Comment 75 for bug 116750

It seems to be more difficult to trigger than before, but as I said it is still fairly reliably triggered for me (what works most of the time is scrolling while it is loading, so the images are not on the screen and immediately scrolling back. The scrollbar than "hangs" and then it crashes).

While testing with gdb, I once had a crash in a different GET function of DAVResourceAccess.cxx, so it seems to crash in either one of these (in the respective line with m_xSession->GET):

uno::Reference< io::XStream > DAVResourceAccess::GET(
    const std::vector< rtl::OUString > & rHeaderNames,
    DAVResource & rResource,
    const uno::Reference< ucb::XCommandEnvironment > & xEnv,
    sal_Bool bAllowEmpty )
  throw( DAVException )
{
    initialize();

    uno::Reference< io::XStream > xStream;
    int errorCount = 0;
    bool bRetry;
    do
    {
        bRetry = false;
        try
        {
            DAVRequestHeaders aHeaders;
            getUserRequestHeaders( xEnv,
                                   getRequestURI(),
                                   rtl::OUString::createFromAscii( "GET" ),
                                   aHeaders );

            xStream = m_xSession->GET( getRequestURI(),
                                       rHeaderNames,
                                       rResource,
                                       DAVRequestEnvironment(
                                           getRequestURI(),
                                           new DAVAuthListener_Impl( xEnv, m_aURL ),
                                           aHeaders, xEnv ),
                                       bAllowEmpty );
        }
        catch ( DAVException & e )
        {
            errorCount++;
            bRetry = handleException( e, errorCount );
            if ( !bRetry )
                throw;
        }
    }
    while ( bRetry );

    return xStream;
}

//=========================================================================
void DAVResourceAccess::GET(
    uno::Reference< io::XOutputStream > & rStream,
    const std::vector< rtl::OUString > & rHeaderNames,
    DAVResource & rResource,
    const uno::Reference< ucb::XCommandEnvironment > & xEnv )
  throw( DAVException )
{
    initialize();

    bool bRetry;
    int errorCount = 0;
    do
    {
        bRetry = false;
        try
        {
            DAVRequestHeaders aHeaders;
            getUserRequestHeaders( xEnv,
                                   getRequestURI(),
                                   rtl::OUString::createFromAscii( "GET" ),
                                   aHeaders );

            m_xSession->GET( getRequestURI(),
                             rStream,
                             rHeaderNames,
                             rResource,
                             DAVRequestEnvironment(
                                 getRequestURI(),
                                 new DAVAuthListener_Impl( xEnv, m_aURL ),
                                 aHeaders, xEnv ) );
        }
        catch ( DAVException & e )
        {
            errorCount++;
            bRetry = handleException( e, errorCount );
            if ( !bRetry )
                throw;
        }
    }
    while ( bRetry );
}

This is what I tried in gdb after a crash in the first function (like in my stacktrace from comment #13):
(gdb) print rHeaderNames
$1 = (const _STL::vector<rtl::OUString, _STL::allocator<rtl::OUString> > &) @0xbfffc650: {<_STL::_Vector_base<rtl::OUString, _STL::allocator<rtl::OUString> >> = {_M_start = 0x0,
    _M_finish = 0x0, _M_end_of_storage = {<_STL::allocator<rtl::OUString>> = {<No data fields>}, _M_data = 0x0}}, <No data fields>}
(gdb) print rResource
$2 = (webdav_ucp::DAVResource &) @0xbfffc628: {uri = {pData = 0xb52f14},
  properties = {<_STL::_Vector_base<webdav_ucp::DAVPropertyValue, _STL::allocator<webdav_ucp::DAVPropertyValue> >> = {_M_start = 0x0, _M_finish = 0x0,
      _M_end_of_storage = {<_STL::allocator<webdav_ucp::DAVPropertyValue>> = {<No data fields>}, _M_data = 0x0}}, <No data fields>}}
(gdb) print xEnv
$3 = (const com::sun::star::uno::Reference<com::sun::star::ucb::XCommandEnvironment> &) @0x8a7cd38: {<com::sun::star::uno::BaseReference> = {
    _pInterface = 0x8818364}, <No data fields>}
(gdb) print m_aURL
$4 = {pData = 0xa}
(gdb) print aHeaders
$5 = {<_STL::_Vector_base<_STL::pair<rtl::OUString, rtl::OUString>, _STL::allocator<_STL::pair<rtl::OUString, rtl::OUString> > >> = {_M_start = 0x0, _M_finish = 0x0,
    _M_end_of_storage = {<_STL::allocator<_STL::pair<rtl::OUString, rtl::OUString> >> = {<No data fields>}, _M_data = 0x0}}, <No data fields>}
(gdb) print xEnv
$6 = (const com::sun::star::uno::Reference<com::sun::star::ucb::XCommandEnvironment> &) @0x8a7cd38: {<com::sun::star::uno::BaseReference> = {
    _pInterface = 0x8818364}, <No data fields>}
(gdb) print bAllowEmpty
$7 = 0 '\000'
(gdb) print m_xSession
$8 = {m_pBody = 0x6f0044}

pData ($4) looks a bit strange for a pointer, doesn't it? I therefore tried this:

(gdb) print m_aURL.pData
$9 = (rtl_uString *) 0xa
(gdb) printf "%s", m_aURL.pData
Cannot access memory at address 0xa

Hope this is of any help :-/