Segmentation fault when opening a specific MusicXML score

[leleogere]

Issue type

Crash or freeze

Description with steps to reproduce

Open the attached score in MuseScore, wait for it to crash.

While the engraving quality of this MusicXML can (and should!) be discussed, MuseScore was able to open it up to version 4.1.1 (despite a warning about the score being corrupted). From 4.2, it leads to a segmentation fault.

Supporting files, videos and screenshots

Corrupted file: xml_score.musicxml.zip

Debug logs: https://pastebin.com/8sGPh8VA (too long for github issue)

What is the latest version of MuseScore Studio where this issue is present?

MuseScore Studio version (64-bit): 4.4.4-243461245, revision: github-musescore-musescore-2232670

Regression

Yes, this used to work in a previous version of MuseScore 4.x

Operating system

OS: Pop!_OS 22.04 LTS, Arch.: x86_64

Additional context

No response

Checklist

• This report follows the guidelines for reporting bugs and issues
• I have verified that this issue has not been logged before, by searching the issue tracker for similar issues
• I have attached all requested files and information to this report
• I have attempted to identify the root problem as concisely as possible, and have used minimal reproducible examples where possible

[Jojo-Schmitz]

Note: the attached xml_score.musicxml.zip is not a .zip file, but just a renamed .musicxml file

[Jojo-Schmitz]

Latest development build crashes too, as does 4.3.2 and 4.2.1.
4.1.1 (and 4.0.1) does not (but reports 2 corruptions), same for 3.6.2

[Jojo-Schmitz]

It crashes here:

MuseScore/src/engraving/rendering/score/tlayout.cpp

Line 2070 in af80582

const EngravingItem* e = s->element(item->track());

with s being a nullptr
Changing that to

    const EngravingItem* e = s ? s->element(item->track()) : nullptr;

makes it crash a few lines later, at

MuseScore/src/engraving/rendering/score/tlayout.cpp

Line 2108 in af80582

const Measure* m = s2->measure();

[Jojo-Schmitz]

Seems an early exit is needed if s or s2is a nullptr?

[Jojo-Schmitz]

Maybe not, see PR #26602

[Jojo-Schmitz]

The score seems to stem from http://musescore.com/score/658031, it says that in the .musicxml. But that score stems from MuseScore 1.3, while your .musicxml stems from 3.4.2 (also says that in the .msucxml)?!?
What happened to that file in between? The original score doesn't cause any issues (neither the .mscz nor the .mxl), except for reporting a couple corruptions (something MuseScore 1.3 wasn't capable of).

The problem seems to be that there are (now!) multiple fermatas (4) attached to (mutlitpe) grace notes. The original didn't have any fermatas at grace notes

[leleogere]

The score seems to stem from http://musescore.com/score/658031, it says that in the .musicxml. But that score stems from MuseScore 1.3, while your .musicxml stems from 3.4.2 (also says that in the .msucxml)?!?
What happened to that file in between?

That file comes from the ASAP dataset, and I guess the authors probably ran some automatic and/or manual post-processing in an attempt to fixe some errors in the scores, resulting in this weird MusicXML.

This score definitely has issues that must be fixed, I just reported it as it was a regression since version 4.1. Anyway, well done for finding the cause of the crash!