Fix plugin EP allocator deleter lifetime

[yen-shi]

Fix plugin EP allocator deleter lifetime

Summary

This PR fixes an AppVerifier failure seen during ONNX Runtime / onnxruntime_genai shutdown with the plugin EP path:

INVALID_POINTER_READ_AVRF_c0000005_onnxruntime.dll!OrtGetApiBase
Access violation - code c0000005

The bug is in the allocator deleter lifetime. Plugin EP allocators are released later by an OrtAllocatorUniquePtr custom deleter, but the deleter was reaching OrtEpFactory::ReleaseAllocator through transient owner captures:

• Environment::CreateSharedAllocatorImpl captured ep_device by reference.
• PluginExecutionProvider::CreatePreferredAllocators captured this.

The fix captures the required OrtEpFactory* directly in both deleters and calls:

ep_factory->ReleaseAllocator(ep_factory, allocator);

This keeps allocator destruction independent from the stack reference / provider object used when the deleter was created, while preserving the same allocator ownership and release API.

Changed files

• onnxruntime/core/session/environment.cc
• onnxruntime/core/session/plugin_ep/ep_plugin_provider_interfaces.cc

Verification

Built ORT and the TRT-RTX EP repro stack against TRT-RTX 1.6.1.114, then ran the DeepSeek WinML AppVerifier repro.

• Fixed branch: "appVerifierEnabled": true, "appVerifierFailed": false
• Rebuilt origin/main negative control: "appVerifierEnabled": true, "appVerifierFailed": true

This confirms the invalid pointer read still reproduces on origin/main and is removed by the allocator deleter lifetime change.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[tianleiwu]

Verdict: Approve

The fix is correct and minimal. Both allocator deleters now capture a stable OrtEpFactory* by value instead of routing through a transient owner (&ep_device in environment.cc, this in the plugin provider), which is exactly the right way to decouple allocator teardown from those objects' lifetimes.

Why this is sound:

• In the plugin provider, ep_factory_ is an OrtEpFactory& reference member, so &ep_factory_ points at the externally-owned factory object, not into the provider. Capturing that address by value genuinely survives provider destruction.
• The remaining lifetime dependency (factory must outlive the allocator) is already guaranteed for the shared-allocator path: ~Environment() clears shared_allocators_ / shared_ort_allocators_ (running the deleters) before tearing down ep_libraries_, which own the factories.
• Both call sites are fixed identically, so the two allocator-creation paths stay consistent.

Only minor (non-blocking) suggestions inline.

[tianleiwu]

@yen-shi, could you merge latest main branch to pass CI?

[tianleiwu]

This commit is cherry-picked in #29770