There was an assymmetry between comparesEqual() and qHash() that I was finally able to exploit: op== checks !d and d->isEmpty(), while qHash() only checks !d, and then goes over all the QString fields, hashing them.

This is a reproducer:

    QUrl null;
    QUrl other;
    other.setFragment("meep");
    other.setUrl(QString()); // doesn't overwrite d->fragment

    QCOMPARE_EQ(null, other);
    QCOMPARE_EQ(qHash(null), qHash(other)); // fails