Crashes after destroying a skeletal mesh attached via socket name (not bone name), the destroyed mesh remains welded.

On welding physics bodies during primitive component attachment, UPrimitiveComponent::WeldToImplementation() calls GetRootWelded() and then GetBodyInstance() on the returned root. This searches by bone name, but returns nullptr when using a socket name on a skeletal mesh. It then does special treatment to find the correct FBodyInstance in that case, which can be found in [PrimitiveComponentPhysics.cpp] by searching the code for the comment "//If initial lookup fails, check if we need to lookup the bone from the socket instead".

On the other hand, when unwelding, UPrimitiveComponent::UnWeldFromParent() does not handle the special case of an attachment using a socket name on a skeletal mesh, doing directly "if (FBodyInstance* RootBI = RootComponent->GetBodyInstance(SocketName, false))", which returns false in that case. As a result, the unweld is not performed. If the unwelding was triggered by the destruction of the welded component, for example, an invalid reference to it will remain. After garbage collection takes place, any attempts to use the destroyed component will cause a crash.

One example where this has been verified is when performing a trace that hits the previously-welded-and-now-destroyed component. Before garbage collection, the trace returns an invalid hit object without crashing. After garbage collection, function SetHitResultFromShapeAndFaceIndex() on file [CollisionConversions.cpp] crashes on line "OutResult.PhysicsObject = BodyInst->GetPhysicsActor() ? BodyInst->GetPhysicsActor()>GetPhysicsObject() : nullptr;", because BodyInst>GetPhysicsActor() returns a freed pointer.

The bug can be seen by stepping through the code on UPrimitiveComponent::WeldToImplementation() and UPrimitiveComponent::UnWeldFromParent() when acting on a skeletal mesh component attached to another by socket name (not bone name). UnWeldFromParent() will skip the unwelding code in this situation.

No consistently reliable repro steps for a crash have been found so far, but crashes have been observed when destroying the attached-and-welded component, then forcing garbage collection to run, and then running traces that hit the now-destroyed-but-still-welded component.

Exception thrown: read access violation.
FBodyInstance::GetPhysicsActor(...) returned 0xFFFFFFFFFFFFFFAF.

UnrealEditor-Engine.dll!SetHitResultFromShapeAndFaceIndex(const Chaos::FPerShapeData & Shape, const Chaos::TGeometryParticle<double,3> & Actor, const unsigned int FaceIndex, const UE::Math::TVector<double> & HitLocation, FHitResult & OutResult, bool bReturnPhysMat) Line 160 C++
UnrealEditor-Engine.dll!ConvertQueryImpactHitImp<ChaosInterface::FLocationHit>(const UWorld * World, const ChaosInterface::FLocationHit & Hit, FHitResult & OutResult, float CheckLength, const FCollisionFilterData & QueryFilter, const UE::Math::TVector<double> & StartLoc, const UE::Math::TVector<double> & EndLoc, const Chaos::FImplicitObject * Geom, const UE::Math::TTransform<double> & QueryTM, bool bReturnFaceIndex, bool bReturnPhysMat) Line 412 C++
UnrealEditor-Engine.dll!ConvertQueryImpactHit(const UWorld *) Line 462 C++
UnrealEditor-Engine.dll!ConvertTraceResults<ChaosInterface::FSweepHit>(bool & OutHasValidBlockingHit, const UWorld * World, int NumHits, ChaosInterface::FSweepHit * Hits, float CheckLength, const FCollisionFilterData & QueryFilter, TArray<FHitResult,TSizedDefaultAllocator<32>> & OutHits, const UE::Math::TVector<double> & StartLoc, const UE::Math::TVector<double> & EndLoc, const Chaos::FImplicitObject * Geom, const UE::Math::TTransform<double> & QueryTM, float MaxDistance, bool bReturnFaceIndex, bool bReturnPhysMat) Line 491 C++
UnrealEditor-Engine.dll!TSceneCastCommonImpWithRetryRequest<TSQTraits<ChaosInterface::FSweepHit,1,1>,FGeomSQAdditionalInputs,FDefaultAccelContainer>(const UWorld * World, TArray<FHitResult,TSizedDefaultAllocator<32>> & OutHits, const FGeomSQAdditionalInputs & GeomInputs, const UE::Math::TVector<double> Start, const UE::Math::TVector<double> End, ECollisionChannel TraceChannel, const FCollisionQueryParams & Params, const FCollisionResponseParams & ResponseParams, const FCollisionObjectQueryParams & ObjectParams, const FDefaultAccelContainer & AccelContainer, bool & bOutRequestRetry, FCollisionQueryParams & OutRetryParams) Line 566 C++
UnrealEditor-Engine.dll!TSceneCastCommonImp<TSQTraits<ChaosInterface::FSweepHit,1,1>,FGeomSQAdditionalInputs,FDefaultAccelContainer>(const UWorld * World, TArray<FHitResult,TSizedDefaultAllocator<32>> & OutHits, const FGeomSQAdditionalInputs & GeomInputs, const UE::Math::TVector<double> Start, const UE::Math::TVector<double> End, ECollisionChannel TraceChannel, const FCollisionQueryParams & Params, const FCollisionResponseParams & ResponseParams, const FCollisionObjectQueryParams & ObjectParams, const FDefaultAccelContainer & AccelContainer) Line 742 C++
UnrealEditor-Engine.dll!TraceCommonImp(const Chaos::EThreadQueryContext) Line 771 C++
UnrealEditor-Engine.dll!TraceCommonImp<1,1,FGeomSQAdditionalInputs,TArray<FHitResult,TSizedDefaultAllocator<32>>,FDefaultAccelContainer>(const Chaos::EThreadQueryContext ThreadContext, const UWorld * World, TArray<FHitResult,TSizedDefaultAllocator<32>> & OutHits, const FGeomSQAdditionalInputs & GeomInputs, const UE::Math::TVector<double> Start, const UE::Math::TVector<double> End, ECollisionChannel TraceChannel, const FCollisionQueryParams & Params, const FCollisionResponseParams & ResponseParams, const FCollisionObjectQueryParams & ObjectParams, const FDefaultAccelContainer & AccelContainer) Line 792 C++
UnrealEditor-Engine.dll!TSceneCastCommon<1,1,TArray<FHitResult,TSizedDefaultAllocator<32>>,FGeomSQAdditionalInputs,FDefaultAccelContainer>(const UWorld * World, TArray<FHitResult,TSizedDefaultAllocator<32>> & OutHits, const FGeomSQAdditionalInputs & GeomInputs, const UE::Math::TVector<double> Start, const UE::Math::TVector<double> End, ECollisionChannel TraceChannel, const FCollisionQueryParams & Params, const FCollisionResponseParams & ResponseParams, const FCollisionObjectQueryParams & ObjectParams, const FDefaultAccelContainer & AccelContainer) Line 885 C++
UnrealEditor-Engine.dll!FGenericPhysicsInterface::GeomSweepMulti<FCollisionShape>(const UWorld * World, const FCollisionShape & InGeom, const UE::Math::TQuat<double> & InGeomRot, TArray<FHitResult,TSizedDefaultAllocator<32>> & OutHits, UE::Math::TVector<double> Start, UE::Math::TVector<double> End, ECollisionChannel TraceChannel, const FCollisionQueryParams & Params, const FCollisionResponseParams & ResponseParams, const FCollisionObjectQueryParams & ObjectParams) Line 1066 C++
UnrealEditor-Engine.dll!UWorld::SweepMultiByObjectType(TArray<FHitResult,TSizedDefaultAllocator<32>> & OutHits, const UE::Math::TVector<double> & Start, const UE::Math::TVector<double> & End, const UE::Math::TQuat<double> & Rot, const FCollisionObjectQueryParams & ObjectQueryParams, const FCollisionShape & CollisionShape, const FCollisionQueryParams & Params) Line 263 C++
UnrealEditor-Engine.dll!UKismetSystemLibrary::SphereTraceMultiForObjects(const UObject * WorldContextObject, const UE::Math::TVector<double> Start, const UE::Math::TVector<double> End, float Radius, const TArray<TEnumAsByte<enum EObjectTypeQuery>,TSizedDefaultAllocator<32>> & ObjectTypes, bool bTraceComplex, const TArray<AActor *,TSizedDefaultAllocator<32>> & ActorsToIgnore, EDrawDebugTrace::Type DrawDebugType, TArray<FHitResult,TSizedDefaultAllocator<32>> & OutHits, bool bIgnoreSelf, FLinearColor TraceColor, FLinearColor TraceHitColor, float DrawTime) Line 2094 C++
UnrealEditor-Engine.dll!UKismetSystemLibrary::execSphereTraceMultiForObjects(UObject * Context, FFrame & Stack, void * const Z_Param__Result) Line 19715 C++
UnrealEditor-CoreUObject.dll!UObject::execCallMathFunction(UObject * Context, FFrame & Stack, void * const Z_Param__Result) Line 1106 C++
UnrealEditor-CoreUObject.dll!FFrame::Step(UObject *) Line 509 C++
UnrealEditor-CoreUObject.dll!UObject::execLetBool(UObject * Context, FFrame & Stack, void * const Z_Param__Result) Line 3044 C++
[Blueprint] Map_<Error reading characters of string.>::ExecuteUbergraph_Map_<Error reading characters of string.> Blueprint
UnrealEditor-CoreUObject.dll!FFrame::Step(UObject *) Line 509 C++
UnrealEditor-CoreUObject.dll!ProcessLocalScriptFunction(UObject * Context, FFrame & Stack, void * const Z_Param__Result) Line 1242 C++
UnrealEditor-CoreUObject.dll!ProcessScriptFunction<void (_cdecl*)(UObject *,FFrame &,void *)>(UObject * Context, UFunction * Function, FFrame & Stack, void * const Z_Param_Result, void[Image Removed](UObject *, FFrame &, void *) ExecFtor) Line 1070 C++
UnrealEditor-CoreUObject.dll!ProcessLocalFunction::__l2::<lambda_1>::operator()() Line 1320 C++
UnrealEditor-CoreUObject.dll!ProcessLocalFunction(UObject * Context, UFunction * Fn, FFrame & Stack, void * const Z_Param__Result) Line 1339 C++
[Blueprint] Map_<Error reading characters of string.>::ReceiveTick Blueprint
UnrealEditor-CoreUObject.dll!FFrame::Step(UObject *) Line 509 C++
UnrealEditor-CoreUObject.dll!ProcessLocalScriptFunction(UObject * Context, FFrame & Stack, void * const Z_Param__Result) Line 1242 C++
UnrealEditor-CoreUObject.dll!UObject::ProcessInternal(UObject * Context, FFrame & Stack, void * const Z_Param__Result) Line 1371 C++
UnrealEditor-CoreUObject.dll!UFunction::Invoke(UObject * Obj, FFrame & Stack, void * const Z_Param__Result) Line 7453 C++
UnrealEditor-CoreUObject.dll!UObject::ProcessEvent(UFunction * Function, void * Parms) Line 2211 C++
UnrealEditor-Engine.dll!AActor::ProcessEvent(UFunction * Function, void * Parameters) Line 1456 C++
UnrealEditor-Engine.dll!AActor::ReceiveTick(float) Line 8265 C++
UnrealEditor-Engine.dll!AActor::Tick(float DeltaSeconds) Line 1957 C++
UnrealEditor-Engine.dll!AActor::TickActor(float DeltaSeconds, ELevelTick TickType, FActorTickFunction & ThisTickFunction) Line 1940 C++
UnrealEditor-Engine.dll!FActorTickFunction::ExecuteTick(float DeltaTime, ELevelTick TickType, ENamedThreads::Type CurrentThread, const TRefCountPtr<FBaseGraphTask> & MyCompletionGraphEvent) Line 372 C++
UnrealEditor-Engine.dll!FTickFunctionTask::DoTask(ENamedThreads::Type CurrentThread, const TRefCountPtr<FBaseGraphTask> &) Line 329 C++
UnrealEditor-Engine.dll!TGraphTask<FTickFunctionTask>::ExecuteTask() Line 706 C++
UnrealEditor-Core.dll!UE::Tasks::Private::FTaskBase::TryExecuteTask() Line 527 C++
UnrealEditor-Core.dll!FBaseGraphTask::Execute(TArray<FBaseGraphTask *,TSizedDefaultAllocator<32>> &) Line 505 C++
UnrealEditor-Core.dll!FNamedTaskThread::ProcessTasksNamedThread(int QueueIndex, bool bAllowStall) Line 779 C++
UnrealEditor-Core.dll!FNamedTaskThread::ProcessTasksUntilIdle(int QueueIndex) Line 679 C++
UnrealEditor-Core.dll!FTaskGraphCompatibilityImplementation::ProcessThreadUntilIdle(ENamedThreads::Type) Line 1419 C++
UnrealEditor-Core.dll!FTaskGraphCompatibilityImplementation::ProcessUntilTasksComplete(const TArray<TRefCountPtr<FBaseGraphTask>,TSizedInlineAllocator<4,32,TSizedDefaultAllocator<32>>> & Tasks, ENamedThreads::Type CurrentThreadIfKnown, const TFunction<enum FTaskGraphInterface::EProcessTasksOperation __cdecl(int)> & IdleWorkUpdate) Line 1592 C++
UnrealEditor-Engine.dll!FTickTaskSequencer::ReleaseTickGroup(ETickingGroup WorldTickGroup, bool bBlockTillComplete, TArray<FTickFunction *,TSizedDefaultAllocator<32>> & TicksToManualDispatch) Line 986 C++
UnrealEditor-Engine.dll!FTickTaskManager::RunTickGroup(ETickingGroup Group, bool bBlockTillComplete) Line 2079 C++
UnrealEditor-Engine.dll!UWorld::RunTickGroup(ETickingGroup Group, bool bBlockTillComplete) Line 786 C++
UnrealEditor-Engine.dll!UWorld::Tick(ELevelTick TickType, float DeltaSeconds) Line 1511 C++
UnrealEditor-UnrealEd.dll!UEditorEngine::Tick(float DeltaSeconds, bool bIdleMode) Line 2151 C++
UnrealEditor-UnrealEd.dll!UUnrealEdEngine::Tick(float DeltaSeconds, bool bIdleMode) Line 533 C++
UnrealEditor.exe!FEngineLoop::Tick() Line 5625 C++
UnrealEditor.exe!EngineTick() Line 60 C++
UnrealEditor.exe!GuardedMain(const wchar_t * CmdLine) Line 187 C++
UnrealEditor.exe!LaunchWindowsStartup(HINSTANCE__ * hInInstance, HINSTANCE__ * hPrevInstance, char * __formal, int nCmdShow, const wchar_t * CmdLine) Line 271 C++
UnrealEditor.exe!WinMain(HINSTANCE__ * hInInstance, HINSTANCE__ * hPrevInstance, char * pCmdLine, int nCmdShow) Line 339 C++
[External Code]