UObjectRedirector memory stomp causes crashes in BuildSignedDistanceFieldBuildSectionData, FStaticMeshSceneProxyDesc::GetMaterial and UStaticMeshComponent::GetMaterial

Development Platform & Builds
, ,
1

Hey,

After upgrading to 5.5.4 some people are consistently seeing a crash in one of three locations (see attached file for callstacks).

  1. BuildSignedDistanceFieldBuildSectionData : LN 177
  2. FStaticMeshSceneProxyDesc::GetMaterial : LN 158
  3. UStaticMeshComponent::GetMaterial : LN 2886

After catching it in the debugger, all of the crashes had one thing in common, they were all trying to access a UMaterialInterface despite the underlying object actually being a UObjectRedirector type shown by the debugger.

This means that, somewhere, a UObject has been unconditionally cast to UMaterialInterface even though it is a UObjectRedirector. This then essentially causes a memory stomp because we try to call functions that are associated with the UMaterialInterface type on what is actually a UObjectRedirector type meaning we could end up anywhere in memory.

Questions

  1. Can you shed any light on whether this is expected behaviour or not?
    1. It seems totally bizarre that the redirectors are not being handled either before they are in use by the static mesh object or the objects should be handling the redirect themselves.
  2. Is this a known issue and what is your suggested work around for this?
  3. How and where is it that the unconditional cast to UMaterialInterface is happening? This feels like a bug with that code.

Workaround(s)

So, based on this discovery, I made the following change in all locations listed above to properly handle the redirect and this stops the crash from happening, I assume that fixing up redirectors works as well but that feels like a temporary solution, can you please advise us on a permanent fix here please?

`// <#CCP_MOD>
//
// Traverse redirectors until we find the destination object
//
{
UObject* TempObj = OutMaterial;

while (UObjectRedirector* Redirector = Cast(TempObj))
{
TempObj = Redirector->DestinationObject;
}

OutMaterial = Cast(TempObj);
}
// </#CCP_MOD>`

2

Steps to Reproduce

  1. Be on Unreal 5.5.4.
  2. Create a simple material.
  3. Create a simple static mesh and attach your material to it as an override.
  4. Create a simple level and place your static mesh into it.
  5. Save everything.
  6. Move/Rename your material so that it creates a redirector but do not fix up the redirectors.
  7. Ensure that all resource caches (DDC / ZenLoader/Store) are totally cleared out so nothing is cached and you’re not connected to a remote cache so that the game has to cache the asset locally.
  8. Launch into your level with a Development Editor Win64 build and -game
  9. You should see a crash in one of the locations above.
3

Hello,

Thank you for reaching out.

I’ve been assigned this issue, and we will be looking into these crashes for you.

We have been unable to reproduce these crashes with your steps, both with and without Zenserver.

Can you please send us a minimal test project that demonstrates the crash?

The guide for test projects: [Content removed]