==1731== ERROR: AddressSanitizer: heap-use-after-free on address 0x60220038e400 at pc 0x913f57 bp 0x7fff5e4be3e0 sp 0x7fff5e4be3d8 READ of size 8 at 0x60220038e400 thread T0 #0 0x913f56 in Ms::Element::score() const /home/antonio/MuseScore/libmscore/element.h:326 #1 0x1275c37 in Ms::AddElement::undo() /home/antonio/MuseScore/libmscore/undo.cpp:1258 #2 0x126cdd4 in Ms::UndoCommand::undo() /home/antonio/MuseScore/libmscore/undo.cpp:127 #3 0x126db5a in Ms::UndoStack::undo() /home/antonio/MuseScore/libmscore/undo.cpp:295 #4 0xab29b8 in Ms::MuseScore::undo() /home/antonio/MuseScore/mscore/musescore.cpp:2910 #5 0xabc42d in Ms::MuseScore::cmd(QAction*, QString const&) /home/antonio/MuseScore/mscore/musescore.cpp:4008 #6 0xabb069 in Ms::MuseScore::cmd(QAction*) /home/antonio/MuseScore/mscore/musescore.cpp:3860 #7 0x8a7789 in Ms::MuseScore::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) /home/antonio/MuseScore/build.debug/mscore/moc_musescore.cpp:813 #8 0x7ffda16a4260 in ?? ??:0 #9 0x7ffd9f8b24ce in ?? ??:0 #10 0x7ffd9f8b2ca8 in ?? ??:0 #11 0x7ffda16a4260 in ?? ??:0 #12 0x7ffd9f8aeba1 in ?? ??:0 #13 0x7ffd9f8b09d6 in ?? ??:0 #14 0x7ffd9f8b0cce in ?? ??:0 #15 0x7ffd9f8b9b53 in ?? ??:0 #16 0x7ffd9f8bcfe5 in ?? ??:0 #17 0x7ffda167cdd3 in ?? ??:0 #18 0x7ffda0ec7e90 in ?? ??:0 #19 0x7ffda0ec8d89 in ?? ??:0 #20 0x7ffd9f8bcf87 in ?? ??:0 #21 0x7ffda167cdd3 in ?? ??:0 #22 0x7ffda0e9d713 in ?? ??:0 #23 0x7ffda0ea692c in ?? ??:0 #24 0x7ffda0e8fa97 in ?? ??:0 #25 0x7ffd9271f93f in ?? ??:0 #26 0x7ffd998d2d52 in ?? ??:0 #27 0x7ffd998d309f in ?? ??:0 #28 0x7ffd998d3163 in ?? ??:0 #29 0x7ffda16c7313 in ?? ??:0 #30 0x7ffda167bb6a in ?? ??:0 #31 0x7ffda167fbbd in ?? ??:0 #32 0xac3c83 in main /home/antonio/MuseScore/mscore/musescore.cpp:4933 #33 0x7ffd9b29676c in __libc_start_main /build/buildd/eglibc-2.15/csu/libc-start.c:226 #34 0x8a2ad8 in _start ??:0 0x60220038e400 is located 160 bytes inside of 224-byte region [0x60220038e360,0x60220038e440) freed by thread T0 here: #0 0x7ffda221ab1a in ?? ??:0 #1 0x1320d31 in Ms::StemSlash::~StemSlash() /home/antonio/MuseScore/build.debug/libmscore/../../libmscore/stemslash.h:26 #2 0x1078309 in Ms::Chord::setStemSlash(Ms::StemSlash*) /home/antonio/MuseScore/libmscore/chord.cpp:2277 #3 0x104cb35 in Ms::Beam::layout2(QList, Ms::SpannerSegmentType, int) /home/antonio/MuseScore/libmscore/beam.cpp:1744 #4 0x103a29d in Ms::Beam::layout() /home/antonio/MuseScore/libmscore/beam.cpp:448 #5 0x111c67f in Ms::Score::doLayout() /home/antonio/MuseScore/libmscore/layout.cpp:640 #6 0x128c2bd in Ms::Score::endCmd() /home/antonio/MuseScore/libmscore/cmd.cpp:121 #7 0xabb0f0 in Ms::MuseScore::cmd(QAction*) /home/antonio/MuseScore/mscore/musescore.cpp:3862 #8 0x8a7789 in Ms::MuseScore::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) /home/antonio/MuseScore/build.debug/mscore/moc_musescore.cpp:813 #9 0x7ffda16a4260 in ?? ??:0 previously allocated by thread T0 here: #0 0x7ffda221a95a in ?? ??:0 #1 0x106da27 in Ms::Chord::layoutStem1() /home/antonio/MuseScore/libmscore/chord.cpp:1175 #2 0x1146dd4 in Ms::Measure::layoutCR0(Ms::ChordRest*, double) /home/antonio/MuseScore/libmscore/measure.cpp:345 #3 0x1146b60 in Ms::Measure::layoutCR0(Ms::ChordRest*, double) /home/antonio/MuseScore/libmscore/measure.cpp:327 #4 0x114691c in Ms::Measure::layoutChords0(Ms::Segment*, int) /home/antonio/MuseScore/libmscore/measure.cpp:306 #5 0x115f404 in Ms::Measure::layoutStage1() /home/antonio/MuseScore/libmscore/measure.cpp:3365 #6 0x111bf88 in Ms::Score::doLayout() /home/antonio/MuseScore/libmscore/layout.cpp:607 #7 0x128c2bd in Ms::Score::endCmd() /home/antonio/MuseScore/libmscore/cmd.cpp:121 #8 0xabb0f0 in Ms::MuseScore::cmd(QAction*) /home/antonio/MuseScore/mscore/musescore.cpp:3862 #9 0x8a7789 in Ms::MuseScore::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) /home/antonio/MuseScore/build.debug/mscore/moc_musescore.cpp:813 #10 0x7ffda16a4260 in ?? ??:0 Shadow bytes around the buggy address: 0x0c04c0069c30: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa 0x0c04c0069c40: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c04c0069c50: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c04c0069c60: fd fa fa fa fa fa fa fa fa fa fa fa fd fd fd fd 0x0c04c0069c70: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd =>0x0c04c0069c80:[fd]fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa 0x0c04c0069c90: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c04c0069ca0: fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa 0x0c04c0069cb0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd 0x0c04c0069cc0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa 0x0c04c0069cd0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap righ redzone: fb Freed Heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 ASan internal: fe ==1731== ABORTING