Cursor-related Crash With Qt5.2 on Macintosh

The attached project demonstrates a crash on Macintosh with Qt 5.2.

To create the crash

1. Build and run the program (I used 32-bit)
2. In the application's document window, click the document icon (on the left) to create a new window
3. Move the mouse back and forth over the two windows
4. A crash should occur within 15 seconds or so

The crash occurs in Debug and Release configurations.
The crash occurs on OS X 10.6.8, 10.7, 10.8 and OS X 10.9.
The crash occurs in 32 bits and 64 bits.

What the program is doing

The attached project is the example that ships at <QT>/qt/qtbase/examples/widgets/mainwindows/sdi with the following addition:

A timer fires every 50 milliseconds, causes CursorController::onTimeout to run, which executes this statement:

QApplication::setOverrideCursor(cursor);

where cursor is a QCursor loaded using:

cursor = QCursor(cursorBitmap, maskBitmap, 7, 7);

See CursorController.cpp for details.

This is a simplified example of "cursor animation" that we use in our real program.

Why it is crashing

I ran a much larger program in which I first found this crash under Xcode 4.2 with Enable Zombie Objects turned on. Xcode trapped and printed this in the debug console:

 -[ NSCursor set: ] message sent to deallocated instance 

I believe that Qt is indirectly causing a "set" message to be sent to a deallocated NSCursor. This may have something to do with "cursor rectangles". The stack crawl often includes the Cocoa internal routine handleCursorRect.

Every time any Qt::BitmapCursor cursor is applied qcocoacursor.mm calls:

[ cocoaCursor release ];

This occurs even if you are applying the same bitmap cursor over and over. This release may have something to do with the crash.

Other observations

The crash does not occur if I use a built-in Qt cursor instead of a cursor created from a PNG file. See CursorController.cpp for details.