## What happened

Quickshell (the Omarchy shell) segfaulted twice in one session, ~36 minutes apart, both times immediately after opening omarchy-menu (Hyprland IPC logged `openlayer>>omarchy-menu` right before each crash). The second crash is quickshell's own automatic crash-relaunch of itself, crashing again on the same trigger — so this is one bug firing twice, not two separate incidents.

Both crash reports (written by quickshell's built-in crash handler) show the same shape:

```
key press → QQuickKeysAttached::keyPressed
  → QML/JS calls (JIT-compiled, unresolvable)
    → QQmlListModel::append()
      → QQmlBinding::update() (property binding notified by the append)
        → more JIT-compiled JS calls
          → SIGSEGV inside JIT-generated code
```

This matches `plugins/menu/Menu.qml`'s `Keys.onPressed` handler (around line 1075): any printable keystroke calls `root.setFilter()`, which drives `rebuildDisplay()` / `rebuildDmenuDisplay()` (lines ~510–640). Both of those do `displayModel.clear()` followed by a loop of `displayModel.append(row)` for each matching entry — exactly the call shape in the crash.

The actual faulting frames are inside Qt's V4 JIT-generated code (no symbol, no library — `n/a (n/a+0x0)`), so I can't point at the exact defective line; it may be a Qt QML engine bug rather than something wrong in `Menu.qml` itself, but the trigger path is entirely through Omarchy's bundled shell config (`/usr/share/omarchy/shell/shell.qml`), not a user config.

## Expected

Typing into the omarchy-menu search box filters the list without crashing quickshell.

## Steps to reproduce

1. Open omarchy-menu.
2. Type a character to filter the list.
3. (Intermittent — reproduced twice in one session, not on every keystroke.)

## System info

- Omarchy: 4.0.0-1
- quickshell-git: 0.3.0.r20.g28771c7-1 (installed same day as the crash, as part of a fresh Omarchy install)
- qt6-declarative: 6.11.1-3
- qt6-base: 6.11.1-1
- GPU: hybrid — AMD (amdgpu, PCI 03:00.0, 1002:7424) + Intel (i915, PCI 00:02.0, 8086:a780)
- No memory pressure at crash time (14G free, no OOM kill in journal)

## Stack trace (crash 1, PID 18800, 2026-08-16 20:21:31)

<details>
<summary>Full symbolized backtrace</summary>

```
Signal: Segmentation fault (11)
Config Path: /usr/share/omarchy/shell/shell.qml

#0  0x00007fa36403e6ef at /usr/bin/../lib/libc.so.6
#1  0x00007fa36577c69c at /usr/bin/../lib/libQt6Qml.so.6
#2  0x00007fa36546a70c at /usr/bin/../lib/libQt6Qml.so.6
#3  0x00007fa3653b8776 at /usr/bin/../lib/libQt6Qml.so.6
#4  QV4::Runtime::CallPropertyLookup::call(...) at libQt6Qml.so.6
#5  0x00007fa340226bc6  (JIT-compiled, unresolvable)
#6  0x00007fa36546a70c at libQt6Qml.so.6
#7  0x00007fa3653b8776 at libQt6Qml.so.6
#8  QV4::Runtime::CallQmlContextPropertyLookup::call(...) at libQt6Qml.so.6
#9  0x00007fa3402262c6  (JIT-compiled, unresolvable)
#10 0x00007fa36546a70c at libQt6Qml.so.6
#11 0x00007fa3653aa173 at libQt6Qml.so.6
#12 QQmlJavaScriptExpression::evaluate(...) at libQt6Qml.so.6
#13 QQmlBinding::evaluate(bool*) at libQt6Qml.so.6
#14 QQmlBinding::doUpdate(...) at libQt6Qml.so.6
#15 QQmlBinding::update(...) at libQt6Qml.so.6
#16 QQmlNotifier::emitNotify(...) at libQt6Qml.so.6
#17 0x00007fa3649f077e at libQt6Core.so.6
#18 QQmlListModel::append(QQmlV4Function*) at libQt6QmlModels.so.6
#19 QQmlListModel::qt_metacall(...) at libQt6QmlModels.so.6
#20 0x00007fa365567362 at libQt6Qml.so.6
#21 QV4::QObjectMethod::callInternal(...) const at libQt6Qml.so.6
#22 QV4::Runtime::CallPropertyLookup::call(...) at libQt6Qml.so.6
#23 0x00007fa340210066  (JIT-compiled, unresolvable)
#24 0x00007fa36546a70c at libQt6Qml.so.6
#25 0x00007fa3653b8776 at libQt6Qml.so.6
#26 QV4::Runtime::CallPropertyLookup::call(...) at libQt6Qml.so.6
#27 0x00007fa350be6c3c  (JIT-compiled, unresolvable)
#28 0x00007fa36546a70c at libQt6Qml.so.6
#29 0x00007fa3653b8776 at libQt6Qml.so.6
#30 QV4::Runtime::CallPropertyLookup::call(...) at libQt6Qml.so.6
#31 0x00007fa350be9b47  (JIT-compiled, unresolvable)
#32 0x00007fa36546a70c at libQt6Qml.so.6
#33 0x00007fa3653aa173 at libQt6Qml.so.6
#34 QV4::Function::call(...) at libQt6Qml.so.6
#35 QQmlJavaScriptExpression::evaluate(...) at libQt6Qml.so.6
#36 QQmlBoundSignalExpression::evaluate(...) at libQt6Qml.so.6
#37 0x00007fa3654b2000 at libQt6Qml.so.6
#38 QQmlNotifier::emitNotify(...) at libQt6Qml.so.6
#39 0x00007fa3649f077e at libQt6Core.so.6
#40 QQuickKeysAttached::keyPressed(QKeyEvent*, bool) at libQt6Quick.so.6
#41 QQuickItemPrivate::filterKeyEvent(...) at libQt6Quick.so.6
#42 QQuickItemPrivate::deliverKeyEvent(...) at libQt6Quick.so.6
#43 QQuickItem::event(QEvent*) at libQt6Quick.so.6
#44 QCoreApplication::notifyInternal2(...) at libQt6Core.so.6
#45 QQuickDeliveryAgentPrivate::deliverKeyEvent(...) at libQt6Quick.so.6
#46 QWindow::event(QEvent*) at libQt6Gui.so.6
#47 QCoreApplication::notifyInternal2(...) at libQt6Core.so.6
#48 QGuiApplicationPrivate::processKeyEvent(...) at libQt6Gui.so.6
#49 QWindowSystemInterface::sendWindowSystemEvents(...) at libQt6Gui.so.6
#50 0x00007fa365f83523 at libQt6Gui.so.6
#51-53 glib main context iteration (libglib-2.0.so.0)
#54 QEventDispatcherGlib::processEvents(...) at libQt6Core.so.6
#55 QEventLoop::exec(...) at libQt6Core.so.6
#56 QCoreApplication::exec() at libQt6Core.so.6
#57 qs::launch::launch(...) at quickshell/src/launch/launch.cpp:320:35
#58 launchFromCommand at quickshell/src/launch/command.cpp:482:15
#59 qs::launch::runCommand(...) at quickshell/src/launch/command.cpp:580:27
#60 qs::launch::main(int, char**) at quickshell/src/launch/main.cpp:130:24
#61 main at quickshell/src/main.cpp:3:58
```

Log tail immediately before crash:
```
20:21:29.000 INFO  quickshell.ipc: New IPC connection ...
20:21:29.000 DEBUG quickshell.hyprland.ipc.events: Received event: "openlayer>>omarchy-menu" parsed as "openlayer" "omarchy-menu"
```

</details>

## Stack trace (crash 2, PID 32680, 2026-08-16 20:57:38 AEST — quickshell's own auto-relaunch, crashing again on the same trigger)

<details>
<summary>Full symbolized backtrace</summary>

```
Signal: Segmentation fault (11)
Config Path: /usr/share/omarchy/shell/shell.qml

(identical shape to crash 1 through the QML/JIT chain, same frames:
 QQuickKeysAttached::keyPressed → ... → QV4::Runtime::CallPropertyLookup::call
 → QQmlListModel::append → QQmlListModel::qt_metacall → ... →
 QQmlBinding::update → QQmlNotifier::emitNotify → JIT-compiled JS → SIGSEGV)

#57 qs::launch::launch(...) at quickshell/src/launch/launch.cpp:320:35
#58 checkCrashRelaunch at quickshell/src/launch/main.cpp:74:10
#59 qs::launch::main(int, char**) at quickshell/src/launch/main.cpp:129:20
#60 main at quickshell/src/main.cpp:3:58
```

Log tail immediately before crash:
```
20:57:35.000 DEBUG quickshell.hyprland.ipc.events: Received event: "closelayer>>omarchy-menu" parsed as "closelayer" "omarchy-menu"
20:57:36.000 INFO  quickshell.ipc: New IPC connection ...
20:57:36.000 DEBUG quickshell.hyprland.ipc.events: Received event: "openlayer>>omarchy-menu" parsed as "openlayer" "omarchy-menu"
```

</details>

---
Filed by Claude Sonnet 5 via Claude Code.