Description

The unpossessd controller will not be removed from UWorld::ControllerList unless destroyed. This causes null access to the ControllerList when GC occurs during seamless travel execution. The unpossessed controller belonging to sublevel is the target. The way to avoid this is to intentionally destroy before seamless travel, or following code.

FSeamlessTravelHandler::Tick
・Before

             for( FConstControllerIterator Iterator = CurrentWorld->GetControllerIterator(); Iterator; ++Iterator )
             {
                 AController* Player = Iterator->Get();
                 if (Player->PlayerState || Cast<APlayerController>(Player) != nullptr)
                 {
                     KeepAnnotation.Set(Player);
                 }
             }

・After

             for( FConstPlayerControllerIterator Iterator = CurrentWorld->GetPlayerControllerIterator(); Iterator; ++Iterator )
             {
                 APlayerController* Player = Iterator->Get();
                 if (Player != nullptr)
                 {
                     KeepAnnotation.Set(Player);
                 }
             }

Steps to Reproduce

[Step]
1. player1 create session.
2. player2 joins the session.
3. Spawn AIPawn with Owner at sublevel.
4. SpawnDefaultController for Pawn.
5. Unpossess for Pawn.
6. player1 execute seamless travel.

Result:
Crash on server

expect:
Succeeded seamless travel

[Attached project repro step]
1. Packaging attached project.
2. Player1 input 1key (create session)
3. Player2 input 2key->3key (find session -> join session)
4. Before matching, player1 input 1key (server travel)

Callstack

・Server callstack

SeamlessTravel.exe!FSeamlessTravelHandler::Tick() Line 5655	C++
SeamlessTravel.exe!UEngine::TickWorldTravel(FWorldContext & Context, float DeltaSeconds) Line 11670	C++
SeamlessTravel.exe!UGameEngine::Tick(float DeltaSeconds, bool bIdleMode) Line 1354	C++
SeamlessTravel.exe!FEngineLoop::Tick() Line 3699	C++
[Inline Frame] SeamlessTravel.exe!EngineTick() Line 62	C++
SeamlessTravel.exe!GuardedMain(const wchar_t * CmdLine, HINSTANCE__ * hInInstance, HINSTANCE__ * hPrevInstance, int nCmdShow) Line 174	C++
SeamlessTravel.exe!WinMain(HINSTANCE__ * hInInstance, HINSTANCE__ * hPrevInstance, char * __formal, int nCmdShow) Line 262	C++
[External Code]	

Have Comments or More Details?

There's no existing public thread on this issue, so head over toAnswerHub just mention UE-71319 in the post.

0
Login to Vote

Fixed
ComponentGameplay
Affects Versions4.204.21
Target Fix4.22
Fix Commit5370448
Main Commit5370459
Release Commit5370448
CreatedMar 9, 2019
ResolvedMar 12, 2019
UpdatedMar 27, 2019