From file [Engine\Source\Runtime\Experimental\Chaos\Public\Chaos\AABBTree.h], function Chaos::TAABBTree<>::GetAsBoundsArray():
bool GetAsBoundsArray(TArray<TAABB<T, 3>>& AllBounds, int32 NodeIdx, int32 ParentNode, TAABB<T, 3>& Bounds)
{
if (Nodes[NodeIdx].bLeaf)
else
{ GetAsBoundsArray(AllBounds, Nodes[NodeIdx].ChildrenNodes[0], NodeIdx, Nodes[NodeIdx].ChildrenBounds[0]); GetAsBoundsArray(AllBounds, Nodes[NodeIdx].ChildrenNodes[1], NodeIdx, Nodes[NodeIdx].ChildrenBounds[0]); }return true;
}
The function above calls itself recursively as it traverses an AABBTree. The two recursive calls access ChildrenNodes[0] and ChildrenNodes[1], but both of them access ChildrenBounds[0].
Note: This function does not seem to be used in production currently, and it has not been touched since 2019. At that time, it was renamed from DumpTreeToLog() by CL 10074296, so it is probably meant as an optional debugging aid. Nevertheless, the function is available to be used by licensees, and the fix seems simple enough.
This bug can be verified by inspecting the related code (see description).
There's no existing public thread on this issue, so head over to Questions & Answers just mention UE-308038 in the post.