I have had the connman crash when free_wispr_routes() is called. It happens when there are lots of wireless networks around but none with good signal strength.
As a fix, I use g_slist_nth_data() to get the wispr_route and check it before using it.

diff --git a/src/wispr.c b/src/wispr.c
index 0ab041e..546660a 100644
--- a/src/wispr.c
+++ b/src/wispr.c
@@ -128,28 +128,30 @@ static void connman_wispr_message_init(struct connman_wispr_message *msg)
static void free_wispr_routes(struct connman_wispr_portal_context *wp_context)
{
   while (wp_context->route_list) {
-       struct wispr_route *route = wp_context->route_list->data;
-
-       DBG("free route to %s if %d type %d", route->address,
-               route->if_index, wp_context->type);
+       struct wispr_route *route = g_slist_nth_data(wp_context->route_list, 0);
+
+       if (route) {
+           DBG("free route to %s if %d type %d", route->address,
+                   route->if_index, wp_context->type);
+
+           switch (wp_context->type) {
+           case CONNMAN_IPCONFIG_TYPE_IPV4:
+               connman_inet_del_host_route(route->if_index,
+                       route->address);
+               break;
+           case CONNMAN_IPCONFIG_TYPE_IPV6:
+               connman_inet_del_ipv6_host_route(route->if_index,
+                       route->address);
+               break;
+           case CONNMAN_IPCONFIG_TYPE_UNKNOWN:
+           case CONNMAN_IPCONFIG_TYPE_ALL:
+               break;
+           }
-       switch (wp_context->type) {
-       case CONNMAN_IPCONFIG_TYPE_IPV4:
-           connman_inet_del_host_route(route->if_index,
-                   route->address);
-           break;
-       case CONNMAN_IPCONFIG_TYPE_IPV6:
-           connman_inet_del_ipv6_host_route(route->if_index,
-                   route->address);
-           break;
-       case CONNMAN_IPCONFIG_TYPE_UNKNOWN:
-       case CONNMAN_IPCONFIG_TYPE_ALL:
-           break;
+           g_free(route->address);
+           g_free(route);
       }
-       g_free(route->address);
-       g_free(route);
-
       wp_context->route_list =
           g_slist_delete_link(wp_context->route_list,
                   wp_context->route_list);