UE 5.5.2.0 Crash in FStateTreeCompiler::CreateBindingsForNodes due to garbage memory access

Sharing about a crash we spotted in the State Tree compiler code, specifically in FStateTreeCompiler::CreateBindingsForNodes.

If you add enough bindings in your state tree, eventually, you’ll hit a 100% reproducible crash in this function. The function takes a TArrayView<FInstancedStruct> Instances. This function call CreatePropertyFunctionsForStruct within the CreateBindingsForNodes can then reallocate FStateTreeCompiler::SharedInstanceStructs.

When CreateBindingsForNodes is called in FStateTreeCompiler::CreateStateTransitions, the parameter passed into the function is SharedInstanceStructs, which is then used to initialize a TArrayView, which later on will be viewing an outdated version of SharedInstanceStructs because of the reallocation, triggering the garbage memory crash.

The fix for this would be updating the function signature from:

bool FStateTreeCompiler::CreateBindingsForNodes(TConstArrayView<FStateTreeEditorNode> EditorNodes, FStateTreeIndex16 NodesBegin, TArrayView<FInstancedStruct> Instances)

into

bool FStateTreeCompiler::CreateBindingsForNodes(TConstArrayView<FStateTreeEditorNode> EditorNodes, FStateTreeIndex16 NodesBegin, TArray<FInstancedStruct>& Instances)

where the Instances parameter is instead a TArray<FInstancedStruct>&.

We are currently experiencing a similar issue in Unreal 5.5.2 with the State Tree Compiler.

The State Tree Compiler can sporadically make the editor crash. It happens for any State Tree Asset using a lot of binded properties, especially bindings using property functions.
Moreover, it can prevent the cook of the project, as the State Tree Compilation sometimes break and needs manual recompilation.


This issue was partially solved by replacing the FStateTreeCompiler::CreateBindingNodes signature from

bool FStateTreeCompiler::CreateBindingsForNodes(TConstArrayView EditorNodes, FStateTreeIndex16 NodesBegin, TArrayView Instances)

to

bool FStateTreeCompiler::CreateBindingsForNodes(TConstArrayView<FStateTreeEditorNode> EditorNodes, FStateTreeIndex16 NodesBegin, TArray<FInstancedStruct>& Instances)

as suggested by @brain56.

However, making the changes makes any FStateTreePropertyRef unusable. Pointers to State Tree Parameters seems to break. This is noticeable while performing a FStateTreeRunEnvQueryTask, where the Parameter binded for the result is not updated.

Has anyone suggestions on how to solve this ?

Hello everyone!

I had this thread brought to my attention, and I have great news! This is indeed a bug and was fixed as part of 5.6. It did not make it into a 5.5 hotfix as it had a header change for the function. You can find the relevant changes made on our GitHub. Here is a direct link to the commit for those interested: StateTree: Fixed crash during bindings compilation (accessing view to array under modification).

Thank you for bringing these issues to our attention. I hope this can help unblock you and any other users on 5.5.

-James