Content browser crash in 5.5 and 5.6 when searching(edit: with fix)

Development Pipeline & Plugins
, ,
1

Edit: This crash is related to the usage of asset collections.

If an asset is part of a collection, it is possible to crash the content browser search when you type a character into the search that is part of the collection name, due to an order of operations bug in the FCompiledAssetTextFilter::PassesFilter function

-Original-

In 5.5, our team ran into a crash issue when typing into the search bar of the content browser. I tracked it to FCompiledAssetTextFilter::TestBasicStringExpression, which calls CompareFStringView, on FStringView objects that are empty.

I am not sure how or why the FCompiledAssetTextFilter gets into the state of having null string views, but here is an example of one such object that crashes.

[Image Removed]

You can see how all 4 string views are empty. Calling CompareFStringView with these empty string views dereferences the data pointer to a nullptr and then crashes in the string compare.

The asset just seems to be a simple gameplay ability. Nothing all that special. I don’t know how it’s getting to this function with none of those string views filled in, but it is

To avoid this crash, I put checks around the locations that would crash on these empty string views.

[Image Removed]

This still happens in 5.6

2

Hello [mention removed]​

Thank you for reaching out and bringing this issue to our attention.

Does this occur upon using a particular feature, i.e., a specific syntax, key, metadata search, boolean operation, string search?

Please let me know if you have additional details on the reproduction steps.

All the best,

[mention removed]​

3

I did some more debugging, and I think I have found the issue

  • FCompiledAssetTextFilter::PassesFilter sets the string views at the bottom of the function
  • If the asset is referenced by dynamic collections (ReferencedDynamicCollections), DynamicCollection.Container->TestDynamicQuery will be called within the PassesFilter function, before the string views have been set, resulting in the string views being accessed before the caller has set them
  • So the key repro case is probably that the asset is part of a collection.

[Image Removed]A proper fix is probably to not call any other query functions prior to the FCompiledAssetTextFilter being fully initialized in this function

Moving the block

if ((CollectionContainers.IsValid() || ReferencedDynamicCollections.IsValid()) && bIncludeCollectionNames)

to after the string view initialization(before the call to

const bool bMatched = Evaluator->TestTextFilter(*this);

Seems to be the proper fix

This also explains why the crash is occuring when typing in the letters B, S, C, O or M, because the collection in play here is “Combos”

4

Hello [mention removed]​

Thank you again for reporting this issue and for providing a possible solution.

I’ve found an already reported issue that is similar to the one you described: Unreal Engine Issues and Bug Tracker (UE\-252265)

I’ve asked Epic to annex your suggestion to this case.

You will be able to track the implementation by following this link.

I’ll close the case, but if you have anything to add, reply, and it will reopen.

All the best,

[mention removed]​