I was having memory corruption after running FSkeletalMeshMerge::DoMerge on certain mesh combinations (caused TBBMalloc to crash on random new allocations) so i ran the engine with the stomp debug allocator, now it reliably crashes here:
else
{
Section.DuplicatedVerticesBuffer.DupVertData = MergeSectionInfo.Section->DuplicatedVerticesBuffer.DupVertData;
Section.DuplicatedVerticesBuffer.DupVertIndexData = MergeSectionInfo.Section->DuplicatedVerticesBuffer.DupVertIndexData;
uint8* VertData = Section.DuplicatedVerticesBuffer.DupVertData.GetDataPointer();
for (uint32 i = 0; i < MergeSectionInfo.Section->NumVertices; ++i)
{
*((uint32*)(VertData + i * sizeof(uint32))) += CurrentBaseVertexIndex - MergeSectionInfo.Section->BaseVertexIndex;
}
}
Section.DuplicatedVerticesBuffer.bHasOverlappingVertices = true;
the problem is the VertData write out of bounds, i is 356 because it goes from 0 to NumVertices (391) however the array size is only 354 (since thats the size of DupVertData).
There is some faulty logic here that determines that number of vertices, since DupVertIndexData is indeed sized 391, but DupVertData is not.