Details
Description
This is reproducible by running the disabledItems() test in tst_QCompleter.
What happens is this:
The popup for the completer is shown, triggering a flush of window system events. In the queue, there is an event which will hide the popup. But the flush of events happens before we remove/add the window to the internal window stack.
This means that the remove for the window will come before the add, and thus the window stack will be in a corrupted state.
The popup ends up being added to the window stack twice, and when it's destroyed later, a dangling pointer to it remains in the stack. The application crashes when this is accessed later on.
I have not been able to reproduce this outside of the test, even when trying to replicate the order of events in the test, so it seems to be very sensitive to the synthetic test environment.