[Crash - Repro] Re-naming Dynamic Parameter Node When Connected Causes Crash

Development Rendering
, , , , ,
1

Re-naming a dynamic parameter while the corresponding node is attached to something will cause an instant crash.

Steps to Reproduce:

  1. Create a new material, set blend mode to ‘Additive, Unlit’.

  2. Create a Dynamic Parameter node, a time node, and a multiply node. Connect the Time to the A input of the multiply node, and the Red Dynamic Parameter output to the B input of the Multiply node.

  3. Select the Dynamic Parameter node and in the details panel, attempt to re-name the Red output node. you should get an instant crash. I’ve done this twice in a row now, with different arrangements of nodes and it seems to happen regularly. I’m using public build 4.4

This ALSO happens if you disconnect the node if it’s been connected, and try to rename it.

Callstack:
!Id:c87a4f3d7a5d659fb91c8aa4bafe74fd

Access violation - code c0000005 (first/second chance not available)

Fatal error!

UE4Editor_Engine + 12282594 bytes
UE4Editor_Engine + 12543818 bytes
UE4Editor_MaterialEditor + 688720 bytes
UE4Editor_PropertyEditor + 2054004 bytes
UE4Editor_PropertyEditor + 1906156 bytes
UE4Editor_PropertyEditor + 1907199 bytes
UE4Editor_PropertyEditor + 2464582 bytes
UE4Editor_PropertyEditor + 2200089 bytes
UE4Editor_PropertyEditor + 1558131 bytes
UE4Editor_PropertyEditor + 1576952 bytes
UE4Editor_Slate + 2733959 bytes
UE4Editor_Slate + 877729 bytes
UE4Editor_Slate + 788062 bytes
UE4Editor_Slate + 722003 bytes
UE4Editor_Core + 2502938 bytes
UE4Editor_Core + 2422753 bytes
UE4Editor_Core + 2508174 bytes
UE4Editor_Core + 2410066 bytes
user32 + 105425 bytes
user32 + 104666 bytes
UE4Editor_Core + 2509366 bytes
UE4Editor!FEngineLoop::Tick() + 2877 bytes [d:\buildfarm\buildmachine_++depot+ue4-releases+4.4\engine\source\runtime\launch\private\launchengineloop.cpp:2080]
UE4Editor!GuardedMain() + 476 bytes [d:\buildfarm\buildmachine_++depot+ue4-releases+4.4\engine\source\runtime\launch\private\launch.cpp:133]
UE4Editor!GuardedMainWrapper() + 26 bytes [d:\buildfarm\buildmachine_++depot+ue4-releases+4.4\engine\source\runtime\launch\private\windows\launchwindows.cpp:125]
UE4Editor!WinMain() + 249 bytes [d:\buildfarm\buildmachine_++depot+ue4-releases+4.4\engine\source\runtime\launch\private\windows\launchwindows.cpp:201]
UE4Editor!__tmainCRTStartup() + 329 bytes [f:\dd\vctools\crt\crtw32\dllstuff\crtexe.c:618]
2

It seems I have repro too and fix for this crash:

change

void UMaterial::UpdateExpressionDynamicParameterNames(const UMaterialExpression* Expression)
{
	const UMaterialExpressionDynamicParameter* DynParam = Cast<UMaterialExpressionDynamicParameter>(Expression);
	if (DynParam)
	{
		for (int32 ExpIndex = 0; ExpIndex < Expressions.Num(); ExpIndex++)
		{
			UMaterialExpressionDynamicParameter* CheckParam = Cast<UMaterialExpressionDynamicParameter>(Expressions[ExpIndex]);
			if (CheckParam->CopyDynamicParameterNames(DynParam))
			{
#if WITH_EDITORONLY_DATA
				CheckParam->GraphNode->ReconstructNode();
#endif // WITH_EDITORONLY_DATA
			}
		}
	}
}

to

void UMaterial::UpdateExpressionDynamicParameterNames(const UMaterialExpression* Expression)
{
	const UMaterialExpressionDynamicParameter* DynParam = Cast<UMaterialExpressionDynamicParameter>(Expression);
	if (DynParam)
	{
		for (int32 ExpIndex = 0; ExpIndex < Expressions.Num(); ExpIndex++)
		{
			UMaterialExpressionDynamicParameter* CheckParam = Cast<UMaterialExpressionDynamicParameter>(Expressions[ExpIndex]);
			if (CheckParam && CheckParam->CopyDynamicParameterNames(DynParam))
			{
#if WITH_EDITORONLY_DATA
				CheckParam->GraphNode->ReconstructNode();
#endif // WITH_EDITORONLY_DATA
			}
		}
	}
}

This code is crashing because casting to UMaterialExpressionDynamicParameter may fail which produces CheckParam nullptr. I made a pull request on github :slight_smile:

3

Nice! Good find too :slight_smile:

4

Hey -

Thanks for letting us know about this issue. I have been able to reproduce this internally and have submitted it to our tracking system for further investigation (TTP #344324).

And thank you , I have included your suggested fix as well.

Cheers

5

This still seems to be happening in 4.4.1 any eta on the fix?

6

Hey FreddyHoops-

This has been fixed internally and will most likely be included in the 4.5 release. Until the fix has been implemented you can work around this by renaming the dynamic parameter node prior to connecting it to another node.