Enhanced Input: use-after-free in EvaluateInputComponentDelegates when a delegate forces a synchronous mapping rebuild

Context

UEnhancedPlayerInput::EvaluateInputComponentDelegates iterates the delegates that triggered this tick. For each one it resolves the action's state via FindActionInstanceData(DelegateAction): a raw pointer into the ActionInstanceData TMap. It then calls Delegate->Execute(*ActionData), which runs arbitrary user code, and continues to use ActionData after that call returns.

Problem

If the invoked user code adds or removes an input mapping context with FModifyContextOptions::bForceImmediately = true, RebuildControlMappings() runs synchronously, inside the delegate. It completes by calling InitializeMappingActionModifiers → FindOrAddActionEventData → ActionInstanceData.Emplace for each action in the incoming context. Growing the TMap reallocates its backing TSparseArray and relocates every element, so ActionData becomes a wild pointer even though the entry logically still exists.

On return from Execute there are two dereferences of that pointer:

• ActionData->TriggerEvent = OriginalEvent;
• GetPathNameSafe(ActionData->GetSourceAction()), ActionData->GetValue()

If ActionData got moved, these accesses are invalid and corrupt memory on write or access garbage on read.

Attached a repro project:

• Edit the included .bat file to point to local editor (5.8+)
• Use it to open editor with -stomp2malloc
• Start PIE in any map.
  • Default PlayerController will have key bindings set up
• Hold K to trigger the crash

New project repro:

1. Blank C++ project with Enhanced Input as the default player input / input component classes.
2. Create IA_Repro (digital) with a Hold trigger, threshold 0.2s. Create IMC_Repro mapping it to K. Create IMC_NextMode mapping ~6 otherwise-unused input actions to distinct keys.
3. In a PlayerController, bind IA_Repro on ETriggerEvent::Triggered. In the handler:
   FModifyContextOptions Options;
   Options.bForceImmediately = true;
   Subsystem->RemoveMappingContext(ReproContext, Options);
   Subsystem->AddMappingContext(NextContext, 0, Options);
4. Launch the editor with -stomp2malloc -MallocStomp2MinSize=64 -MallocStomp2MaxSize=4096 to catch memory stomps instead of silently corrupting
5. PIE, hold K.