Crash when calling SetState inside state machine OnUpdate

The crash happens when SetState is called inside the function bound to OutputAnimationPose’s OnUpdate in the animation state. This way of using Set State node is the same as shown in the official documentation.

[Link Removed]

From the investigation, the crash occurs because the size of ActiveTransitionArray in FAnimNode_StateMachine::Update_AnyThread is changed inside this loop:

for (int32 Index = 0; Index < ActiveTransitionArray.Num(); ++Index)
{
    ActiveTransitionArray[Index].Update(Context, CurrentState, /*out*/ FinishedTransitions[Index]);
}

The Update call can change the size of ActiveTransitionArray, but FinishedTransitions is not updated accordingly. As a result, the next loop causes an out-of-bounds access on FinishedTransitions.

This crash did not happen before CL37755307, [Link Removed].

The temporary workaround is to backout CL37755307.

1. Create an Animation Blueprint with a State Machine.
2. Bind a function to the OutputAnimationPose.OnUpdate event of a state.
3. Inside that function, call UAnimationStateMachineLibrary::SetState.

You can download the repro project then open ABP_Unarmed asset.

> [インライン フレーム] UnrealEditor-Engine.dll!TArray<bool,TSizedInlineAllocator<4,32,TSizedDefaultAllocator<32>>>::RangeCheck(int) 行 1067 C++
[インライン フレーム] UnrealEditor-Engine.dll!TArray<bool,TSizedInlineAllocator<4,32,TSizedDefaultAllocator<32>>>::operator[](int) 行 1145 C++
UnrealEditor-Engine.dll!FAnimNode_StateMachine::Update_AnyThread(const FAnimationUpdateContext & Context) 行 508 C++
UnrealEditor-Engine.dll!FPoseLinkBase::Update(const FAnimationUpdateContext & InContext) 行 343 C++
UnrealEditor-Engine.dll!FAnimNode_SaveCachedPose::PostGraphUpdate() 行 201 C++
UnrealEditor-Engine.dll!FAnimInstanceProxy::UpdateAnimationNode_WithRoot(const FAnimationUpdateContext & InContext, FAnimNode_Base * InRootNode, FName InLayerName) 行 150 C++
UnrealEditor-Engine.dll!FAnimInstanceProxy::UpdateAnimationNode(const FAnimationUpdateContext & InContext) 行 124 C++
UnrealEditor-Engine.dll!FAnimInstanceProxy::UpdateAnimation_WithRoot(const FAnimationUpdateContext & InContext, FAnimNode_Base * InRootNode, FName InLayerName) 行 1370 C++
UnrealEditor-Engine.dll!FAnimInstanceProxy::UpdateAnimation() 行 1241 C++
UnrealEditor-Engine.dll!UAnimInstance::ParallelUpdateAnimation() 行 831 C++
UnrealEditor-Engine.dll!UAnimInstance::UpdateAnimation(float DeltaSeconds, bool bNeedsValidRootMotion, UAnimInstance::EUpdateAnimationFlag UpdateFlag) 行 669 C++
UnrealEditor-Engine.dll!USkeletalMeshComponent::TickAnimInstances(float DeltaTime, bool bNeedsValidRootMotion) 行 1732 C++
UnrealEditor-Engine.dll!USkeletalMeshComponent::TickAnimation(float DeltaTime, bool bNeedsValidRootMotion) 行 1686 C++
UnrealEditor-Engine.dll!USkeletalMeshComponent::TickPose(float DeltaTime, bool bNeedsValidRootMotion) 行 1884 C++
UnrealEditor-Engine.dll!USkinnedMeshComponent::TickComponent(float DeltaTime, ELevelTick TickType, FActorComponentTickFunction * ThisTickFunction) 行 1671 C++
UnrealEditor-Engine.dll!USkeletalMeshComponent::TickComponent(float DeltaTime, ELevelTick TickType, FActorComponentTickFunction * ThisTickFunction) 行 1992 C++
UnrealEditor-UnrealEd.dll!UDebugSkelMeshComponent::TickComponent(float DeltaTime, ELevelTick TickType, FActorComponentTickFunction * ThisTickFunction) 行 1284 C++
[インライン フレーム] UnrealEditor-Engine.dll!FActorComponentTickFunction::ExecuteTick::__l2::<lambda_1>::operator()(float) 行 1591 C++
UnrealEditor-Engine.dll!??$ExecuteTickHelper@V<lambda_1>@?1??ExecuteTick@FActorComponentTickFunction@@UEAAXMW4ELevelTick@@W4Type@ENamedThreads@@AEBV?$TRefCountPtr@VFBaseGraphTask@@@@@Z@@FActorComponentTickFunction@@SAXPEAVUActorComponent@@NMW4ELevelTick@@AEBV<lambda_1>@?1??ExecuteTick@0@UEAAXM2W4Type@ENamedThreads@@AEBV?$TRefCountPtr@VFBaseGraphTask@@@@@Z@@Z(UActorComponent * Target, bool bTickInEditor, float DeltaTime, ELevelTick TickType, const FActorComponentTickFunction::ExecuteTick::_l2::<lambda_1> & ExecuteTickFunc) 行 4835 C++
UnrealEditor-Engine.dll!FActorComponentTickFunction::ExecuteTick(float DeltaTime, ELevelTick TickType, ENamedThreads::Type CurrentThread, const TRefCountPtr<FBaseGraphTask> & MyCompletionGraphEvent) 行 1589 C++
[インライン フレーム] UnrealEditor-Engine.dll!FTickFunctionTask::DoTask(ENamedThreads::Type CurrentThread, const TRefCountPtr<FBaseGraphTask> &) 行 329 C++
UnrealEditor-Engine.dll!TGraphTask<FTickFunctionTask>::ExecuteTask() 行 706 C++
UnrealEditor-Core.dll!UE::Tasks::Private::FTaskBase::TryExecuteTask() 行 527 C++
[インライン フレーム] UnrealEditor-Core.dll!FBaseGraphTask::Execute(TArray<FBaseGraphTask *,TSizedDefaultAllocator<32>> &) 行 505 C++
UnrealEditor-Core.dll!FNamedTaskThread::ProcessTasksNamedThread(int QueueIndex, bool bAllowStall) 行 779 C++
UnrealEditor-Core.dll!FNamedTaskThread::ProcessTasksUntilIdle(int QueueIndex) 行 679 C++
[インライン フレーム] UnrealEditor-Core.dll!FTaskGraphCompatibilityImplementation::ProcessThreadUntilIdle(ENamedThreads::Type) 行 1419 C++
UnrealEditor-Core.dll!FTaskGraphCompatibilityImplementation::ProcessUntilTasksComplete(const TArray<TRefCountPtr<FBaseGraphTask>,TSizedInlineAllocator<4,32,TSizedDefaultAllocator<32>>> & Tasks, ENamedThreads::Type CurrentThreadIfKnown, const TFunction<enum FTaskGraphInterface::EProcessTasksOperation __cdecl(int)> & IdleWorkUpdate) 行 1592 C++
UnrealEditor-Engine.dll!FTickTaskSequencer::ReleaseTickGroup(ETickingGroup WorldTickGroup, bool bBlockTillComplete, TArray<FTickFunction *,TSizedDefaultAllocator<32>> & TicksToManualDispatch) 行 986 C++
UnrealEditor-Engine.dll!FTickTaskManager::RunTickGroup(ETickingGroup Group, bool bBlockTillComplete) 行 2079 C++
UnrealEditor-Engine.dll!UWorld::RunTickGroup(ETickingGroup Group, bool bBlockTillComplete) 行 786 C++
UnrealEditor-Engine.dll!UWorld::Tick(ELevelTick TickType, float DeltaSeconds) 行 1511 C++
UnrealEditor-Persona.dll!FAnimationEditorPreviewScene::Tick(float InDeltaTime) 行 1296 C++
[インライン フレーム] UnrealEditor-UnrealEd.dll!FTickableEditorObject::TickObjects::__l2::<lambda_1>::operator()(FTickableObjectBase * TickableObject) 行 33 C++
[インライン フレーム] UnrealEditor-UnrealEd.dll!Invoke(FTickableEditorObject::TickObjects::__l2::<lambda_1> &) 行 47 C++
UnrealEditor-UnrealEd.dll!?Call@?$TFunctionRefCaller@V<lambda_1>@?1??TickObjects@FTickableEditorObject@@SAXM@Z@XPEAVFTickableObjectBase@@@Function@Private@Core@UE@@SAXPEAXAEAPEAVFTickableObjectBase@@@Z(void * Obj, FTickableObjectBase * & <Params_0>) 行 316 C++
[インライン フレーム] UnrealEditor-Engine.dll!UE::Core::Private::Function::TFunctionRefBase<UE::Core::Private::Function::FFunctionRefStoragePolicy,void __cdecl(FTickableObjectBase *)>::operator()(FTickableObjectBase * <Params_0>) 行 471 C++
UnrealEditor-Engine.dll!FTickableObjectBase::SimpleTickObjects(FTickableObjectBase::FTickableStatics & Statics, TFunctionRef<void __cdecl(FTickableObjectBase *)> TickFunc) 行 112 C++
[インライン フレーム] UnrealEditor-UnrealEd.dll!FTickableEditorObject::TickObjects(const float) 行 30 C++
UnrealEditor-UnrealEd.dll!UEditorEngine::Tick(float DeltaSeconds, bool bIdleMode) 行 1909 C++
UnrealEditor-UnrealEd.dll!UUnrealEdEngine::Tick(float DeltaSeconds, bool bIdleMode) 行 533 C++
UnrealEditor.exe!FEngineLoop::Tick() 行 5625 C++
[インライン フレーム] UnrealEditor.exe!EngineTick() 行 60 C++
UnrealEditor.exe!GuardedMain(const wchar_t * CmdLine) 行 187 C++
UnrealEditor.exe!LaunchWindowsStartup(HINSTANCE__ * hInInstance, HINSTANCE__ * hPrevInstance, char * __formal, int nCmdShow, const wchar_t * CmdLine) 行 271 C++
UnrealEditor.exe!WinMain(HINSTANCE__ * hInInstance, HINSTANCE__ * hPrevInstance, char * pCmdLine, int nCmdShow) 行 339 C++
[外部コード]