[MU4 Issue] Linux: malloc invalid size crash on any audio export

[bmarwell]

Describe the bug

When trying to export an mp3 with musescore 4.0-1 (manjaro version) on Linux, MuseScore 4 will crash. This is what I see in the logs:

malloc(): invalid next size (unsorted)
[1]    2232217 IOT instruction (core dumped)  mscore

See: https://musescore.org/en/node/339336

To Reproduce
Steps to reproduce the behavior:

• I use Manjaro (rolling release). I use btrfs partitions.
• Install package MuseScore from community
• I also installed muse-hub-bin from aur which extracts the files from the official .deb package
• Started MuseScore. Playback anything (any score) with Muse Sounds works fine.
• Click on export and chose any audio format. It will crash.

Expected behavior

• Audio exports exports audio file without crashing
  … or
• At least gives some error message what went wrong.

Screenshots

n/a, but stucks at 0 % (desktop) or 4 % (laptop)

Platform information

• OS: Linux only, tested on Manjaro w/ LTS-Kernel, Kernel 6.0 and 6.1 as well.

cat /etc/lsb-release 
DISTRIB_ID=ManjaroLinux
DISTRIB_RELEASE=22.0.0
DISTRIB_CODENAME=Sikaris
DISTRIB_DESCRIPTION="Manjaro Linux"

Additional context

1. Reproduced by Marc (see issue tracker)
2. core dumps available on google drive (see issue tracker)
3. May be related to different malloc: https://musescore.org/en/node/339563
4. On my laptop, the error message is slightly different:

free(): invalid pointer
[1]    3630 IOT instruction (core dumped)  mscore

[rtbo]

For me audio export works with sampling frequency 44100 Hz, but I have a similar crash if I change to 48000 Hz (with different error message)

malloc(): invalid size (unsorted)
[15258:15258:20221224,002301.442872:ERROR elf_dynamic_array_reader.h:61] tag not found
[15258:15258:20221224,002301.444976:ERROR elf_dynamic_array_reader.h:61] tag not found
[15258:15258:20221224,002301.447417:ERROR elf_dynamic_array_reader.h:61] tag not found
(... about 30 times the same message before crash)

[rtbo]

Crash in GDB gives the following call stack:

libc.so.6![Unknown/Just-In-Time compiled code] (Source inconnue:0)
libc.so.6!raise (Source inconnue:0)
libc.so.6!abort (Source inconnue:0)
libc.so.6![Unknown/Just-In-Time compiled code] (Source inconnue:0)
libc.so.6!malloc (Source inconnue:0)
libMuseSamplerCoreLib.so!std::_Sp_counted_ptr_inplace<staffpad::audio::SignalData<float>, std::allocator<staffpad::audio::SignalData<float> >, (__gnu_cxx::_Lock_policy)2>::_Sp_counted_ptr_inplace<int&, int&>(std::allocator<staffpad::audio::SignalData<float> >, int&, int&) (Source inconnue:0)
libMuseSamplerCoreLib.so!staffpad::audio::Signal<float>::Signal(int, int) (Source inconnue:0)
libMuseSamplerCoreLib.so!staffpad::audio::Signal<float>::concatenate(staffpad::audio::Signal<float> const&, staffpad::audio::Signal<float> const&) (Source inconnue:0)
libMuseSamplerCoreLib.so!staffpad::vi::SfzVoice::generate(int) (Source inconnue:0)
libMuseSamplerCoreLib.so!staffpad::vi::BaseInstrument::KeyData::generate(int, int) const (Source inconnue:0)
libMuseSamplerCoreLib.so!staffpad::vi::BaseInstrument::processKeyEvents(staffpad::vi::BaseInstrument::KeyData&, staffpad::vi::VIEventList const&, staffpad::audio::Signal32&, bool) (Source inconnue:0)
libMuseSamplerCoreLib.so!staffpad::vi::BaseInstrument::process(double, staffpad::vi::VIEventList const&, staffpad::audio::Signal32&) (Source inconnue:0)
libMuseSamplerCoreLib.so!std::enable_if<is_invocable_r_v<staffpad::audio::Signal32, std::_Bind<staffpad::vi::PlaybackEngine::generate(double, staffpad::audio::Signal32&, std::optional<int>, staffpad::vi::PrerenderBuffer const*)::$_0 ()>&>, staffpad::audio::Signal32>::type std::__invoke_r<staffpad::audio::Signal32, std::_Bind<staffpad::vi::PlaybackEngine::generate(double, staffpad::audio::Signal32&, std::optional<int>, staffpad::vi::PrerenderBuffer const*)::$_0 ()>&>(std::_Bind<staffpad::vi::PlaybackEngine::generate(double, staffpad::audio::Signal32&, std::optional<int>, staffpad::vi::PrerenderBuffer const*)::$_0 ()>&) (Source inconnue:0)
libMuseSamplerCoreLib.so!std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<staffpad::audio::Signal32>, std::__future_base::_Result_base::_Deleter>, std::__future_base::_Task_state<std::_Bind<staffpad::vi::PlaybackEngine::generate(double, staffpad::audio::Signal32&, std::optional<int>, staffpad::vi::PrerenderBuffer const*)::$_0 ()>, std::allocator<int>, staffpad::audio::Signal32 ()>::_M_run()::{lambda()#1}, staffpad::audio::Signal32> >::_M_invoke(std::_Any_data const&) (Source inconnue:0)
libMuseSamplerCoreLib.so!std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) (Source inconnue:0)
libc.so.6![Unknown/Just-In-Time compiled code] (Source inconnue:0)
libMuseSamplerCoreLib.so!std::__future_base::_Task_state<std::_Bind<staffpad::vi::PlaybackEngine::generate(double, staffpad::audio::Signal32&, std::optional<int>, staffpad::vi::PrerenderBuffer const*)::$_0 ()>, std::allocator<int>, staffpad::audio::Signal32 ()>::_M_run() (Source inconnue:0)
libMuseSamplerCoreLib.so!staffpad::ThreadPool::workerThreadFunction() (Source inconnue:0)
libstdc++.so.6!std::execute_native_thread_routine(void * __p) (/usr/src/debug/gcc/libstdc++-v3/src/c++11/thread.cc:82)
libc.so.6![Unknown/Just-In-Time compiled code] (Source inconnue:0)

[bmarwell]

Let me know if you need debugging information. I'm an experienced Linux user, I only need some gdb guidelines as I'm a java dev, not a C dev. 😉

[bmarwell]

4.0.1 still occasionally crashes

[rtbo]

The crash seems to come from Muse Sounds (libMuseSamplerCoreLib.so) which is not open source AFAIK.

[agittins]

I'm experiencing the same with Musescore 4.0.2 and Muse sounds when trying to export 48kHz mp3. Changing to 44.1kHz seems to resolve the issue. I'm using 320 kbit/s in both cases.

[zacjansheski]

@bmarwell We are currently unable to reproduce this.

Could you confirm if the issue is resolved or still present?

[bmarwell]

That's one year old and probably a Manjaro bug. I switched to app image on Manjaro, which works. On my laptop running endeavour OS (which is closer to vanilla arch), the aur package works fine.

Might have been anything in the past year...

If no one has rejections, let's close it.

Thanks for coming back to this!

[zacjansheski]

Thank you!