Fix use-after-free FEncounteredStateMachineStack::StateStack

Development Character & Animation
, ,
1

Memory optimization done at CL 44140136 introduced this issue. Fix use-after-free by not using memstack allocator for persistent data. StateStack is being copied into the tick record which makes it persistent, but memstack allocations are per-frame and thus, not persistent. Doubled inline alloc size to account for this so we don’t see increased memory pressure from this change.

Look at `FActiveStateMachineScope::MakeUniqueEventContextData` and how it’s used to help determine root cause.

Small fix in .\Engine\Source\Runtime\Engine\Public\Animation\ActiveStateMachineScope.h

USTRUCT()
struct FEncounteredStateMachineStack
{
...
  TArray<FStateMachineEntry, TInlineAllocator<8>> StateStack
...

[Attachment Removed]

2

Steps to Reproduce[Attachment Removed]

3

Hi, thanks for reporting this, it’s a pretty nasty bug. I’m going to submit the change you included into Main, but I also want to prevent the possibility of this crashing in 5.8. Unfortunately, that change isn’t compatible with our hotfix rules, so I can’t include it there and there are no other good options. Instead, I’ll likely make a change so that we truncate the state stack to prevent it from being reallocated via the memstack allocator. It’ll mean that notifies generated within deeply nested states will fail the IsTriggeredByStateMachine, etc queries, but at least it shouldn’t crash.

Let me know if you’d like to discuss this any further.

[Attachment Removed]