QtWebengine 5.15 Wayland HTML select crash

Running QtWebengine 5.15 with Wayland platform.  Tested on iMX6.

load https://www.w3schools.com/tags/tryit.asp?filename=tryhtml_select

Make a selection and then resize browser.

1 wl_list_insert wayland-util.c 46 0x6d7e28b0
2 queue_event wayland-client.c 1390 0x6d7dfff0
3 read_events wayland-client.c 1469 0x6d7dfff0
4 wl_display_read_events wayland-client.c 1552 0x6d7dfff0
5 QtWaylandClient::QWaylandDisplay::flushRequests qwaylanddisplay.cpp 218 0x6d8673d0
6 doActivate<false> qobjectdefs_impl.h 395 0x763991b0
7 QMetaObject::activate qobject.cpp 3946 0x7639272c
8 QSocketNotifier::activated moc_qsocketnotifier.cpp 178 0x7639cd58
9 QSocketNotifier::event qsocketnotifier.cpp 302 0x7639d690
10 QApplicationPrivate::notify_helper qapplication.cpp 3630 0x76b32ca8
11 QApplication::notify qapplication.cpp 3376 0x76b3a2f4
12 QCoreApplication::notifyInternal2 qthread_p.h 325 0x76360058
13 QCoreApplication::sendEvent qcoreapplication.cpp 1458 0x76360244
14 socketNotifierSourceDispatch qeventdispatcher_glib.cpp 107 0x763c0474
15 g_main_dispatch gmain.c 3182 0x70f35d64
16 g_main_context_dispatch gmain.c 3847 0x70f35d64
17 g_main_context_iterate gmain.c 3920 0x70f35f50
18 g_main_context_iteration gmain.c 3981 0x70f36040
19 QEventDispatcherGlib::processEvents qeventdispatcher_glib.cpp 423 0x763bf6dc
20 QEventLoop::exec qflags.h 141 0x7635e8e0
... <More>

Valgrind output.  Unfortunately, I'm unable to get valgrind to complete when adding --track-origins=yes.

==933== Invalid read of size 4
==933== at 0xDFA2FE8: wl_display_read_events (in /usr/lib/libwayland-client.so.0.3.0)
==933== Address 0x1d0b1dc8 is 0 bytes inside a block of size 12 free'd
==933== at 0x484900C: free (vg_replace_malloc.c:530)
==933== by 0xDFA21DF: wl_event_queue_destroy (in /usr/lib/libwayland-client.so.0.3.0)
==933== Block was alloc'd at
==933== at 0x48479CC: malloc (vg_replace_malloc.c:299)
==933== by 0xDFA21FB: wl_display_create_queue (in /usr/lib/libwayland-client.so.0.3.0)
==933==
==933== Invalid read of size 4
==933== at 0xDFA58B0: wl_list_insert (in /usr/lib/libwayland-client.so.0.3.0)
==933== Address 0x1d0b1dcc is 4 bytes inside a block of size 12 free'd
==933== at 0x484900C: free (vg_replace_malloc.c:530)
==933== by 0xDFA21DF: wl_event_queue_destroy (in /usr/lib/libwayland-client.so.0.3.0)
==933== Block was alloc'd at
==933== at 0x48479CC: malloc (vg_replace_malloc.c:299)
==933== by 0xDFA21FB: wl_display_create_queue (in /usr/lib/libwayland-client.so.0.3.0)
==933==
==933== Invalid write of size 4
==933== at 0xDFA58B8: wl_list_insert (in /usr/lib/libwayland-client.so.0.3.0)
==933== Address 0x1d0b1dcc is 4 bytes inside a block of size 12 free'd
==933== at 0x484900C: free (vg_replace_malloc.c:530)
==933== by 0xDFA21DF: wl_event_queue_destroy (in /usr/lib/libwayland-client.so.0.3.0)
==933== Block was alloc'd at
==933== at 0x48479CC: malloc (vg_replace_malloc.c:299)
==933== by 0xDFA21FB: wl_display_create_queue (in /usr/lib/libwayland-client.so.0.3.0)
==933==
==933== Invalid write of size 4
==933== at 0xDFA58C0: wl_list_insert (in /usr/lib/libwayland-client.so.0.3.0)
==933== Address 0x1d0b1dc8 is 0 bytes inside a block of size 12 free'd
==933== at 0x484900C: free (vg_replace_malloc.c:530)
==933== by 0xDFA21DF: wl_event_queue_destroy (in /usr/lib/libwayland-client.so.0.3.0)
==933== Block was alloc'd at
==933== at 0x48479CC: malloc (vg_replace_malloc.c:299)
==933== by 0xDFA21FB: wl_display_create_queue (in /usr/lib/libwayland-client.so.0.3.0)
==933==