Bug 408675

Unfortunately, the backtrace does not reveal much information. It seems related to timers firing while a menu was up (local event loop).

Relevant part of backtrace:

Thread 1 (Thread 0x7f21c2668340 (LWP 17420)):
[KCrash Handler]
#5  0x00007f21d127e208 in QBasicTimer::stop() () at /usr/lib/libQt5Core.so.5
#6  0x00007f21d202f6f1 in  () at /usr/lib/libQt5Widgets.so.5
#7  0x00007f21d202f7a8 in QMenu::enterEvent(QEvent*) () at /usr/lib/libQt5Widgets.so.5
#8  0x00007f21d1ed19b0 in QWidget::event(QEvent*) () at /usr/lib/libQt5Widgets.so.5
#9  0x00007f21d2033a9b in QMenu::event(QEvent*) () at /usr/lib/libQt5Widgets.so.5
#10 0x00007f21d1e84592 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () at /usr/lib/libQt5Widgets.so.5
#11 0x00007f21d1e8b378 in QApplication::notify(QObject*, QEvent*) () at /usr/lib/libQt5Widgets.so.5
#12 0x00007f21d1280708 in QCoreApplication::sendEvent(QObject*, QEvent*) () at /usr/lib/libQt5Core.so.5
#13 0x00007f21d1e89ce8 in  () at /usr/lib/libQt5Widgets.so.5
#14 0x00007f21d1ef0f62 in  () at /usr/lib/libQt5Widgets.so.5
#15 0x00007f21d1ef349f in  () at /usr/lib/libQt5Widgets.so.5
#16 0x00007f21d1e84592 in QApplicationPrivate::notify_helper(QObject*, QEvent*) () at /usr/lib/libQt5Widgets.so.5
#17 0x00007f21d1e8b378 in QApplication::notify(QObject*, QEvent*) () at /usr/lib/libQt5Widgets.so.5
#18 0x00007f21d12808c8 in QCoreApplication::sendSpontaneousEvent(QObject*, QEvent*) () at /usr/lib/libQt5Core.so.5
#19 0x00007f21d184df40 in QGuiApplicationPrivate::processMouseEvent(QWindowSystemInterfacePrivate::MouseEvent*) () at /usr/lib/libQt5Gui.so.5
#20 0x00007f21d184f93b in QGuiApplicationPrivate::processWindowSystemEvent(QWindowSystemInterfacePrivate::WindowSystemEvent*) () at /usr/lib/libQt5Gui.so.5
#21 0x00007f21d182082b in QWindowSystemInterface::sendWindowSystemEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib/libQt5Gui.so.5
#22 0x00007f21b555d9ba in  () at /usr/lib/libQt5XcbQpa.so.5
#23 0x00007f21c620a8dd in g_main_dispatch (context=0x7f21b0004fd0) at ../glib/gmain.c:3189
#24 0x00007f21c620a8dd in g_main_context_dispatch (context=context@entry=0x7f21b0004fd0) at ../glib/gmain.c:3854
#25 0x00007f21c620ab68 in g_main_context_iterate (context=context@entry=0x7f21b0004fd0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:3927
#26 0x00007f21c620abec in g_main_context_iteration (context=0x7f21b0004fd0, may_block=1) at ../glib/gmain.c:3988
#27 0x00007f21d12df0e0 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib/libQt5Core.so.5
#28 0x00007f21d127ee16 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /usr/lib/libQt5Core.so.5
#29 0x00007f21d202ccdd in QMenu::exec(QPoint const&, QAction*) () at /usr/lib/libQt5Widgets.so.5

*** Bug 418356 has been marked as a duplicate of this bug. ***

My wife has been hitting this crash regularly for the last few years.
Let's try to see what frame #6 might be.

One possibility would be:
#5  QMenuSloppyState::stopTimer() { m_time.stop(); }
    QMenuSloppyState::reset()
#6  QMenuSloppyState::enter()
#7  QMenu::enterEvent(QEvent*)

But for #5 to crash, `this` must be deleted, but then the other member vars accessed in reset() would crash too.

Alternatively, this comes from m_parent->childEnter().

#5  QMenuSloppyState::stopTimer() { m_time.stop(); }
    QMenuSloppyState::childEnter() on the parent
#6  QMenuSloppyState::enter()  calls m_parent->childEnter();
#7  QMenu::enterEvent(QEvent*)

This seems more likely, m_parent would be a dangling pointer. But m_parent only happens with submenus...
There are submenus in the "Reply" toolbutton, but the mouse is nowhere near those... or maybe that's what triggers it?

It's Qt bug, now it's fixed
https://bugreports.qt.io/browse/QTBUG-80528

This is excellent news, thanks!