Out-of-Bounds Access During Partial Updates of ISMC Per-Instance Custom Data

When using instance custom data values, removing an instance and changing the number of custom data floats in sequence can cause an array-out-of-bounds crash.

The underlying arrays are not resized to the new size before copying entries to handle the removed instance, but the new number of floats per instance is used, leading to the copy being off the end of the array.

1. Download the Licensee's test project (see addl info URL)
2. Open with the debugger attached
3. Enter PIE
4. Hit the "0" key
5. Observe the crash

> [Inline Frame] UnrealEditor-Engine.dll!TArray<float,TSizedDefaultAllocator<32>>::RangeCheck(int) Line 1095 C++
[Inline Frame] UnrealEditor-Engine.dll!TArray<float,TSizedDefaultAllocator<32>>::operator[](int Index) Line 1173 C++
UnrealEditor-Engine.dll!CondMove<float>(bool bCondition, TArray<float,TSizedDefaultAllocator<32>> & Data, int FromIndex, int ToIndex, int NumElements) Line 124 C++
UnrealEditor-Engine.dll!FISMCInstanceDataSceneProxy::Update(FISMInstanceUpdateChangeSet && ChangeSet) Line 366 C++
[Inline Frame] UnrealEditor-Engine.dll!FPrimitiveInstanceDataManager::FlushChanges::__l147::<lambda_4>::operator()() Line 702 C++
UnrealEditor-Engine.dll!DispatchInstanceDataUpdateTask::__l2::<lambda_1>::operator()() Line 386 C++
[Inline Frame] UnrealEditor-Engine.dll!Invoke(DispatchInstanceDataUpdateTask::__l2::<lambda_1> &) Line 47 C++
UnrealEditor-Engine.dll!UE::Tasks::Private::TExecutableTaskBase<`DispatchInstanceDataUpdateTask<FISMCInstanceDataSceneProxy,`FPrimitiveInstanceDataManager::FlushChanges'::`147'::<lambda_4>>'::`2'::<lambda_1>,void,void>::ExecuteTask() Line 898 C++
UnrealEditor-Engine.dll!UE::Tasks::Private::FTaskBase::TryExecuteTask() Line 518 C++
[Inline Frame] UnrealEditor-Engine.dll!UE::Tasks::Private::FTaskBase::Init::__l2::<lambda_1>::operator()() Line 180 C++
[Inline Frame] UnrealEditor-Engine.dll!LowLevelTasks::FTask::Init::__l13::<lambda_1>::operator()(const bool) Line 499 C++
[Inline Frame] UnrealEditor-Engine.dll!Invoke(LowLevelTasks::FTask::Init::__l13::<lambda_1> &) Line 47 C++
[Inline Frame] UnrealEditor-Engine.dll!LowLevelTasks::TTaskDelegate<LowLevelTasks::FTask * __cdecl(bool),48>::TTaskDelegateImpl<`LowLevelTasks::FTask::Init<`UE::Tasks::Private::FTaskBase::Init'::`2'::<lambda_1>>'::`13'::<lambda_1>,0>::Call(void *) Line 162 C++
UnrealEditor-Engine.dll!LowLevelTasks::TTaskDelegate<LowLevelTasks::FTask * __cdecl(bool),48>::TTaskDelegateImpl<`LowLevelTasks::FTask::Init<`UE::Tasks::Private::FTaskBase::Init'::`2'::<lambda_1>>'::`13'::<lambda_1>,0>::CallAndMove(LowLevelTasks::TTaskDelegate<LowLevelTasks::FTask * __cdecl(bool),48> & Destination, void * InlineData, unsigned int DestInlineSize, bool <Params_0>) Line 171 C++
[Inline Frame] UnrealEditor-Core.dll!LowLevelTasks::TTaskDelegate<LowLevelTasks::FTask * __cdecl(bool),48>::CallAndMove(LowLevelTasks::TTaskDelegate<LowLevelTasks::FTask * __cdecl(bool),48> &) Line 309 C++
UnrealEditor-Core.dll!LowLevelTasks::FTask::ExecuteTask() Line 627 C++
UnrealEditor-Core.dll!LowLevelTasks::FScheduler::ExecuteTask(LowLevelTasks::FTask * InTask) Line 397 C++
[Inline Frame] UnrealEditor-Core.dll!LowLevelTasks::FScheduler::TryExecuteTaskFrom(LowLevelTasks::Private::FWaitEvent *) Line 698 C++
UnrealEditor-Core.dll!LowLevelTasks::FScheduler::WorkerLoop(LowLevelTasks::Private::FWaitEvent * WorkerEvent, LowLevelTasks::Private::TLocalQueueRegistry<1024,1024>::TLocalQueue * WorkerLocalQueue, unsigned int WaitCycles, bool bPermitBackgroundWork) Line 757 C++
[Inline Frame] UnrealEditor-Core.dll!LowLevelTasks::FScheduler::WorkerMain(LowLevelTasks::Private::FWaitEvent * WorkerEvent, LowLevelTasks::Private::TLocalQueueRegistry<1024,1024>::TLocalQueue * WorkerLocalQueue, unsigned int WaitCycles, bool) Line 816 C++
UnrealEditor-Core.dll!LowLevelTasks::FScheduler::CreateWorker::__l2::<lambda_1>::operator()() Line 220 C++
[Inline Frame] UnrealEditor-Core.dll!UE::Core::Private::Function::TFunctionRefBase<UE::Core::Private::Function::TFunctionStorage<1>,void __cdecl(void)>::operator()() Line 414 C++
UnrealEditor-Core.dll!FThreadImpl::Run() Line 69 C++
UnrealEditor-Core.dll!FRunnableThreadWin::Run() Line 159 C++
UnrealEditor-Core.dll!FRunnableThreadWin::GuardedRun() Line 71 C++
[External Code]