Brutal crash when trying to play

I took a closer look. In fact, it takes a number of conditions to reproduce this crash.
First an open volta (covering at least two measures), a horizontal frame, a section break, and another measure after that.
So, you can solve in various ways:
1. By closing the volta
2. By deleting the second measure covered by the open volta
3. By deleting the section break and/or the horizontal frame
4. By deleting the extra measure

See the test file created from scratch where one can reproduce the crash by running the playback: test4.mscz

I have no idea what the mechanism behind this behavior is, and whether it has been reported before, in a similar way or not?

In a Debug build:
Fatal: ASSERT: "e == 0 || e->isMeasure()" in file ...\libmscore\scoreElement.h, line 522

Stack trace before:

1 Ms::mscoreMessageHandler musescore.cpp 3941 0x422a19
2 qt_message_print(QtMsgType, QMessageLogContext const&, QString const&) 0x68892408
3 qt_message(QtMsgType, QMessageLogContext const&, const char *, char *) 0x68892509
4 QMessageLogger::fatal(const char *, ...) const 0x68bfe272
5 qt_assert(const char *, const char *, int) 0x68bfde37
6 Ms::toMeasure scoreElement.h 522 0xa6c14b
7 Ms::RepeatList::collectRepeatListElements repeatlist.cpp 543 0xa6df63
8 Ms::RepeatList::unwind repeatlist.cpp 733 0xa6eb07
9 Ms::RepeatList::update repeatlist.cpp 143 0xa6c76a
10 Ms::MasterScore::repeatList score.cpp 1830 0xa7d728
11 Ms::Seq::getPlayStartUtick seq.cpp 1210 0x476780
12 Ms::Seq::canStart seq.cpp 332 0x4725e8
13 Ms::ScoreView::::operator()(Ms::ScoreView *, const QByteArray &) const scoreview.cpp 2177 0x6422bf
14 std::_Function_handler>::_M_invoke(const std::_Any_data &, Ms::ScoreView *&&, const QByteArray &) std_function.h 297 0x65d8b0
15 std::function::operator()(Ms::ScoreView *, QByteArray const&) const std_function.h 687 0x10d453d
16 Ms::ScoreView::cmd scoreview.cpp 2890 0x64a701
17 Ms::ScoreView::cmd scoreview.cpp 2089 0x641de7
18 Ms::MuseScore::cmd musescore.cpp 6613 0x433de4
19 Ms::MuseScore::cmd musescore.cpp 6044 0x43077a
20 Ms::MuseScore::qt_static_metacall moc_musescore.cpp 610 0x5ee87d
...

            // Section break (or end of score)
            if (mb->sectionBreak() || !mb->nextMeasure()) {
                  if (sectionEndMeasureBase != nullptr) {
                        if (volta != nullptr) {
                              //if (volta->endMeasure()->tick() < mb->tick()) {
                                    // The previous volta was supposed to end before us (open volta case) -> insert the end
                                    sectionRLElements->push_back(new RepeatListElement(RepeatListElementType::VOLTA_END, volta, toMeasure(mb)));       //<----------- crash here
                                    volta = nullptr;
                              //      }
                              //else { // Volta is spanning over this section break, consider splitting the volta and adding it again at the start of the next section }
                              }
                        sectionRLElements->push_back(new RepeatListElement(RepeatListElementType::SECTION_BREAK, mb, toMeasure(sectionEndMeasureBase)));
                        sectionEndMeasureBase = nullptr; // reset to indicate not having found the end for the next section
                        // store section
                        _rlElements.push_back(sectionRLElements);
                        }

It's about time to get this into the issue tracker

Simple fix:

diff --git a/libmscore/repeatlist.cpp b/libmscore/repeatlist.cpp
index c5f989b545..1e0169ff92 100644
--- a/libmscore/repeatlist.cpp
+++ b/libmscore/repeatlist.cpp
@@ -537,7 +537,7 @@ void RepeatList::collectRepeatListElements()
             // Section break (or end of score)
             if (mb->sectionBreak() || !mb->nextMeasure()) {
                   if (sectionEndMeasureBase != nullptr) {
-                        if (volta != nullptr) {
+                        if (volta != nullptr && mb->isMeasure()) {
                               //if (volta->endMeasure()->tick() < mb->tick()) {
                                     // The previous volta was supposed to end before us (open volta case) -> insert the end
                                     sectionRLElements->push_back(new RepeatListElement(RepeatListElementType::VOLTA_END, volta, toMeasure(mb)));