I can reproduce the heap-use-after-free, but not very reliably as it depends on timing (thus your machine, the code to process, ...).

What works here is:

1. Open tests/unit/unit.pro
2. Open clangcodemodelserver-test.cpp
3. Apply

 diff --git a/tests/unit/unittest/clangcodemodelserver-test.cpp b/tests/unit/unittest/clangcodemodelserver-test.cpp
index c74e2a96d8..38f571e69b 100644
--- a/tests/unit/unittest/clangcodemodelserver-test.cpp
+++ b/tests/unit/unittest/clangcodemodelserver-test.cpp
@@ -44,6 +44,7 @@
 
 #include <QCoreApplication>
 #include <QFile>
+#include <QTemporaryDir>
 
 using testing::Property;
 using testing::Contains;
@@ -189,6 +190,9 @@ TEST_F(ClangCodeModelServerSlowTest, GetCodeCompletion)
 
     expectCompletionFromFileA();
     requestCompletionsInFileA();
+
+    QTemporaryDir dir;
+    ASSERT_TRUE(dir.isValid();
 }
 
 TEST_F(ClangCodeModelServerSlowTest, RequestAnnotations)

1. Then remove and type the added "ASSERT_TRUE(", sometimes it's enough to remove and add "(". Vary the speed when doing so.

Sometimes "corrupted double-linked list" appears in the output.

Sometimes the clangbackend process does not react to anything. In this case an attached debugger shows that it tries to print some stacktrace but somehow deadlocks or so.

Note that reverting

• https://codereview.qt-project.org/#/c/240912/
• https://codereview.qt-project.org/#/c/240913/ 

helps - at least I do not see the heap-use-after-free with the address sanitizer build.