Editor or player crashes when using a deeply nested Particle System with a sub-emitter that has multiple references

Unity: Visual Effects

6.4.X

6000.4.0a3

6.3.X

6.0.X

6.2.X

Unity 6000.2 has reached its end of life and will not receive further updates. If you need additional fixes, please upgrade to a newer Unity version.

Steps to reproduce:

Import the attached package to the URP project
Open SubEmitterCrash Scene
Enable Particle System 7 GO
Observe the crash
Reopen the editor
Enable Particle System 7 it shouldn't crash now. If it crashes, reopen the editor again and and turn the camera away from particles before enabling Particle System 7
Enable Particle System 7
Save the scene
Build Player with Development Build flag on and run it with -debugallocator argument
Player crashes

Actual results: Editor and Player crashes

Expected results: Particle Systems are able to handle more complex scenarios and do not crash

Reproducible with versions: 6000.4.0a1

Not reproducible with versions:

Can’t test with versions:

Tested on (OS): macOS, Windows

Notes:

Expected particle count is wrong after UpdateModulesPreSimulationIncremental (Particle System 7)

toIndex is out of bounds after UpdateModulesPreSimulationIncremental (Particle System 7)

I set User Prevalence to 3 because this case isn't something users would often run into, but there are similar cases that could affect them more.
Callstacks of trunk and 6000.0.54f1 version are in the attachments