[launcher] crash when removing favorites or closing applications

I cannot reproduce it with latest trunk.

I don't have any 100% sure way to reproduce it, but essentially for me it still happens pretty reliably every 3 or 4 applications i remove from the launcher in sequence (either by removing the favorites or just quitting the app from the context menu).
It seems to happen much more if you have many applications in launcher and you start removing from near the bottom, but it happened also starting from the top.

Here's a slightly more useful backtrace:

0 main_arena /lib/libc.so.6 0 0x7ffff4bc5678
1 cache qdeclarativeengine_p.h 341 0x7ffff7aad620
2 QDeclarativePropertyCache::property qdeclarativepropertycache.cpp 402 0x7ffff7aad620
3 QDeclarativeObjectScriptClass::queryProperty qdeclarativeobjectscriptclass.cpp 167 0x7ffff7ab1d51
4 QDeclarativeObjectScriptClass::queryProperty qdeclarativeobjectscriptclass.cpp 147 0x7ffff7ab1f3b
5 QScript::DeclarativeObjectDelegate::getOwnPropertySlot qscriptdeclarativeobject.cpp 74 0x7ffff457c78e
6 fastGetOwnPropertySlot JSObject.h 382 0x7ffff440cb5e
7 QTJSC::JSValue::get JSObject.h 618 0x7ffff440cb5e
8 QTJSC::cti_op_get_by_id_generic JITStubs.cpp 1228 0x7ffff44460cf
9 ?? 0 0x7fffcfc693e3
10 ?? 0

Please note that I also get sometimes the same stack trace as Bug 725103 while removing favorites or closing applications from the launcher (which is a different stack trace).

Since it seems to be related to animations, I tried removing the ListView.onRemoved animation and I can't reproduce the bug anymore even after removing dozens of applications, so I'm pretty sure they are somehow linked.

I'm unsure about how to proceed, any advice would be welcome at this point.

Just thinking out loud here: could it be linked to the fact that we request a delay in the removal, and somehow it is still removed too early?

in launcher/LauncherList.qml:

ListView.onRemove: SequentialAnimation {
    PropertyAction { target: launcherItem; property: "ListView.delayRemove"; value: true }
    […]
    PropertyAction { target: launcherItem; property: "ListView.delayRemove"; value: false }
}

I doubt that, since ListView.delayRemove is designed to be used exactly that way.
I think our usage is lifted pretty much straight from the docs, actually, or from QT's own example code.

Florian, attached you can find the full backtrace as you requested.

To reproduce the crash everytime, you can raise the duration of the animation that makes a launcher item disappear and then move the mouse over entering and exiting the item that is going away (or just don't touch the duration and be very rather quick).

The crash itself is caused by what seems like a bug in QT itself.
Basically accessing some properties of a model item from a delegate that's being kept alive with ListView.delayRemove causes a SEGV in QT itself.
I couldn't find any related bug in the QT bugtracker, but I may later try to make a minimal test case to see if it can be reproduced and submit it.

A fix to the launcher have beens submitted for review in the meantime.