Segfault when changing a QQmlListProperty

#include <QGuiApplication>

#include <QQuickView>
#include <QQmlEngine>
#include <QQmlContext>
#include <QTimer>

#include <qqmllist.h>

class ObjectsHolder : public QObject
{
    Q_OBJECT
    Q_PROPERTY(QQmlListProperty<QObject> objects READ objects NOTIFY objectsChanged)
public:
    ObjectsHolder(QQuickView *quickWidget, QObject *parent = 0)
        : QObject(parent)
    {
        QQmlContext *context = quickWidget->engine()->rootContext();
        context->setContextProperty("holder", this);

        QTimer::singleShot(500, this, SLOT(changeObjects()));
        QTimer::singleShot(1000, this, SLOT(changeObjects()));
    }

    QQmlListProperty<QObject> objects()
    {
        return QQmlListProperty<QObject>(this, m_objects);
    }

private slots:
    void changeObjects()
    {
        qDeleteAll(m_objects);
        m_objects.clear();

        for (int i = 0; i < 2; ++i) {
            QObject* o = new QObject;
            static int num = 0;
            o->setObjectName("object-" + QString::number(num));
            ++num;
            m_objects.push_back(o);
        }
        emit objectsChanged();
    }

signals:
    void objectsChanged();

private:
    QQuickView *m_quickWidget;
    QList<QObject*> m_objects;
};

int main(int argc, char *argv[])
{
    QGuiApplication a(argc, argv);

    QQuickView quickWidget;

    ObjectsHolder oh(&quickWidget);

    quickWidget.setSource(QUrl("main.qml"));
    quickWidget.show();

    return a.exec();
}

#include "main.moc"

$ lldb -- ./tmp.app/Contents/MacOS/tmp 
Current executable set to './tmp.app/Contents/MacOS/tmp' (x86_64).
(lldb) r
Process 95372 launched: './tmp.app/Contents/MacOS/tmp' (x86_64)
QSGThreadedRenderLoop: expose event received for window with invalid geometry.
Process 95372 stopped
* thread #1: tid = 0x40e9d3, 0x0000000101abfaa0 QtCore_debug`QMetaObject::cast(this=0x0000000102917da0, obj=0x00000001033bfba0) const + 48 at qmetaobject.cpp:331, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
    frame #0: 0x0000000101abfaa0 QtCore_debug`QMetaObject::cast(this=0x0000000102917da0, obj=0x00000001033bfba0) const + 48 at qmetaobject.cpp:331
   328 	QObject *QMetaObject::cast(QObject *obj) const
   329 	{
   330 	    if (obj) {
-> 331 	        const QMetaObject *m = obj->metaObject();
   332 	        do {
   333 	            if (m == this)
   334 	                return obj;
(lldb) bt
* thread #1: tid = 0x40e9d3, 0x0000000101abfaa0 QtCore_debug`QMetaObject::cast(this=0x0000000102917da0, obj=0x00000001033bfba0) const + 48 at qmetaobject.cpp:331, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
  * frame #0: 0x0000000101abfaa0 QtCore_debug`QMetaObject::cast(this=0x0000000102917da0, obj=0x00000001033bfba0) const + 48 at qmetaobject.cpp:331
    frame #1: 0x0000000102758baf QtQml_debug`QQmlDelegateModelItem* qobject_cast<QQmlDelegateModelItem*>(object=0x00000001033bfba0) + 31 at qobject.h:520
    frame #2: 0x0000000102748c3f QtQml_debug`QQmlDelegateModelItem::dataForObject(object=0x00000001033c3170) + 175 at qqmldelegatemodel.cpp:1972
    frame #3: 0x0000000102748add QtQml_debug`QQmlDelegateModelPrivate::release(this=0x000000010344b6b0, object=0x00000001033c3170) + 77 at qqmldelegatemodel.cpp:509
    frame #4: 0x0000000102748ffa QtQml_debug`QQmlDelegateModel::release(this=0x000000010344b1c0, item=0x00000001033c3170) + 42 at qqmldelegatemodel.cpp:533
    frame #5: 0x00000001002b15bd QtQuick_debug`QQuickItemViewPrivate::releaseItem(this=0x0000000104834600, item=0x00000001033dbce0) + 189 at qquickitemview.cpp:2350
    frame #6: 0x00000001002439c9 QtQuick_debug`QQuickListViewPrivate::releaseItem(this=0x0000000104834600, item=0x00000001033dbce0) + 105 at qquicklistview.cpp:604
    frame #7: 0x00000001002aeeb2 QtQuick_debug`QQuickItemViewPrivate::clear(this=0x0000000104834600) + 146 at qquickitemview.cpp:1685
    frame #8: 0x000000010024331d QtQuick_debug`QQuickListViewPrivate::clear(this=0x0000000104834600) + 253 at qquicklistview.cpp:553
    frame #9: 0x00000001002a7465 QtQuick_debug`QQuickItemView::setModel(this=0x0000000103441530, model=0x00007fff5fbfc9f0) + 565 at qquickitemview.cpp:291
    frame #10: 0x0000000100370e7d QtQuick_debug`QQuickItemView::qt_metacall(this=0x0000000103441530, _c=WriteProperty, _id=0, _a=0x00007fff5fbfc400) + 1053 at moc_qquickitemview_p.cpp:817
    frame #11: 0x0000000100355963 QtQuick_debug`QQuickListView::qt_metacall(this=0x0000000103441530, _c=WriteProperty, _id=78, _a=0x00007fff5fbfc400) + 51 at moc_qquicklistview_p.cpp:576
    frame #12: 0x0000000101abfa15 QtCore_debug`QMetaObject::metacall(object=0x0000000103441530, cl=WriteProperty, idx=78, argv=0x00007fff5fbfc400) + 165 at qmetaobject.cpp:295
    frame #13: 0x000000010263775b QtQml_debug`QQmlPropertyPrivate::write(object=0x0000000103441530, property=0x000000010344bc08, value=0x00007fff5fbfc9f0, context=0x0000000103406b30, flags=QQmlPropertyPrivate::WriteFlags at 0x00007fff5fbfc598) + 1643 at qqmlproperty.cpp:1314
    frame #14: 0x00000001026370d9 QtQml_debug`QQmlPropertyPrivate::writeValueProperty(object=0x0000000103441530, core=0x000000010344bc08, value=0x00007fff5fbfc9f0, context=0x0000000103406b30, flags=QQmlPropertyPrivate::WriteFlags at 0x00007fff5fbfc698) + 601 at qqmlproperty.cpp:1238
    frame #15: 0x00000001026398cd QtQml_debug`QQmlPropertyPrivate::writeBinding(object=0x0000000103441530, core=0x000000010344bc08, context=0x0000000103406b30, expression=0x000000010344bbd0, result=const QV4::ValueRef at 0x00007fff5fbfcb28, isUndefined=false, flags=QQmlPropertyPrivate::WriteFlags at 0x00007fff5fbfcb20) + 3565 at qqmlproperty.cpp:1571
    frame #16: 0x00000001026db8a1 QtQml_debug`QQmlBinding::update(this=0x000000010344bbb0, flags=QQmlPropertyPrivate::WriteFlags at 0x00007fff5fbfcd08) + 1441 at qqmlbinding.cpp:229
    frame #17: 0x00000001026dc5e1 QtQml_debug`QQmlBinding::update(this=0x000000010344bbb0) + 49 at qqmlbinding_p.h:97
    frame #18: 0x00000001026dbf78 QtQml_debug`QQmlBinding::expressionChanged(e=0x000000010344bbd0) + 88 at qqmlbinding.cpp:291
    frame #19: 0x00000001026cfe2f QtQml_debug`QQmlJavaScriptExpressionGuard_callback(e=0x0000000104845448, (null)=0x0000000000000000) + 47 at qqmljavascriptexpression.cpp:363
    frame #20: 0x00000001026a9e70 QtQml_debug`QQmlNotifier::emitNotify(endpoint=0x0000000104845448, a=0x0000000000000000) + 256 at qqmlnotifier.cpp:73
    frame #21: 0x000000010261723f QtQml_debug`QQmlData::signalEmitted((null)=0x000000010344bda0, object=0x00007fff5fbff8a8, index=3, a=0x0000000000000000) + 1183 at qqmlengine.cpp:709
    frame #22: 0x0000000101b0e117 QtCore_debug`QMetaObject::activate(sender=0x00007fff5fbff8a8, signalOffset=3, local_signal_index=0, argv=0x0000000000000000) + 247 at qobject.cpp:3602
    frame #23: 0x0000000101b0e00d QtCore_debug`QMetaObject::activate(sender=0x00007fff5fbff8a8, m=0x0000000100009510, local_signal_index=0, argv=0x0000000000000000) + 61 at qobject.cpp:3582
    frame #24: 0x0000000100004a8b tmp`ObjectsHolder::objectsChanged(this=0x00007fff5fbff8a8) + 43 at main.moc:173
    frame #25: 0x0000000100005053 tmp`ObjectsHolder::changeObjects(this=0x00007fff5fbff8a8) + 371 at main.cpp:44
    frame #26: 0x000000010000498b tmp`ObjectsHolder::qt_static_metacall(_o=0x00007fff5fbff8a8, _c=InvokeMetaMethod, _id=1, _a=0x00007fff5fbfd770) + 107 at main.moc:84
    frame #27: 0x0000000101b0eb9f QtCore_debug`QMetaObject::activate(sender=0x000000010353ebe0, signalOffset=3, local_signal_index=0, argv=0x0000000000000000) + 2943 at qobject.cpp:3716
    frame #28: 0x0000000101b0e00d QtCore_debug`QMetaObject::activate(sender=0x000000010353ebe0, m=0x0000000101e9c570, local_signal_index=0, argv=0x0000000000000000) + 61 at qobject.cpp:3582
    frame #29: 0x0000000101b1e10b QtCore_debug`QSingleShotTimer::timeout(this=0x000000010353ebe0) + 43 at qtimer.moc:122
    frame #30: 0x0000000101b1e0ae QtCore_debug`QSingleShotTimer::timerEvent(this=0x000000010353ebe0, (null)=0x00007fff5fbfdca0) + 254 at qtimer.cpp:318
    frame #31: 0x0000000101b06262 QtCore_debug`QObject::event(this=0x000000010353ebe0, e=0x00007fff5fbfdca0) + 306 at qobject.cpp:1226
    frame #32: 0x0000000101ab5a58 QtCore_debug`QCoreApplicationPrivate::notify_helper(this=0x00000001034051e0, receiver=0x000000010353ebe0, event=0x00007fff5fbfdca0) + 136 at qcoreapplication.cpp:1049
    frame #33: 0x0000000101ab59aa QtCore_debug`QCoreApplication::notify(this=0x00007fff5fbff900, receiver=0x000000010353ebe0, event=0x00007fff5fbfdca0) + 186 at qcoreapplication.cpp:994
    frame #34: 0x0000000100ad2a38 QtGui_debug`QGuiApplication::notify(this=0x00007fff5fbff900, object=0x000000010353ebe0, event=0x00007fff5fbfdca0) + 264 at qguiapplication.cpp:1555
    frame #35: 0x0000000101ab586f QtCore_debug`QCoreApplication::notifyInternal(this=0x00007fff5fbff900, receiver=0x000000010353ebe0, event=0x00007fff5fbfdca0) + 207 at qcoreapplication.cpp:932
    frame #36: 0x0000000101aba8b4 QtCore_debug`QCoreApplication::sendEvent(receiver=0x000000010353ebe0, event=0x00007fff5fbfdca0) + 84 at qcoreapplication.h:228
    frame #37: 0x0000000101b55f3c QtCore_debug`QTimerInfoList::activateTimers(this=0x0000000103303180) + 732 at qtimerinfo_unix.cpp:635
    frame #38: 0x0000000106c379e4 libqcocoa_debug.dylib`QCocoaEventDispatcherPrivate::activateTimersSourceCallback(info=0x0000000103303100) + 36 at qcocoaeventdispatcher.mm:129
    frame #39: 0x00007fff8f4105b1 CoreFoundation`__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
    frame #40: 0x00007fff8f401c62 CoreFoundation`__CFRunLoopDoSources0 + 242
    frame #41: 0x00007fff8f4013ef CoreFoundation`__CFRunLoopRun + 831
    frame #42: 0x00007fff8f400e75 CoreFoundation`CFRunLoopRunSpecific + 309
    frame #43: 0x00007fff872e6a0d HIToolbox`RunCurrentEventLoopInMode + 226
    frame #44: 0x00007fff872e67b7 HIToolbox`ReceiveNextEventCommon + 479
    frame #45: 0x00007fff872e65bc HIToolbox`_BlockUntilNextEventMatchingListInModeWithFilter + 65
    frame #46: 0x00007fff8fe3624e AppKit`_DPSNextEvent + 1434
    frame #47: 0x00007fff8fe3589b AppKit`-[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 122
    frame #48: 0x00007fff8fe2999c AppKit`-[NSApplication run] + 553
    frame #49: 0x0000000106c38733 libqcocoa_debug.dylib`QCocoaEventDispatcher::processEvents(this=0x00000001033015f0, flags=QEventLoop::ProcessEventsFlags at 0x00007fff5fbff670) + 1155 at qcocoaeventdispatcher.mm:426
    frame #50: 0x0000000101ab108a QtCore_debug`QEventLoop::processEvents(this=0x00007fff5fbff800, flags=QEventLoop::ProcessEventsFlags at 0x00007fff5fbff6a8) + 122 at qeventloop.cpp:128
    frame #51: 0x0000000101ab12c1 QtCore_debug`QEventLoop::exec(this=0x00007fff5fbff800, flags=QEventLoop::ProcessEventsFlags at 0x00007fff5fbff778) + 545 at qeventloop.cpp:204
    frame #52: 0x0000000101ab6039 QtCore_debug`QCoreApplication::exec() + 393 at qcoreapplication.cpp:1185
    frame #53: 0x0000000100ad2926 QtGui_debug`QGuiApplication::exec() + 22 at qguiapplication.cpp:1534
    frame #54: 0x0000000100004807 tmp`main(argc=1, argv=0x00007fff5fbff948) + 215 at main.cpp:66
    frame #55: 0x0000000100004724 tmp`start + 52