When is '//' removed we access i + 2 indecies. But array is 257 length and iterate until 256, on last iteration 255 + 2 == 257 and we out-of-bounds.
There:
https://github.com/bitcoin/bitcoin/blob/master/src/qt/qtipcserver.cpp#L37 https://github.com/bitcoin/bitcoin/blob/master/src/qt/qtipcserver.cpp#L73
Without // that loop does not even run, oh I see what you're saying "In the code where it removes //", yes that code bothered me too— IIRC I complained about it when it was written.
I'm not sure the conversion should even be there. Wouldn't it be better to move it with the rest of the URL parsing in GUIUtil? (so that bitcoin:// also can be tested by the unit case).
When using QString you could easily get rid of the complete ugly loop:
if(url.startsWith("bitcoin://"))
{
url.replace(0, 10, "bitcoin:");
}
Edit: working on this, expect pull request soon...