Crash in QQuickItemPrivate::removeChild

In a project (KDE) I have a crash if the application exits whilst a QtQuickControls textbox has activeFocus.

GDB poking the child that was being removed twice was a TextHandle,
in QtQuickControls which is bound to the line:

    TextHandle {
        id: cursorHandle
        parent: !input.activeFocus || Qt.platform.os === "ios" ? control : Window.contentItem 

it seems that during teardown it got reparented, however it was still in the list of items to be removed.

Despite this all seeming to be in Qt, I was unable to reproduce it in a simpler test program.

#0 0x00007ffff2bfd295 in raise () from /usr/lib/libc.so.6
#1 0x00007ffff2bfe6da in abort () from /usr/lib/libc.so.6
#2 0x00007ffff38b7613 in qt_message_fatal (context=..., message=...) at /home/david/projects/qt5/qtbase/src/corelib/global/qlogging.cpp:1680
#3 0x00007ffff38b38ea in QMessageLogger::fatal (this=0x7fffffffa1d0, msg=0x7ffff3bee6f0 "ASSERT: \"%s\" in file %s, line %d")
at /home/david/projects/qt5/qtbase/src/corelib/global/qlogging.cpp:793
#4 0x00007ffff38aca2c in qt_assert (assertion=0x7ffff50d0901 "childItems.contains(child)",
file=0x7ffff50d00c0 "/run/media/david/15cbf614-32ad-44e8-9fdc-466f76304ed7/projects/qt5/qtdeclarative/src/quick/items/qquickitem.cpp", line=2933)
at /home/david/projects/qt5/qtbase/src/corelib/global/qglobal.cpp:3091
#5 0x00007ffff4eab97f in QQuickItemPrivate::removeChild (this=0x8d46b0, child=0xe8f020)
at /run/media/david/15cbf614-32ad-44e8-9fdc-466f76304ed7/projects/qt5/qtdeclarative/src/quick/items/qquickitem.cpp:2933
#6 0x00007ffff4eaad29 in QQuickItem::setParentItem (this=0xe8f020, parentItem=0x0)
at /run/media/david/15cbf614-32ad-44e8-9fdc-466f76304ed7/projects/qt5/qtdeclarative/src/quick/items/qquickitem.cpp:2695
#7 0x00007ffff4ebb4f0 in QQuickItem::qt_static_metacall (_o=0xe8f020, _c=QMetaObject::WriteProperty, _id=0, _a=0x7fffffffafb0) at .moc/moc_qquickitem.cpp:913
#8 0x00007ffff4ebba40 in QQuickItem::qt_metacall (this=0xe8f020, _c=QMetaObject::WriteProperty, _id=0, _a=0x7fffffffafb0) at .moc/moc_qquickitem.cpp:990
#9 0x00007ffff508ec66 in QQuickImplicitSizeItem::qt_metacall (this=0xe8f020, _c=QMetaObject::WriteProperty, _id=1, _a=0x7fffffffafb0) at .moc/moc_qquickimplicitsizeitem_p.cpp:150
#10 0x00007ffff4fb71b6 in QQuickLoader::qt_metacall (this=0xe8f020, _c=QMetaObject::WriteProperty, _id=1, _a=0x7fffffffafb0) at .moc/moc_qquickloader_p.cpp:298
#11 0x00007ffff497b478 in QQmlVMEMetaObject::metaCall (this=0xf58190, o=0xe8f020, c=QMetaObject::WriteProperty, _id=1, a=0x7fffffffafb0)
at /run/media/david/15cbf614-32ad-44e8-9fdc-466f76304ed7/projects/qt5/qtdeclarative/src/qml/qml/qqmlvmemetaobject.cpp:885
#12 0x00007ffff497b43f in QQmlVMEMetaObject::metaCall (this=0xf58e30, o=0xe8f020, c=QMetaObject::WriteProperty, _id=1, a=0x7fffffffafb0)
at /run/media/david/15cbf614-32ad-44e8-9fdc-466f76304ed7/projects/qt5/qtdeclarative/src/qml/qml/qqmlvmemetaobject.cpp:883
#13 0x00007ffff3b0feed in QMetaObject::metacall (object=0xe8f020, cl=QMetaObject::WriteProperty, idx=1, argv=0x7fffffffafb0)
at /home/david/projects/qt5/qtbase/src/corelib/kernel/qmetaobject.cpp:299
#14 0x00007ffff499899a in QQmlPropertyPrivate::write (object=0xe8f020, property=..., value=..., context=0xf558b0, flags=...)
at /run/media/david/15cbf614-32ad-44e8-9fdc-466f76304ed7/projects/qt5/qtdeclarative/src/qml/qml/qqmlproperty.cpp:1281
#15 0x00007ffff4998040 in QQmlPropertyPrivate::writeValueProperty (object=0xe8f020, core=..., value=..., context=0xf558b0, flags=...)
at /run/media/david/15cbf614-32ad-44e8-9fdc-466f76304ed7/projects/qt5/qtdeclarative/src/qml/qml/qqmlproperty.cpp:1183
#16 0x00007ffff4a20ac7 in QQmlBinding::write (this=0xf59260, core=..., result=..., isUndefined=false, flags=...)
at /run/media/david/15cbf614-32ad-44e8-9fdc-466f76304ed7/projects/qt5/qtdeclarative/src/qml/qml/qqmlbinding.cpp:333
#17 0x00007ffff4a1fa19 in QQmlBinding::update (this=0xf59260, flags=...) at /run/media/david/15cbf614-32ad-44e8-9fdc-466f76304ed7/projects/qt5/qtdeclarative/src/qml/qml/qqmlbinding.cpp:197
#18 0x00007ffff4a21098 in QQmlBinding::expressionChanged (this=0xf59260) at /run/media/david/15cbf614-32ad-44e8-9fdc-466f76304ed7/projects/qt5/qtdeclarative/src/qml/qml/qqmlbinding.cpp:404
#19 0x00007ffff4a18caf in QQmlJavaScriptExpressionGuard_callback (e=0xefe390)
at /run/media/david/15cbf614-32ad-44e8-9fdc-466f76304ed7/projects/qt5/qtdeclarative/src/qml/qml/qqmljavascriptexpression.cpp:430
#20 0x00007ffff49f4f57 in QQmlNotifier::emitNotify (endpoint=0x0, a=0x0) at /run/media/david/15cbf614-32ad-44e8-9fdc-466f76304ed7/projects/qt5/qtdeclarative/src/qml/qml/qqmlnotifier.cpp:100
#21 0x00007ffff4980323 in QQmlData::signalEmitted (object=0x1101650, index=6, a=0x0)
at /run/media/david/15cbf614-32ad-44e8-9fdc-466f76304ed7/projects/qt5/qtdeclarative/src/qml/qml/qqmlengine.cpp:780
#22 0x00007ffff3b47588 in QMetaObject::activate (sender=0x1101650, signalOffset=3, local_signal_index=3, argv=0x0) at /home/david/projects/qt5/qtbase/src/corelib/kernel/qobject.cpp:3618
#23 0x00007ffff3b473d4 in QMetaObject::activate (sender=0x1101650, m=0x7ffff524fe40 <QQuickWindowAttached::staticMetaObject>, local_signal_index=3, argv=0x0)
at /home/david/projects/qt5/qtbase/src/corelib/kernel/qobject.cpp:3602
#24 0x00007ffff50a0e5d in QQuickWindowAttached::contentItemChanged (this=0x1101650) at .moc/moc_qquickwindowattached_p.cpp:293
#25 0x00007ffff4ff7cda in QQuickWindowAttached::windowChange (this=0x1101650, window=0x0)
at /run/media/david/15cbf614-32ad-44e8-9fdc-466f76304ed7/projects/qt5/qtdeclarative/src/quick/items/qquickwindowattached.cpp:111
#26 0x00007ffff4ff86bc in QtPrivate::FunctorCall<QtPrivate::IndexesList<0>, QtPrivate::List<QQuickWindow*>, void, void (QQuickWindowAttached::)(QQuickWindow)>::call (f=
(void (QQuickWindowAttached::)(QQuickWindowAttached * const, QQuickWindow *)) 0x7ffff4ff7b4a <QQuickWindowAttached::windowChange(QQuickWindow)>, o=0x1101650, arg=0x7fffffffd7d0)
at /home/david/projects/qt5-build/qtbase/include/QtCore/../../../../qt5/qtbase/src/corelib/kernel/qobjectdefs_impl.h:141
#27 0x00007ffff4ff85f8 in QtPrivate::FunctionPointer<void (QQuickWindowAttached::)(QQuickWindow)>::call<QtPrivate::List<QQuickWindow*>, void> (f=
(void (QQuickWindowAttached::)(QQuickWindowAttached * const, QQuickWindow *)) 0x7ffff4ff7b4a <QQuickWindowAttached::windowChange(QQuickWindow)>, o=0x1101650, arg=0x7fffffffd7d0)
at /home/david/projects/qt5-build/qtbase/include/QtCore/../../../../qt5/qtbase/src/corelib/kernel/qobjectdefs_impl.h:160
#28 0x00007ffff4ff847e in QtPrivate::QSlotObject<void (QQuickWindowAttached::)(QQuickWindow), QtPrivate::List<QQuickWindow*>, void>::impl (which=1, this_=0x1105de0, r=0x1101650,
a=0x7fffffffd7d0, ret=0x0) at /home/david/projects/qt5-build/qtbase/include/QtCore/../../../../qt5/qtbase/src/corelib/kernel/qobject_impl.h:120
#29 0x00007ffff3b4ac29 in QtPrivate::QSlotObjectBase::call (this=0x1105de0, r=0x1101650, a=0x7fffffffd7d0) at ../../include/QtCore/../../../../qt5/qtbase/src/corelib/kernel/qobject_impl.h:101
#30 0x00007ffff3b47ab5 in QMetaObject::activate (sender=0xe8f020, signalOffset=3, local_signal_index=11, argv=0x7fffffffd7d0)
--Type <return> to continue, or q <return> to quit--
at /home/david/projects/qt5/qtbase/src/corelib/kernel/qobject.cpp:3723
#31 0x00007ffff3b473d4 in QMetaObject::activate (sender=0xe8f020, m=0x7ffff523b500 <QQuickItem::staticMetaObject>, local_signal_index=11, argv=0x7fffffffd7d0)
at /home/david/projects/qt5/qtbase/src/corelib/kernel/qobject.cpp:3602
#32 0x00007ffff4ebbe09 in QQuickItem::windowChanged (this=0xe8f020, _t1=0x0) at .moc/moc_qquickitem.cpp:1088
#33 0x00007ffff4eb15b5 in QQuickItem::itemChange (this=0xe8f020, change=QQuickItem::ItemSceneChange, value=...)
at /run/media/david/15cbf614-32ad-44e8-9fdc-466f76304ed7/projects/qt5/qtdeclarative/src/quick/items/qquickitem.cpp:5022
#34 0x00007ffff4eb38ba in QQuickItemPrivate::itemChange (this=0xf57f60, change=QQuickItem::ItemSceneChange, data=...)
at /run/media/david/15cbf614-32ad-44e8-9fdc-466f76304ed7/projects/qt5/qtdeclarative/src/quick/items/qquickitem.cpp:5990
#35 0x00007ffff4eac0fd in QQuickItemPrivate::derefWindow (this=0xf57f60)
at /run/media/david/15cbf614-32ad-44e8-9fdc-466f76304ed7/projects/qt5/qtdeclarative/src/quick/items/qquickitem.cpp:3050
#36 0x00007ffff4eaaded in QQuickItem::setParentItem (this=0xe8f020, parentItem=0x0)
at /run/media/david/15cbf614-32ad-44e8-9fdc-466f76304ed7/projects/qt5/qtdeclarative/src/quick/items/qquickitem.cpp:2709
#37 0x00007ffff4ea91ec in QQuickItem::~QQuickItem (this=0x6cdcd0, __in_chrg=<optimized out>)
at /run/media/david/15cbf614-32ad-44e8-9fdc-466f76304ed7/projects/qt5/qtdeclarative/src/quick/items/qquickitem.cpp:2363
#38 0x00007ffff5070f11 in QQuickRootItem::~QQuickRootItem (this=0x6cdcd0, __in_chrg=<optimized out>) at .moc/../../../../../qt5/qtdeclarative/src/quick/items/qquickwindow_p.h:78
#39 0x00007ffff5070f32 in QQuickRootItem::~QQuickRootItem (this=0x6cdcd0, __in_chrg=<optimized out>) at .moc/../../../../../qt5/qtdeclarative/src/quick/items/qquickwindow_p.h:78
#40 0x00007ffff4ed0645 in QQuickWindow::~QQuickWindow (this=0xa432a0, __in_chrg=<optimized out>)
at /run/media/david/15cbf614-32ad-44e8-9fdc-466f76304ed7/projects/qt5/qtdeclarative/src/quick/items/qquickwindow.cpp:1244
#41 0x00007ffff77925e0 in KQuickAddons::QuickViewSharedEngine::~QuickViewSharedEngine (this=0xa432a0, __in_chrg=<optimized out>)
at /home/david/projects/kde5/src/frameworks/kdeclarative/src/quickaddons/quickviewsharedengine.cpp:154
#42 0x00007ffff7792602 in KQuickAddons::QuickViewSharedEngine::~QuickViewSharedEngine (this=0xa432a0, __in_chrg=<optimized out>)
at /home/david/projects/kde5/src/frameworks/kdeclarative/src/quickaddons/quickviewsharedengine.cpp:156
#43 0x00000000004125aa in qDeleteAll<QList<KQuickAddons::QuickViewSharedEngine*>::const_iterator> (begin=..., end=...) at /opt/qt5/include/QtCore/qalgorithms.h:323
#44 0x0000000000411525 in qDeleteAll<QList<KQuickAddons::QuickViewSharedEngine*> > (c=...) at /opt/qt5/include/QtCore/qalgorithms.h:331
#45 0x000000000040ba4c in ScreenLocker::UnlockApp::~UnlockApp (this=0x7fffffffdec0, __in_chrg=<optimized out>)
at /home/david/projects/kde5/src/kde/workspace/kscreenlocker/greeter/greeterapp.cpp:115
#46 0x000000000041533b in main (argc=2, argv=0x7fffffffe2c8) at /home/david/projects/kde5/src/kde/workspace/kscreenlocker/greeter/main.cpp:79