Removing rests attached to slurs in a voice >1 causes a crash

• Jan 4, 2019 - 10:36
Reported version
3.0
Priority
P0 - Critical
Type
Functional
Frequency
Once
Severity
S2 - Critical
Reproducibility
Always
Status
closed
Regression
No
Workaround
Yes
Project
MuseScore

OS: Windows 7 SP 1 (6.1), Arch.: x86_64, MuseScore version (64-bit): 3.0.0.4839, revision: cf1f5ce

1) Default score
2) Enter two half notes Voice 2 with slur
3) Delete the two notes
4) Delete the two half rests

---> crash

  • Test file: slur rest.mscz
  • As expected, same result with voices 3 et 4

  • With the 2.3.2, the slur is deleted with the first half rest

    Video_2019-01-04_112010.gif

Comments

• Jan 4, 2019 - 11:22

stack trace:
1 Ms::ScoreElement::isChord scoreElement.h 261 0xfb1e60
2 Ms::Score::layoutSystemElements layout.cpp 3596 0x895a80
3 Ms::Score::collectSystem layout.cpp 3436 0x8945ad
4 Ms::Score::doLayoutRange layout.cpp 4192 0x8994f8
5 Ms::Score::update cmd.cpp 220 0x99dfdd
6 Ms::Score::endCmd cmd.cpp 178 0x99dce9
7 Ms::Score::cmd cmd.cpp 3694 0x9af414
8 Ms::ScoreView::cmd scoreview.cpp 2312 0x423d25
9 Ms::ScoreView::cmd scoreview.cpp 1760 0x42059d
10 Ms::MuseScore::cmd musescore.cpp 6085 0x4d4f38
11 Ms::MuseScore::cmd musescore.cpp 5577 0x4d1e94
12 Ms::MuseScore::qt_static_metacall moc_musescore.cpp 850 0x76693f
13 QMetaObject::activate(QObject *, int, int, void * *) 0x68a929ea
14 Ms::ScoreTab::actionTriggered moc_scoretab.cpp 225 0x770596
15 Ms::ScoreTab::qt_static_metacall moc_scoretab.cpp 110 0x77001e
16 QMetaObject::activate(QObject *, int, int, void * *) 0x68a929ea
17 QActionGroup::hovered(QAction *) 0x25294db2
18 QActionGroup::qt_static_metacall(QObject *, QMetaObject::Call, int, void * *) 0x2529573c
19 QMetaObject::activate(QObject *, int, int, void * *) 0x68a929ea
20 QAction::activate(QAction::ActionEvent) 0x25293e0e
...

Reply

• Jan 4, 2019 - 11:24 
      for (auto s : spanner) {
            Slur* slur = toSlur(s);
            ChordRest* scr = s->startCR();
            ChordRest* ecr = s->endCR();
            if (scr->isChord())   ///<<<<< crashes here, scr being 0
                  toChord(scr)->layoutArticulations3(slur); 
            if (ecr->isChord())
                  toChord(ecr)->layoutArticulations3(slur);
            }

Reply

• Jan 4, 2019 - 11:33

Changing the code mentioned above to

      for (auto s : spanner) {
            Slur* slur = toSlur(s);
            ChordRest* scr = s->startCR();
            ChordRest* ecr = s->endCR();
            if (scr && scr->isChord())
                  toChord(scr)->layoutArticulations3(slur);
            if (ecr && ecr->isChord())
                  toChord(ecr)->layoutArticulations3(slur);
            }

i.e. check for scr (and ecr) to not be 0 prior to dereferencing them fixes the crash, but leaves the orphaned slur, so cures the symptom but not the cause.
Not sure whether we want both fixes.

Reply

• Jan 8, 2019 - 01:30
Status PR created ⇒ fixed

Fixed in branch master, commit 6ee14ff890

fix #281175: Removing rests attached to slurs in a voice >1 causes a crash

fixes the symtom, the crash, and the cause, the orphaned slur,
which gets removed now.

Reply

Fix version
3.0.1