================================================================= ==2262== ERROR: AddressSanitizer: heap-use-after-free on address 0x6008013769e8 at pc 0xd354a9 bp 0x7fffd67d4410 sp 0x7fffd67d4408 READ of size 4 at 0x6008013769e8 thread T0 #0 0xd354a8 in Ms::StaffType::lines() const /home/antonio/MuseScore/libmscore/stafftype.h:101 #1 0x12277b1 in Ms::Staff::setStaffType(Ms::StaffType*) /home/antonio/MuseScore/libmscore/staff.cpp:695 #2 0x12d9700 in Ms::ChangeStaff::flip() /home/antonio/MuseScore/libmscore/undo.cpp:2344 #3 0x12c7270 in Ms::UndoCommand::undo() /home/antonio/MuseScore/libmscore/undo.cpp:133 #4 0x12c720e in Ms::UndoCommand::undo() /home/antonio/MuseScore/libmscore/undo.cpp:131 #5 0x12c7f94 in Ms::UndoStack::undo() /home/antonio/MuseScore/libmscore/undo.cpp:299 #6 0xad629a in Ms::MuseScore::undo() /home/antonio/MuseScore/mscore/musescore.cpp:2964 #7 0xadfd3b in Ms::MuseScore::cmd(QAction*, QString const&) /home/antonio/MuseScore/mscore/musescore.cpp:4067 #8 0xadeaa3 in Ms::MuseScore::cmd(QAction*) /home/antonio/MuseScore/mscore/musescore.cpp:3925 #9 0x8bd31e in Ms::MuseScore::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) /home/antonio/MuseScore/build.debug/mscore/moc_musescore.cpp:817 #10 0x7fe120277260 in ?? ??:0 #11 0x7fe11e4854ce in ?? ??:0 #12 0x7fe11e485ca8 in ?? ??:0 #13 0x7fe120277260 in ?? ??:0 #14 0x7fe11e481ba1 in ?? ??:0 #15 0x7fe11e4839d6 in ?? ??:0 #16 0x7fe11e589eb4 in ?? ??:0 #17 0x7fe11e58a173 in ?? ??:0 #18 0x7fe11e648e79 in ?? ??:0 #19 0x7fe11e4c386d in ?? ??:0 #20 0x7fe11e649d0f in ?? ??:0 #21 0x7fe11e48cb53 in ?? ??:0 #22 0x7fe11e48fe38 in ?? ??:0 #23 0x7fe12024fdd3 in ?? ??:0 #24 0x7fe11e48efa7 in ?? ??:0 #25 0x7fe11e4e2864 in ?? ??:0 #26 0x7fe11e4e4a6f in ?? ??:0 #27 0x7fe11e48cb53 in ?? ??:0 #28 0x7fe11e48ffe5 in ?? ??:0 #29 0x7fe12024fdd3 in ?? ??:0 #30 0x7fe11fa7901a in ?? ??:0 #31 0x7fe11fa798ec in ?? ??:0 #32 0x7fe11fa62a97 in ?? ??:0 #33 0x7fe1112ca93f in ?? ??:0 #34 0x7fe1184a4d12 in ?? ??:0 #35 0x7fe1184a505f in ?? ??:0 #36 0x7fe1184a5123 in ?? ??:0 #37 0x7fe12029a313 in ?? ??:0 #38 0x7fe12024eb6a in ?? ??:0 #39 0x7fe120252bbd in ?? ??:0 #40 0xae73c1 in main /home/antonio/MuseScore/mscore/musescore.cpp:4916 #41 0x7fe119e6876c in __libc_start_main /build/buildd/eglibc-2.15/csu/libc-start.c:226 #42 0x8b7b68 in _start ??:0 0x6008013769e8 is located 24 bytes inside of 48-byte region [0x6008013769d0,0x600801376a00) freed by thread T0 here: #0 0x7fe120dedb1a in ?? ??:0 #1 0x123e477 in Ms::StaffTypePitched::~StaffTypePitched() /home/antonio/MuseScore/libmscore/stafftype.h:151 #2 0x11eba78 in Ms::Score::addStaffType(int, Ms::StaffType*) /home/antonio/MuseScore/libmscore/score.cpp:1973 #3 0x11ebcd9 in Ms::Score::replaceStaffTypes(QList const&) /home/antonio/MuseScore/libmscore/score.cpp:2009 #4 0xae1935 in Ms::MuseScore::cmd(QAction*, QString const&) /home/antonio/MuseScore/mscore/musescore.cpp:4257 #5 0xadeaa3 in Ms::MuseScore::cmd(QAction*) /home/antonio/MuseScore/mscore/musescore.cpp:3925 #6 0x8bd31e in Ms::MuseScore::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) /home/antonio/MuseScore/build.debug/mscore/moc_musescore.cpp:817 #7 0x7fe120277260 in ?? ??:0 previously allocated by thread T0 here: #0 0x7fe120ded95a in ?? ??:0 #1 0x123b30a in Ms::StaffTypePitched::clone() const /home/antonio/MuseScore/libmscore/stafftype.h:164 #2 0x11defa8 in Ms::Score::init() /home/antonio/MuseScore/libmscore/score.cpp:297 #3 0x11e067f in Ms::Score::Score(Ms::MStyle const*) /home/antonio/MuseScore/libmscore/score.cpp:358 #4 0xdee624 in Ms::MuseScore::newFile() /home/antonio/MuseScore/mscore/file.cpp:464 #5 0xadf9a4 in Ms::MuseScore::cmd(QAction*, QString const&) /home/antonio/MuseScore/mscore/musescore.cpp:4037 #6 0xadeaa3 in Ms::MuseScore::cmd(QAction*) /home/antonio/MuseScore/mscore/musescore.cpp:3925 #7 0x8bd31e in Ms::MuseScore::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) /home/antonio/MuseScore/build.debug/mscore/moc_musescore.cpp:817 #8 0x7fe120277260 in ?? ??:0 Shadow bytes around the buggy address: 0x0c0180266ce0: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x0c0180266cf0: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 00 0x0c0180266d00: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa 0x0c0180266d10: fa fa 00 00 00 00 00 04 fa fa 00 00 00 00 00 00 0x0c0180266d20: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd =>0x0c0180266d30: fa fa fd fd fd fd fd fd fa fa fd fd fd[fd]fd fd 0x0c0180266d40: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fd 0x0c0180266d50: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 06 0x0c0180266d60: fa fa fd fd fd fd fd fa fa fa 00 00 00 00 00 fa 0x0c0180266d70: fa fa 00 00 00 00 00 06 fa fa 00 00 00 00 00 fa 0x0c0180266d80: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap righ redzone: fb Freed Heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 ASan internal: fe ==2262== ABORTING