Clone, Memory, And Sanitizer Stability

[zayenz]

This branch fixes several exception-safety and sanitizer-detected failures in Gecode's clone, allocation, MiniModel, and search code.

The clone and allocation work is based on the issues reported in Gecode/gecode#211.

Changes

• Failed cloning restores the source space if actor, advisor, local-object, variable-implementation, disposal metadata, or derived Space copying throws.
• Partial clone destruction no longer walks inconsistent actor/advisor state.
• Dispose-notice and AP_DISPOSE registration failures follow the ownership boundary: the space disposes an actor only after registration succeeds.
• IntSetObject allocation initializes cleanup state before range allocation and releases the object if range allocation fails.
• Full-width integer-domain calculations avoid signed overflow in range-width and hole-count arithmetic.
• MiniModel expression construction cleans up partially transferred objects and arrays without changing the public LinIntExpr() zero-expression behavior.
• Advisor recovery handles marked advisor links without typed casts.
• BAB recomputation handles the missing-incumbent case without binding through an invalid reference.
• Parallel search uses targeted synchronization fixes for command state, path stealing, stop state, mutable stop limits, PBS slave lifetime, restart-stop state, shared statistics, and no-good accounting.
• Fault injection can exercise clone, dispose-notice, IntSet, MiniModel, and heap-allocation failure paths deterministically.

Relationship To PR 211

PR 211 identified real problems , several parts carry over closely, especially the IntSetObject cleanup rule, early initialization of clone fields, and guarded MiniModel ownership transfers.

Some parts changed after testing made the ownership boundary more explicit. The clearest case is AP_DISPOSE: PR 211 disposed the actor when registration allocation failed, but the fault test shows that the space does not own the actor until registration succeeds.

Two PR 211 changes are not included. The propagation-statistics virtual hook is not needed for the clone/allocation fixes and adds dispatch to a hot path. The broad locking-scope patch is also left out as a unit; the synchronization changes here are the narrower ones exercised by TSan.

Validation

Multiple local runs of ASan, UBSan, and TSan, plus targeted UBSan replays for wide integer-domain arithmetic and
no-good accounting.

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[zayenz]

I pushed current main into the branch and added three review fixes:

• 1044ec5 keeps each partial propagator and brancher list circular after every successful copy. The previous head crashed when actor copy #2 threw because recovery followed actor #1's uninitialized next link. The fault tests now cover failures on both the first and second copy.
• 00bca10 restores the copy construction and assignment that NodeStop, FailStop, TimeStop, RestartStop, and NoGoods had before their fields became atomic.
• 80ce269 gives the process-global fault suite its own single-threaded CTest/check target, exercises it on the Ubuntu CMake CI row, and documents the fault/sanitizer options.

The repaired crash probe and copy-semantics probe pass. Debug+Audit check, the fault suite, generated-header comparison, tidy, and ASan+UBSan fault runs also pass locally.

I am leaving these points for manual design review:

1. Thread::run now snapshots Runnable::todelete() before run(). A Runnable that calls todelete(true) inside run() was deleted on main and is no longer deleted on this branch. That supports the PBS lifetime change, but it changes public behavior; a clean fix likely needs an explicit PBS completion handshake.
2. TimeStop::reset() can still write Timer::t0 while parallel workers read it in TimeStop::stop(). Making only the limit atomic does not make reset/resume race-free.
3. The new 64-bit and double atomics may require libatomic on supported 32-bit targets. Neither build system detects that dependency, and current CI is 64-bit only.
4. FailPoint remains process-global. The supported CMake targets are now safe, but manually mixing Fault::* and ordinary tests in one multi-threaded test process is not.

I would resolve those as explicit API/platform decisions rather than fold speculative changes into this already broad stability PR.