&subdiv_ccg and node span in fill_mask_grids becomes invalid after `BKE_sculpt_mask_layers_ensure` call (`sculpt->subdiv_ccg` pointer updated in `BKE_scene_graph_evaluated_ensure`). To avoid this, move multires reference and GridNode array after that function. Pull Request: https://projects.blender.org/blender/blender/pulls/130014