#2 Crash when dropping track on SoundBridge

[Mike Crowe]

chorale-v0.18 on Debian Lenny x86:

1. Pick up a single track from the chorale media browser.

2. Drop it on a SoundBridge set-list.

3. Bang:

==569==
==569== Invalid read of size 4
==569== at 0x80DC580: std::map<std::string, std::string, std::less<std::string>, std::allocator<std::pair<std::string const, std::string> > >::operator[](std::string const&) (stl_tree.h:453)
==569== by 0x80D9D8C: upnp::DeviceClient::Impl::SoapXMLObserver::OnEnd(char const*) (soap.h:31)
==569== by 0x810AA2B: xml::SaxParser::Parse() (xml.cpp:140)
==569== by 0x810AF8A: xml::SaxParser::WriteAll(void const*, unsigned) (xml.cpp:63)
==569== by 0x80D75D2: upnp::DeviceClient::Impl::SyncSoapHandler::Write(void const*, unsigned, unsigned*) (client.cpp:527)
==569== by 0x80ECCFD: util::http::Client::Task::Run() (http_client.cpp:446)
==569== by 0x810C91F: util::posix::PollerCore::DoCallbacks(std::vector<util::PollRecord, std::allocator<util::PollRecord> >*, bool) (bind.h:59)
==569== by 0x8101F33: util::BackgroundScheduler::Impl::Poll(unsigned) (scheduler.cpp:323)
==569== by 0x80D8A60: upnp::DeviceClient::Impl::SoapAction(char const*, char const*, upnp:🧼:Outbound const&, upnp:🧼:Inbound*) (client.cpp:586)
==569== by 0x80D8DC1: upnp::ServiceClient::SoapAction(char const*, upnp:🧼:Outbound const&, upnp:🧼:Inbound*) (client.cpp:724)
==569== by 0x80CE9EC: upnp::AVTransport2Client::SetAVTransportURI(unsigned, std::string const&, std::string const&) (AVTransport2_client.cpp:27)
==569== by 0x80B134C: output::upnpav::URLPlayer::SetURL(std::string const&, std::string const&) (upnpav.cpp:166)
==569== Address 0x8 is not stack'd, malloc'd or (recently) free'd
==569==

==569==
==569== Invalid read of size 4
==569== at 0x80DC580: std::map<std::string, std::string, std::less<std::string>, std::allocator<std::pair<std::string const, std::string> > >::operator[](std::string const&) (stl_tree.h:453)
==569== by 0x80D9D8C: upnp::DeviceClient::Impl::SoapXMLObserver::OnEnd(char const*) (soap.h:31)
==569== by 0x810AA2B: xml::SaxParser::Parse() (xml.cpp:140)
==569== by 0x810AF8A: xml::SaxParser::WriteAll(void const*, unsigned) (xml.cpp:63)
==569== by 0x80D75D2: upnp::DeviceClient::Impl::SyncSoapHandler::Write(void const*, unsigned, unsigned*) (client.cpp:527)
==569== by 0x80ECCFD: util::http::Client::Task::Run() (http_client.cpp:446)
==569== by 0x810C91F: util::posix::PollerCore::DoCallbacks(std::vector<util::PollRecord, std::allocator<util::PollRecord> >*, bool) (bind.h:59)
==569== by 0x8101F33: util::BackgroundScheduler::Impl::Poll(unsigned) (scheduler.cpp:323)
==569== by 0x80D8A60: upnp::DeviceClient::Impl::SoapAction(char const*, char const*, upnp:🧼:Outbound const&, upnp:🧼:Inbound*) (client.cpp:586)
==569== by 0x80D8DC1: upnp::ServiceClient::SoapAction(char const*, upnp:🧼:Outbound const&, upnp:🧼:Inbound*) (client.cpp:724)
==569== by 0x80CE9EC: upnp::AVTransport2Client::SetAVTransportURI(unsigned, std::string const&, std::string const&) (AVTransport2_client.cpp:27)
==569== by 0x80B134C: output::upnpav::URLPlayer::SetURL(std::string const&, std::string const&) (upnpav.cpp:166)
==569== Address 0x8 is not stack'd, malloc'd or (recently) free'd
==569==

(gdb) bt
#0 std::map<std::string, std::string, std::less<std::string>, std::allocator<std::pair<std::string const, std::string> > >::operator[] (this=0x0, __k=@0xbebd8cf4) at /usr/include/c++/4.3/bits/stl_tree.h:453
#1 0x080d9d8d in upnp::DeviceClient::Impl::SoapXMLObserver::OnEnd (this=0xbebd9558, tag=0xbebd9141 "faultcode")
at /home/mac/src/chorale-0.18/libupnp/soap.h:31
#2 0x0810aa2c in xml::SaxParser::Parse (this=0xbebd913c) at libutil/xml.cpp:140
#3 0x0810af8b in xml::SaxParser::WriteAll (this=0xbebd913c, buffer=0x645e60a, len=0) at libutil/xml.cpp:63
#4 0x080d75d3 in upnp::DeviceClient::Impl::SyncSoapHandler::Write (this=0x645c718, buffer=0x645e460, len=426,
pwrote=0xbebd8f30) at libupnp/client.cpp:527
#5 0x080eccfe in util::http::Client::Task::Run (this=0x645cdf8) at libutil/http_client.cpp:446
#6 0x0810c920 in util::posix::PollerCore::DoCallbacks (this=0x645c7ac, pollables=0x645c790, array_valid=true)
at libutil/bind.h:59
#7 0x08101f34 in util::BackgroundScheduler::Impl::Poll (this=0x645c778, timeout_ms=10000)
at libutil/scheduler.cpp:323
#8 0x080d8a61 in upnp::DeviceClient::Impl::SoapAction (this=0x7abcad0,
service_id=0x8127e20 "urn:upnp-org:serviceId:AVTransport", action_name=0x8124928 "SetAVTransportURI",
in=@0xbebd9608, result=0x0) at libupnp/client.cpp:586
#9 0x080d8dc2 in upnp::ServiceClient::SoapAction (this=0x7abca64, action_name=0x8124928 "SetAVTransportURI",
in=@0xbebd9608, result=0x0) at libupnp/client.cpp:724
#10 0x080ce9ed in upnp::AVTransport2Client::SetAVTransportURI (this=0x7abca5c, instance_id=0,
current_uri=@0xbebd96b0, current_uri_meta_data=@0xbebd96a0) at libupnp/AVTransport2_client.cpp:27
#11 0x080b134d in output::upnpav::URLPlayer::SetURL (this=0x7abca30, url=@0xbebd96b0, metadata=@0xbebd96a0)
at liboutput/upnpav.cpp:166
#12 0x080aeb52 in output::Queue::SetURL (this=0x7abcf18) at liboutput/queue.cpp:479
#13 0x080af6ea in output::Queue::EntryInsert (this=0x7abcf18, db=0x7a704f8, id=272, where=0)
at liboutput/queue.cpp:225
#14 0x0807a24f in choraleqt::SetlistModel::dropMimeData (this=0x641a30c, data=0x9afd868, action=Qt::CopyAction,
row=-1, parent=@0xbebd9844) at choralecd/setlist_model.cpp:200
#15 0x04805041 in QAbstractItemView::dropEvent () from /usr/lib/libQtGui.so.4
#16 0x0439a101 in QWidget::event () from /usr/lib/libQtGui.so.4
#17 0x046cdca3 in QFrame::event () from /usr/lib/libQtGui.so.4
#18 0x047643cf in QAbstractScrollArea::viewportEvent () from /usr/lib/libQtGui.so.4
#19 0x0480f88f in QAbstractItemView::viewportEvent () from /usr/lib/libQtGui.so.4
#20 0x04766975 in ?? () from /usr/lib/libQtGui.so.4
#21 0x04c4d2ba in QCoreApplicationPrivate::sendThroughObjectEventFilters () from /usr/lib/libQtCore.so.4
#22 0x0434277a in QApplicationPrivate::notify_helper () from /usr/lib/libQtGui.so.4
#23 0x0434abf8 in QApplication::notify () from /usr/lib/libQtGui.so.4
#24 0x04c4e0d1 in QCoreApplication::notifyInternal () from /usr/lib/libQtCore.so.4
#25 0x043c07cf in ?? () from /usr/lib/libQtGui.so.4
#26 0x043c51e8 in QDragManager::drop () from /usr/lib/libQtGui.so.4
#27 0x043c53a6 in QDragManager::eventFilter () from /usr/lib/libQtGui.so.4
#28 0x04c4d364 in QCoreApplicationPrivate::sendThroughApplicationEventFilters () from /usr/lib/libQtCore.so.4
#29 0x04342713 in QApplicationPrivate::notify_helper () from /usr/lib/libQtGui.so.4
#30 0x0434afd1 in QApplication::notify () from /usr/lib/libQtGui.so.4
#31 0x04c4e0d1 in QCoreApplication::notifyInternal () from /usr/lib/libQtCore.so.4
#32 0x0434a25e in QApplicationPrivate::sendMouseEvent () from /usr/lib/libQtGui.so.4
#33 0x043b3dfd in ?? () from /usr/lib/libQtGui.so.4
#34 0x043b2be1 in QApplication::x11ProcessEvent () from /usr/lib/libQtGui.so.4
#35 0x043dc60a in ?? () from /usr/lib/libQtGui.so.4
#36 0x050441d8 in IA__g_main_context_dispatch (context=0x63f0818)
at /build/buildd-glib2.0_2.16.6-2-i386-PgybGk/glib2.0-2.16.6/glib/gmain.c:2012
#37 0x05047873 in g_main_context_iterate (context=0x63f0818, block=1, dispatch=1, self=0x63eb340)
---Type <return> to continue, or q <return> to quit---
at /build/buildd-glib2.0_2.16.6-2-i386-PgybGk/glib2.0-2.16.6/glib/gmain.c:2645
#38 0x05047a31 in IA__g_main_context_iteration (context=0x63f0818, may_block=1)
at /build/buildd-glib2.0_2.16.6-2-i386-PgybGk/glib2.0-2.16.6/glib/gmain.c:2708
#39 0x04c785d8 in QEventDispatcherGlib::processEvents () from /usr/lib/libQtCore.so.4
#40 0x043dbd45 in ?? () from /usr/lib/libQtGui.so.4
#41 0x04c4c79a in QEventLoop::processEvents () from /usr/lib/libQtCore.so.4
#42 0x04c4c95a in QEventLoop::exec () from /usr/lib/libQtCore.so.4
#43 0x043c344b in QDragManager::drag () from /usr/lib/libQtGui.so.4
#44 0x04355b2a in QDrag::exec () from /usr/lib/libQtGui.so.4
#45 0x0480c98f in QAbstractItemView::startDrag () from /usr/lib/libQtGui.so.4
#46 0x04823078 in QListView::startDrag () from /usr/lib/libQtGui.so.4
#47 0x0480b339 in QAbstractItemView::mouseMoveEvent () from /usr/lib/libQtGui.so.4
#48 0x04823472 in QListView::mouseMoveEvent () from /usr/lib/libQtGui.so.4
#49 0x0439a62b in QWidget::event () from /usr/lib/libQtGui.so.4
#50 0x046cdca3 in QFrame::event () from /usr/lib/libQtGui.so.4
#51 0x047643cf in QAbstractScrollArea::viewportEvent () from /usr/lib/libQtGui.so.4
#52 0x0480f88f in QAbstractItemView::viewportEvent () from /usr/lib/libQtGui.so.4
#53 0x04766975 in ?? () from /usr/lib/libQtGui.so.4
#54 0x04c4d2ba in QCoreApplicationPrivate::sendThroughObjectEventFilters () from /usr/lib/libQtCore.so.4
#55 0x0434277a in QApplicationPrivate::notify_helper () from /usr/lib/libQtGui.so.4
#56 0x0434afd1 in QApplication::notify () from /usr/lib/libQtGui.so.4
#57 0x04c4e0d1 in QCoreApplication::notifyInternal () from /usr/lib/libQtCore.so.4
#58 0x0434a25e in QApplicationPrivate::sendMouseEvent () from /usr/lib/libQtGui.so.4
#59 0x043b3dfd in ?? () from /usr/lib/libQtGui.so.4
#60 0x043b2be1 in QApplication::x11ProcessEvent () from /usr/lib/libQtGui.so.4
#61 0x043dc60a in ?? () from /usr/lib/libQtGui.so.4
#62 0x050441d8 in IA__g_main_context_dispatch (context=0x63f0818)
at /build/buildd-glib2.0_2.16.6-2-i386-PgybGk/glib2.0-2.16.6/glib/gmain.c:2012
#63 0x05047873 in g_main_context_iterate (context=0x63f0818, block=1, dispatch=1, self=0x63eb340)
at /build/buildd-glib2.0_2.16.6-2-i386-PgybGk/glib2.0-2.16.6/glib/gmain.c:2645
#64 0x05047a31 in IA__g_main_context_iteration (context=0x63f0818, may_block=1)
at /build/buildd-glib2.0_2.16.6-2-i386-PgybGk/glib2.0-2.16.6/glib/gmain.c:2708
#65 0x04c785d8 in QEventDispatcherGlib::processEvents () from /usr/lib/libQtCore.so.4
#66 0x043dbd45 in ?? () from /usr/lib/libQtGui.so.4
#67 0x04c4c79a in QEventLoop::processEvents () from /usr/lib/libQtCore.so.4
#68 0x04c4c95a in QEventLoop::exec () from /usr/lib/libQtCore.so.4
#69 0x04c4f015 in QCoreApplication::exec () from /usr/lib/libQtCore.so.4
#70 0x04342617 in QApplication::exec () from /usr/lib/libQtGui.so.4
#71 0x0805f822 in choraleqt::Main (argc=1, argv=0xbebdc4e4) at choralecd/choralecd.cpp:140
#72 0x0805fb52 in main (argc=Cannot access memory at address 0x1
) at choralecd/choralecd.cpp:151
(gdb)