[Bug Report] Problems of ReferencePicker Crash and point to the same address of memory

[sol3breaker]

1. Editor will crash if using button to change some property but not set dirty.
   Here is an simplified example, I didn't test the example, but I got crash in my own classes.
   When using a button function to change value inside a class like UpdateEditorTitle(), it won't be able to Set Dirty properly. If I use the same way in a normal class, it won't cause any problem. But when using polymorphism, after I press the button, then press "+" in someList to add a new element, unity will crash. But if I change the value of someFloat, it will set dirty, then when pressing "+" in someList, it won't crash.

[SerializeReference,ReferencePicker(ParentType = typeof(BaseTestClass))]
[ReorderableList(Foldable = true)]
public List<BaseTestClass> testList = new List<BaseTestClass>();

[System.Serializable]
public class BaseTestClass
{

}

[System.Serializable]
public class ATestClass : BaseTestClass
{
            [ReorderableList(Foldable = true)]
            public List<SomeClass> someList = new List<SomeClass>();

             [ReorderableList(Foldable = true)]
            public List<ItemInfo> itemInfoList = new List<ItemInfo>();

             public float someFloat;
}

[System.Serializable]
public class SomeClass
{
           [ReorderableList(Foldable = true)]
           public List<string> stringList = new List<string>();
}

[System.Serializable]
public class ItemInfo
{

#if UNITY_EDITOR
        [EditorButton(nameof(UpdateEditorTitle))]
        public string editorTitle; //a title for displaying summary info in list, it display name and amount at same time

        public void UpdateEditorTitle()
        {
                editorTitle = Name + amount.ToString();
        }
#endif
        public string Name;
        public float amount;

}

Sometimes, for editorTitle, it will cause erros like
ObjectDisposedException: SerializedProperty m_merchantList.Array.data[2].stockRules.Array.data[0].goodsInfoList.Array.data[0].editorTitle has disappeared!
UnityEditor.SerializedProperty.get_propertyPath () (at <4b8f645257c94d1296f440a10c6f388e>:0)
Toolbox.Editor.PropertyUtility.GetPropertyFieldTree (UnityEditor.SerializedProperty property, System.Boolean ignoreArrayElements) (at Assets/Editor Toolbox/Editor/Utilities/PropertyUtility.cs:745) .........

And
ArgumentException: Getting control 2's position in a group with only 2 controls when doing repaint
Aborting
UnityEngine.GUILayoutGroup.GetNext () (at <738dfc017b6f49678c748c0a004fcafe>:0)
UnityEngine.GUILayoutUtility.DoGetRect (UnityEngine.GUIContent content, UnityEngine.GUIStyle style, UnityEngine.GUILayoutOption[] options) (at <738dfc017b6f49678c748c0a004fcafe>:0)
UnityEngine.GUILayoutUtility.GetRect (UnityEngine.GUIContent content, UnityEngine.GUIStyle style, UnityEngine.GUILayoutOption[] options) (at <738dfc017b6f49678c748c0a004fcafe>:0)
UnityEngine.GUILayout.DoButton (UnityEngine.GUIContent content, UnityEngine.GUIStyle style, UnityEngine.GUILayoutOption[] options) (at <738dfc017b6f49678c748c0a004fcafe>:0)
UnityEngine.GUILayout.Button (UnityEngine.GUIContent content, UnityEngine.GUIStyle style, UnityEngine.GUILayoutOption[] options) (at <738dfc017b6f49678c748c0a004fcafe>:0)
Toolbox.Editor.Drawers.EditorButtonAttributeDrawer.DrawButton (UnityEngine.EditorButtonAttribute attribute) (at Assets/Editor Toolbox/Editor/Drawers/Toolbox/Decorator/EditorButtonAttributeDrawer.cs:29).....

2. Another Problem is about memory sharing. If I press "+" in infoList, it will duplicate a copy of ExampleInfo which is very usual. But for BaseExample, when I used AExample, the new copy of ExampleInfo will not be deeply copied, if I changed value in m_optionData, the previous one will share the same result. This even happend when I restarted the editor. So I have to set the new element to BaseExample then switch back to AExample, or use an editorButton to add new BaseExample() to the list.

[ReorderableList(Foldable = true)]
public List<ExampleInfo> infoList = new List<ExampleInfo>();

[System.Serializable]
public class ExampleInfo
{
           [SerializeReference,ReferencePicker(ParentType = typeof(BaseExample))]
           public BaseExample> example = new BaseExample();
}

[System.Serializable]
public class BaseExample
{
          
}

[System.Serializable]
public class AExample : BaseExample
{
                [ReorderableList(Foldable = true)]
		[SerializeField]
		private List<TMP_Dropdown.OptionData> m_optionData = new List<TMP_Dropdown.OptionData>();
		public List<TMP_Dropdown.OptionData> optionData
		{
			get => m_optionData;
			set => m_optionData = value;
		}
}

[arimger]

Hi!

1. I'm not sure if I entirely understand the issue. I made a setup using the code examples, but everything was working fine. Could you double-check if this the proper use-case that should I test?
2. Thanks, I already fixed it in develop, fix will be available in the next update.

[sol3breaker]

TestBug.zip

I forget to say it happens in scriptableObject, here is the example.

[arimger]

Ok, got it and I think I managed to fix it, thanks.

[sol3breaker]

TestBug.zip

I had meet new error, I don't know if they are related. When switching class, if a property had editorbutton, it will easily lose.