Musescore 3.7 crash opening xml files

[zorba77]

XML.zip

Musescore 3.7 crash opening these xml files converted by newzik.com. They contains errors, but MS 3.6 and 4.X open them without problems.

[Jojo-Schmitz]

Will check, after vacation

[Jojo-Schmitz]

For some stupid reason I can't get the debugger to run on this, there was a QtCreator update today, I guess that broke something

[Jojo-Schmitz]

Closed via #570

[zorba77]

Sorry, but on Linux the latest version of MS 3.7 crashes importing both files attached to this thread

[zorba77]

How can I help you to understand the problem?

[Jojo-Schmitz]

A QtCreator/MinGW build still crashes too, which sort of matches as that is using gcc too, rather than MSVC

Can you provide a stack trace?

[zorba77]

This? backtrace.log

[Jojo-Schmitz]

Closed via #571

[zorba77]

Now I can open both files, but MS 3.7 crashes when I quit the tab with the imported XML. Step:

1. open MS 3.7
2. Import one of the two XML attached
3. click on the "X" to quit the tab
4. MS 3.7 crashes

[Jojo-Schmitz]

Damn...

[zorba77]

backtrace.log

[Jojo-Schmitz]

But yes, I believe to have seen that

0x0000555556359cce in Ms::Score::~Score (this=0x55555b3c6bd0, __in_chrg=<optimized out>) at /var/mscore3.7/MuseScore-3.x-120824/libmscore/score.cpp:336
336             delete it->second;

myself once, but then couldn't reproduce anymore. I guess there it tries to delete (free memory) something it had deleted already.

[Jojo-Schmitz]

Actually not the same, but a similar one:

ScoreElement::~ScoreElement()
      {
      if (_links) {
            _links->removeOne(this);
            if (_links->empty()) {
                  delete _links;
                  _links = 0;
                  }
            }
      delete[] _propertyFlagsList;      // <<<<<<<<<<< crash
      }

[Jojo-Schmitz]

That crash can get fixed by setting _propertyFlagsList to nullptr after the delete[], but then it does crash at the place you reported,

      for (auto it = _spanner.cbegin(); it != _spanner.cend(); ++it)
            delete it->second;
      _spanner.clear();

and there it->second can't get set to 0, being a const :-(

[Jojo-Schmitz]

Might be entirely unrelated to your original XML issue, but rather a general issue with opening and closing more than one score, although I can't reproduce it with other scores

[worldwideweary]

Probably doesn't help, but my personal build doesn't have any crashes upon closing, but my particular build doesn't build on top of "Evolution" beyond about a year ago, so whatever the problem is is only about at most a year old... for what it's worth