Crash in 5.6 preview - deprecated delegate wrappers in GraphEditor.cpp access variable after free

Development Platform & Builds
, ,
1

CL 41643395 has introduced a crash. SGraphEditor::UpgradeDeprecatedDelegates creates 4 lambda wrappers to invoke the deprecated delegate in client code by binding to the newer non-deprecated version and calling the deprecated version.

We’re in the process of upgrading to 5.6 and we still have client code which is binding to the deprecated methods (in our case OnCreateActionMenu). When we right click in our editor widget it causes a crash because EventsToUpdate reference has now expired as the FGraphEditorEvents has gone out of scope. I’ve fixed this by changing the lambda capture to capture a copy, i.e:

if (EventsToUpdate.OnDropActor.IsBound() && !EventsToUpdate.OnDropActors.IsBound()) { EventsToUpdate.OnDropActors = FOnDropActors::CreateLambda([&EventsToUpdate](const TArray< TWeakObjectPtr<AActor> >& Actors, UEdGraph* InGraph, const FVector2f& InDropLocation) { EventsToUpdate.OnDropActor.Execute(Actors, InGraph, FVector2D(InDropLocation)); }); }Changes to the following:

if (EventsToUpdate.OnDropActor.IsBound() && !EventsToUpdate.OnDropActors.IsBound()) { EventsToUpdate.OnDropActors = FOnDropActors::CreateLambda([OnDropActor=EventsToUpdate.OnDropActor](const TArray< TWeakObjectPtr<AActor> >& Actors, UEdGraph* InGraph, const FVector2f& InDropLocation) { OnDropActor.Execute(Actors, InGraph, FVector2D(InDropLocation)); }); }Cheers!

-Steven

2

Steps to Reproduce

  1. Create an SGraphEditor::FGraphEditorEvents on the stack
  2. Bind a callback to the deprecated “OnCreateActionMenu” delegate.
  3. Create a new SGraphEditor, passing in the temporary FGraphEditorEvents which goes out of scope after the caller finishes.
  4. Caller scope exits, FGraphEditorEvents variable is expired
  5. <some time passes>
  6. Right click in the new graph editor, it will invoke the OnCreateActionMenuAtLocation wrapper we created in SGraphEditor::UpgradeDeprecatedDelegates.
  7. It will crash when trying to invoke EventsToUpdate.OnCreateActionMenu as EventsToUpdate is an expired stack object which was destructed in step 3.
3

Hi Steve, thank you for the report! We will work to get this into a 5.6 hotfix.

4

This change should be present in the 5.6.1 hotfix. If it is needed sooner, it is mirrored to the public github here.