#14424 merges upstream first, that commit drops out on rebase and nothing else changes.

Stage 1 — cycle-safe dependency traversal

Delta ensembles were found by scanning the summary case main collection, and their dependents visited by unguarded recursion. A dependency cycle, constructible through the UI, made that recursion run forever, and an ensemble used as both source 1 and source 2 was reported twice.

RimSummaryEnsembleTools gains dependentDeltaEnsembles(), deltaEnsemblesInUpdateOrder() and wouldCreateDependencyCycle(). The traversal follows the PDM back references, deduplicates, is iterative with visited and on-path sets, and returns delta ensembles in topological order. Back edges are logged rather than traversed. RimDeltaSummaryEnsemble::findReferringEnsembles() is deleted and its four call sites converted.

Stage 2 — declarative rebuild, setInUse pooling deleted

Derived cases were pooled through an m_inUse flag that conflated pool bookkeeping with owning the source references and the value cache. allSummaryCases() hid the not-in-use cases from the rest of the project, and cases handed out of the pool never got nameChanged connected, so a renamed source case never propagated.

Replaced by desiredSourceCasePairs(), a pure computation of the pairs the ensemble should have, and rebuildDerivedCases(), which diffs that against the existing derived cases keyed on the (case1, case2) pointer pair. Matching cases are reused, missing ones created, surplus ones detached and returned to the caller instead of deleted in place. Keying on the pointer pair makes the rebuild idempotent, including right after project load. setInUse, isInUse, m_inUse, setAllCasesNotInUse, firstCaseNotInUse and deleteCasesNoInUse are gone; old project files still load, since unknown XML keywords are skipped.

Stage 3 — RimSummaryCaseUpdateBatch

RicCloseSummaryCaseFeature::deleteSummaryCases holds a case list across removeCases and deletes it afterwards, while removeCases made a delta ensemble destroy derived cases that are themselves in that list.

RimSummaryCaseUpdateBatch is a plain scope object, ambient for its scope. Removal only detaches and hands the cases to the batch; the outermost scope flushes, regenerating dirty delta ensembles in dependency order first, then destroying the orphans. A nested batch contributes to the outermost one and never flushes. Orphans are held as guarded pointers, so a case the caller already destroyed is skipped rather than destroyed twice. Both contribution points fall back to immediate execution when no batch is active.

Deviation from the plan

The plan puts the outermost batch in removeCases. That does not work: deleteSummaryCases calls caf::PdmObjectHandleTools::deleteObjects( cases ) after removeCases has returned, so a batch ending there frees the orphans while that list still refers to them and the crash survives. A batch is therefore opened in both places, and nesting makes the feature's the outermost. removeCases no longer rewrites the caller's list and now takes it by const reference.

The regression test could not be kept verbatim for the same reason — its aliveCount == cases.size() assertion tests the write-back, which is the band-aid. It is renamed to RemoveCases_NoDanglingInCallerVector, as the plan's own test table anticipated, and asserts the invariant the batch buys instead: inside the batch scope every entry the caller handed over is still alive, and after the scope exits each has been destroyed exactly once. Removing just the batch line from that test on this branch reproduces the original signature exactly, cases.size() 6 against aliveCount() 4 followed by SEH exception with code 0xc0000005.

Follow-up spotted along the way

A dependency cycle stack-overflows in auto-name generation, independently of the traversal fixed here: RimSummaryEnsemble::updateName ends in caseNameChanged.send(), which reaches RimSummaryCaseMainCollection::onCaseNameChanged and back into updateSummaryEnsembleNames(), terminating only because names converge — which they never do when A's name derives from B's and B's from A's. DependencyOrder_CycleTerminates closes its cycle by writing the PdmPtrField directly for that reason. Stage 7 already plans cycle prevention in the setters and should cover it.