Running into check in URollbackBlackboard::BeginPredictionFrame with UAF

Development Character & Animation
, ,
1

Hello,

we are currently experimenting with Mover and UAF and are running into issues related to its debugging functionality. We have a pawn that is using mover and a UAF System. In the UAF System we are using a “Generate Trajectory from Mover” node to generate the trajectory. This works fine and as expected but it seems to collide with the FGameplayDebuggerCategory_Mover trying to draw the Trajectory aswell.

[Image Removed]

When we play the game in PIE and open the GDT with this pawn active, a check triggers in URollbackBlackboard::BeginPredictionFrame. The trajectory prediction is called twice at the same time, once on the GameThread due to the GDT and once on a background worker due to UAF.

This causes the following check to fail because the InPredictionThreadId doesn’t match anymore when either one of the system already started a prediction:

check(!bIsPredictionInProgress || InPredictionThreadId == FPlatformTLS::GetCurrentThreadId());

[Image Removed]

Is this a known issue and do you have any insights in how we could fix this issue?

Thanks!

[Attachment Removed]

2

Steps to Reproduce

  • Start play mode with any mover pawn using UAF System using the GenerateTrajectoryFromMover node
  • Open the console and enter “EnableGDT” to open the gameplay debugger tool
  • Use Numpad 5 to enable the Mover category
  • Observe a check failing in URollbackBlackboard::BeginPredictionFrame due to multiple threads trying to predict at once
    [Attachment Removed]
3

Yes, we ran into this as well. Good news, there’s a fix. Unfortunately it came too late for the 5.8 release, but it’s possible to integrate from the public Github:

https://github.com/EpicGames/UnrealEngine/commit/bebe55012554116dc914e86683d1598c5410620d

The rollback blackboard can’t support concurrent prediction, so this change makes one prediction requester wait for the other to finish.

Hope this helps!

[Attachment Removed]

4

Thats great news, we’ll be integrating this change then. Thanks!

[Attachment Removed]