This indeed seems to be a Qt painting bug. We received a report about Dolphin crashing in the same painting code at Launchpad: https://launchpad.net/bugs/465433

#0  0x00707422 in __kernel_vsyscall ()
No symbol table info available.
#1  0x0914f4d1 in *__GI_raise (sig=6)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
	resultvar = <value optimized out>
	pid = 153505780
	selftid = 2375
#2  0x09152932 in *__GI_abort () at abort.c:92
	act = {__sigaction_handler = {sa_handler = 0x107, 
    sa_sigaction = 0x107}, sa_mask = {__val = {3214100124, 153254968, 
      5026404, 0, 134619144, 134546192, 0, 48666, 3214100272, 134525168, 
      134522696, 263, 5027440, 153000561, 263, 134619144, 3214100200, 
      153505780, 37, 3214101656, 3214100316, 153118100, 2, 3214100200, 4, 0, 
      3, 3214100308, 2, 153379555, 153379551, 153375127}}, 
  sa_flags = 153375101, sa_restorer = 0x924762b}
	sigs = {__val = {32, 0 <repeats 31 times>}}
#3  0x09185ee5 in __libc_message (do_abort=2, 
    fmt=0x9249438 "*** glibc detected *** %s: %s: 0x%s ***\n")
    at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
	ap = <value optimized out>
	fd = -1080866668
	on_2 = <value optimized out>
	list = <value optimized out>
	nlist = <value optimized out>
	cp = <value optimized out>
	written = false
#4  0x0918fff1 in malloc_printerr (action=<value optimized out>, 
    str=0x6 <Address 0x6 out of bounds>, ptr=0x9c774f0) at malloc.c:6217
	buf = "09c774f0"
	cp = <value optimized out>
#5  0x0919021e in malloc_consolidate (av=<value optimized out>)
    at malloc.c:5095
	fb = (mfastbinptr *) 0x92663ac
	maxfb = (mfastbinptr *) 0x92663cc
	p = (mchunkptr) 0x9c774f0
	nextp = (mchunkptr) 0x9fdd7b0
	unsorted_bin = (mchunkptr) 0x92663d0
	first_unsorted = <value optimized out>
	nextchunk = (mchunkptr) 0x9c77518
	size = <value optimized out>
	nextsize = <value optimized out>
	prevsize = <value optimized out>
	bck = <value optimized out>
	fwd = <value optimized out>
	__PRETTY_FUNCTION__ = "malloc_consolidate"
#6  0x091924b2 in _int_malloc (av=<value optimized out>, 
    bytes=<value optimized out>) at malloc.c:4338
	nb = 664
	idx = 3214111652
	bin = <value optimized out>
	victim = <value optimized out>
	size = <value optimized out>
	victim_index = <value optimized out>
	remainder = <value optimized out>
	remainder_size = <value optimized out>
	block = <value optimized out>
	bit = <value optimized out>
	map = <value optimized out>
	fwd = <value optimized out>
	bck = <value optimized out>
	__PRETTY_FUNCTION__ = "_int_malloc"
#7  0x09194868 in *__GI___libc_malloc (bytes=660) at malloc.c:3638
	ar_ptr = (mstate) 0x92663a0
	victim = <value optimized out>
	__PRETTY_FUNCTION__ = "__libc_malloc"
#8  0x0248ad5b in PolygonRegion (Pts=<value optimized out>, 
    Count=<value optimized out>, rule=0) at painting/qregion.cpp:3605
	region = (QRegionPrivate *) 0x9fb1fa0
	pAET = <value optimized out>
	y = 167652544
	pETEs = <value optimized out>
	pPrevAET = <value optimized out>
	fixWAET = 165053616
	FirstPtBlock = {data = {0, 0, 167641848, 137280097, 167642260, 
    167117772, -1080864786, 4311995, -1080864804, -1080864808, 4315800, 
    -1080864792, -1080864832, -1080864800, 167117728, 222, 167641856, 0, 
    167642264, 167642264, 167475664, 163174936, -1080864760, 96, 17407988, 2, 
    152642430, 45654004, 209, 24, 806, 722, 166856368, 16, 166852200, 0, 
    28671255, 167642256, 28676377, 165100680, 165026744, 12, 0, 153505780, 
    160115344, 153086304, -1080864760, 153086358, 160115348, 51634164, 
    -1080864696, 51129667, 160115348, 152651880, -1080864664, 139276276, 0, 
    159989360, -1080864664, 6905844, 12, 159989360, -1080864664, 139276276, 
    159989320, 159989360, -1080864664, 138460509, 160115344, -1080864600, 0, 
    139276276, 139276276, 139276276, -1080864552, 138286194, 159988272, 0, 
    -1080864580, -1080864600, 16, 159989320, 153510816, 0, 0, 153505780, 
    163641684, 159989360, 159989320, 353, 159989344, 163641688, 1, 3707808, 
    159989372, 6905844, 12, 167436912, -1080864520, 139276276, 167591152, 
    167436912, -1080864520, 138286652, 167475664, 167591152, 0, 139276276, 
    167475664, 139276276, -1080864472, 138349236, 167475664, 167591152, 3, 
    -1080864488, 167475664, 167220528, 0, -1080864460, 17407988, 167475664, 
    -1080864440, 15926397, 167475664, 167475664, -1080864312, 3735540, 
    3735540, 167475664, -1080864280, 1939040, 167475664, 3735540, 
    -1080864360, 1867551, 152642430, 167442424, -1080864360, 152637974, 
    167475664, 3707808, 0, 167629340, -1080864136, 0, -1080864348, 3735540, 
    167442424, 152637974, -1080864136, 33, -1080864184, 167629320, 40, 
    17407988, 25, 167475664, 153510816, 17407988, 0, 167475664, -1080864248, 
    15921562, 167475664, 0, 41, 1032, 153510816, 153505780, 153510816, 
    163608004, -1080864248, 152651677, 152642738, 3735540, 139276276, 
    163608004, -1080864216, 137279117, 163607984, 152637974, 43, 138202671, 
    137279097, 139276276, -1080864168, 137332094, 163607984, 139276276, 
    -1080864136, 138364478, 167449440, 153505780, -1080864104, 139276276, 
    167449416, 167449416, 161, 16...}, pts = 0xbf934f40, next = 0x9c73f38}
	curPtBlock = <value optimized out>
	iPts = <value optimized out>
	pWETE = <value optimized out>
	pts = <value optimized out>
	SLLBlock = {SLLs = {{scanline = 160154304, edgelist = 0x9b9db4c, 
      next = 0x98cbff0}, {scanline = 83820532, edgelist = 0xbf936868, 
      next = 0x2b89ff4}, {scanline = 8, edgelist = 0x9c80f08, 
      next = 0xbf9368a8}, {scanline = 37360376, edgelist = 0x9c73f38, 
      next = 0x8}, {scanline = 1, edgelist = 0x1, next = 0xc0043c0}, {
      scanline = 164105968, edgelist = 0xbf9368d8, next = 0x24a0b58}, {
      scanline = -1080858240, edgelist = 0x0, next = 0x3ff00000}, {
      scanline = 0, edgelist = 0x0, next = 0x0}, {scanline = 0, 
      edgelist = 0x0, next = 0x3ff00000}, {scanline = 0, 
      edgelist = 0x406a2000, next = 0x0}, {scanline = 1079296000, 
      edgelist = 0x9c37cb8, next = 0x98bc2c0}, {scanline = 45654004, 
      edgelist = 0x2b89ff4, next = 0x9d57d40}, {scanline = -1080857976, 
      edgelist = 0x243a74b, next = 0x9fed5f0}, {scanline = -1080858240, 
      edgelist = 0x3ff00000, next = 0x0}, {scanline = 0, edgelist = 0x0, 
      next = 0x0}, {scanline = 0, edgelist = 0x3ff00000, next = 0x0}, {
      scanline = 1080696832, edgelist = 0x0, next = 0x4054c000}, {
      scanline = 160154304, edgelist = 0xbf936928, next = 0x2b89ff4}, {
      scanline = 8, edgelist = 0x9c74c68, next = 0xbf936a20}, {
      scanline = 37360376, edgelist = 0x9c04818, next = 0x8}, {
      scanline = -1080858280, edgelist = 0x23dfc3b, next = 0x9ca8318}, {
      scanline = 164056040, edgelist = 0x98bc2c0, next = 0x9c74d5c}, {
      scanline = 45654004, edgelist = 0x23ef5a6, next = 0xbf936968}, {
      scanline = 45654004, edgelist = 0x8, next = 0x9c76298}, {
      scanline = -1080858200, edgelist = 0x23a12f8, next = 0x9c74be8}}, 
  next = 0x8}
	tmpPtBlock = <value optimized out>
	numFullPtBlocks = <value optimized out>
	pSLL = (ScanLineList *) 0xbf935008
	ET = {ymax = 1080696832, ymin = 0, scanlines = {
    scanline = -1080858192, edgelist = 0x0, next = 0x0}}
	AET = {ymax = 8, bres = {minor_axis = 11136054, d = 160293232, 
    m = -1080858192, m1 = 8, incr1 = 0, incr2 = 0}, next = 0x0, back = 0x0, 
  nextWETE = 0x98de164, ClockWise = 0}
#9  0x0248c2fb in QRegion (this=0xbf9373a0, a=@0xbf9373a4, 
    fillRule=Qt::OddEvenFill) at painting/qregion.cpp:3858
No locals.
#10 0x024edc88 in QX11PaintEngine::updateState (this=0x9dab588, 
    state=@0x9fed55c) at painting/qpaintengine_x11.cpp:1087
	clip_poly_dev = {<QVector<QPointF>> = {{p = 0x9fd4a58, 
      d = 0x9fd4a58}}, <No data fields>}
	clipped_poly_dev = {<QVector<QPointF>> = {{p = 0x9fd4898, 
      d = 0x9fd4898}}, <No data fields>}
	d = (QX11PaintEnginePrivate * const) 0x9cf6bb8
#11 0x02439ee4 in QPainterPrivate::updateStateImpl (this=0x9d57d40, 
    newState=0x9fed558) at painting/qpainter.cpp:908
No locals.
#12 0x02439fac in QPainterPrivate::updateState (this=0x9d57d40, 
    newState=0x9fed558) at painting/qpainter.cpp:936
No locals.
#13 0x02441029 in QPainter::setClipRegion (this=0xbf937920, r=@0xbf9377b4, 
    op=Qt::ReplaceClip) at painting/qpainter.cpp:2692
	d = (QPainterPrivate * const) 0x9d57d40
#14 0x0236e25e in QWidgetPrivate::paintBackground (this=0x9b9da58, 
    painter=0xbf937920, rgn=@0xbf93792c, offset=@0xbf937914, 
    flags=<value optimized out>) at kernel/qwidget.cpp:2070
	opt = {version = 160504232, type = 0, state = {i = 166860816}, 
  direction = 164266776, rect = {x1 = 6, y1 = 38724347, x2 = 45654004, 
    y2 = 162222820}, fontMetrics = {d = 0x9d57d40}, palette = {
    static staticMetaObject = {d = {superdata = 0x0, 
        stringdata = 0x29f9e20 "QPalette", data = 0x29f9f60, 
        extradata = 0x0}}, d = 0xbf9377a8, current_group = 7, 
    resolve_mask = 2375368}}
	q = (const QWidget * const) 0x9c73f38
	autoFillBrush = {d = 0x9922710}
#15 0x0236f036 in QWidgetPrivate::drawWidget (this=0x9b9da58, pdev=0x9ab52e4, 
    rgn=@0xbf937a90, offset=@0x9b9de0c, flags=<value optimized out>, 
    sharedPainter=0x0, backingStore=0x9b9dde8) at kernel/qwidget.cpp:5057
	p = {static staticMetaObject = {d = {superdata = 0x0, 
      stringdata = 0x29fac80 "QPainter", data = 0x29fad20, extradata = 0x0}}, 
  d_ptr = 0x9d57d40}
	scrollAreaOffset = {xp = 0, yp = 0}
	scrollArea = (class QAbstractScrollArea *) 0x0
	paintEngine = (class QPaintEngine *) 0x9dab588
	e = {<QEvent> = {_vptr.QEvent = 0x84d1748, d = 0x0, t = 12, 
    posted = 0, spont = 1, m_accept = 1, reserved = 87}, m_rect = {x1 = 0, 
    y1 = 0, x2 = 605, y2 = 392}, m_region = {d = 0x9fe4158, 
    static shared_empty = {ref = {_q_value = 1604}, rgn = 0x0, 
      xrectangles = 0x0, qt_rgn = 0x0}}, m_erased = 22}
	onScreen = false
	asRoot = true
	toBePainted = {d = 0x9e89e98, static shared_empty = {ref = {
      _q_value = 1604}, rgn = 0x0, xrectangles = 0x0, qt_rgn = 0x0}}
#16 0x024fd2f8 in QWidgetBackingStore::sync (this=0x9b9dde8)
    at painting/qbackingstore.cpp:1269
	tlwRect = {x1 = 4, y1 = 29, x2 = 821, y2 = 531}
	surfaceGeometry = {x1 = 4, y1 = 29, x2 = 821, y2 = 531}
	repaintAllWidgets = false
	dirtyCopy = {d = 0x9f860a8, static shared_empty = {ref = {
      _q_value = 1604}, rgn = 0x0, xrectangles = 0x0, qt_rgn = 0x0}}
	tlwExtra = <value optimized out>
	updatesDisabled = true
	toClean = {d = 0x9fa3ca8, static shared_empty = {ref = {
      _q_value = 1604}, rgn = 0x0, xrectangles = 0x0, qt_rgn = 0x0}}
	opaqueNonOverlappedWidgets = {a = 32, s = 1, ptr = 0xbf937ac4, {
    array = "ØaÇ\tèz\223¿)e>\b8?Ç\t\235G\031\tõ\001?\bô\237¸\002\000\000\000\000\021Ø\232\002\030{\223¿b\2345\0028?Ç\t\237\213A\005à×ý\t\003\000\000\000 c&\tôO&\t c&\tô\237¸\002¡\213A\005Âì\237\002H{\223¿\177'\232\0028?Ç\t\237\213A\005H{\223¿ñFf\000¸\024ò\tL\211Ö\t\031\000\000\000ô/©\000 \213A\005a<§\000x{\223¿", 
    q_for_alignment_1 = -4642231653873786408, 
    q_for_alignment_2 = -0.019023538205006435}}
	beginPaintInfo = {wasFlushed = 0, nothingToPaint = 0, 
  windowSurfaceRecreated = 0}
#17 0x02360116 in QWidgetPrivate::syncBackingStore (this=0x9b9da58)
    at kernel/qwidget.cpp:1603
	bs = (QWidgetBackingStore *) 0x0
#18 0x02367215 in QWidget::event (this=0x9c73f38, event=0x9fdd7e0)
    at kernel/qwidget.cpp:7827
No locals.
#19 0x02734297 in QMainWindow::event (this=0x9c73f38, event=0x9fdd7e0)
    at widgets/qmainwindow.cpp:1399
	d = (QMainWindowPrivate * const) 0x9b9da58
#20 0x009c0dc4 in KMainWindow::event (this=0x9c73f38, ev=0x9fdd7e0)
    at ../../kdeui/widgets/kmainwindow.cpp:1094
	d = (KMainWindowPrivate * const) 0x6
#21 0x00a0730f in KXmlGuiWindow::event (this=0x9c73f38, ev=0x9fdd7e0)
    at ../../kdeui/xmlgui/kxmlguiwindow.cpp:131
	ret = <value optimized out>
#22 0x02311f54 in QApplicationPrivate::notify_helper (this=0x98b7c38, 
    receiver=0x9c73f38, e=0x9fdd7e0) at kernel/qapplication.cpp:4056
	consumed = <value optimized out>
#23 0x023195ca in QApplication::notify (this=0xbf93847c, receiver=0x9c73f38, 
    e=0x9fdd7e0) at kernel/qapplication.cpp:4021
	res = <value optimized out>
#24 0x008dabfa in KApplication::notify (this=0xbf93847c, receiver=0x9c73f38, 
    event=0x9fdd7e0) at ../../kdeui/kernel/kapplication.cpp:302
No locals.
#25 0x083e16cb in QCoreApplication::notifyInternal (this=0xbf93847c, 
    receiver=0x9c73f38, event=0x9fdd7e0) at kernel/qcoreapplication.cpp:610
	result = false
	cbdata = {0x9c73f38, 0x9fdd7e0, 0xbf93808f}
	threadData = (QThreadData *) 0x9893e48
	returnValue = <value optimized out>
#26 0x083e22b2 in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, 
    event_type=0, data=0x9893e48)
    at ../../include/QtCore/../../src/corelib/kernel/qcoreapplication.h:213
	pe = (const QPostEvent &) @0x9f3f528: {receiver = 0x9c73f38, 
  event = 0x0, priority = -1}
	e = (class QEvent *) 0x9fdd7e0
	r = (class QObject *) 0x9c73f38
	locker = {{mtx = 0x9893e70, val = 159989360}}
	startOffset = 0
	i = (int &) @0x9893e68: 2
#27 0x083e247d in QCoreApplication::sendPostedEvents (receiver=0x0, 
    event_type=0) at kernel/qcoreapplication.cpp:1140
	data = <value optimized out>
#28 0x0840c3ff in postEventSourceDispatch (s=0x98b2b10)
    at ../../include/QtCore/../../src/corelib/kernel/qcoreapplication.h:218
No locals.
#29 0x030c1e78 in g_main_context_dispatch () from /lib/libglib-2.0.so.0
No symbol table info available.
#30 0x030c5720 in ?? () from /lib/libglib-2.0.so.0
No symbol table info available.
#31 0x030c5853 in g_main_context_iteration () from /lib/libglib-2.0.so.0
No symbol table info available.
#32 0x0840c02c in QEventDispatcherGlib::processEvents (this=0x9893a30, flags=
      {i = 36}) at kernel/qeventdispatcher_glib.cpp:327
	d = (QEventDispatcherGlibPrivate * const) 0x98b2a90
	canWait = true
	result = <value optimized out>
#33 0x023b2be5 in QGuiEventDispatcherGlib::processEvents (this=0x9893a30, 
    flags={i = 36}) at kernel/qguieventdispatcher_glib.cpp:202
	d = (QGuiEventDispatcherGlibPrivate * const) 0x98b17d8
	returnValue = false
#34 0x083dfc79 in QEventLoop::processEvents (this=0xbf9383d4, flags=DWARF-2 expression error: DW_OP_reg operations must be used either alone or in conjuction with DW_OP_piece.
)
    at kernel/qeventloop.cpp:149
	d = (QEventLoopPrivate * const) 0x9b7ed78
#35 0x083e00ca in QEventLoop::exec (this=0xbf9383d4, flags={i = 0})
    at kernel/qeventloop.cpp:201
	d = (QEventLoopPrivate * const) 0x9b7ed78
	app = <value optimized out>
#36 0x083e253f in QCoreApplication::exec () at kernel/qcoreapplication.cpp:888
	threadData = (QThreadData *) 0x9893e48
	eventLoop = {<QObject> = {_vptr.QObject = 0x84d27a8, 
    static staticMetaObject = {d = {superdata = 0x0, 
        stringdata = 0x847aba0 "QObject", data = 0x847ac40, 
        extradata = 0x84ce1b8}}, d_ptr = 0x9b7ed78, 
    static staticQtMetaObject = {d = {superdata = 0x0, 
        stringdata = 0x8484380 "Qt", data = 0x8487700, extradata = 0x0}}}, 
  static staticMetaObject = {d = {superdata = 0x80b7540, 
      stringdata = 0x848c7a0 "QEventLoop", data = 0x848c7c0, 
      extradata = 0x0}}}
	returnCode = -1
#37 0x02311dd7 in QApplication::exec () at kernel/qapplication.cpp:3525
No locals.
#38 0x0807a745 in main (argc=3, argv=0xbf938654)
    at ../../../../apps/dolphin/src/main.cpp:94
	about = {d = 0x9895d70}
	options = {d = 0x98a93c8}
	app = {<KUniqueApplication> = {<KApplication> = {<QApplication> = {<QCoreApplication> = {<QObject> = {_vptr.QObject = 0x80a90a8, 
            static staticMetaObject = {d = {superdata = 0x0, 
                stringdata = 0x847aba0 "QObject", data = 0x847ac40, 
                extradata = 0x84ce1b8}}, d_ptr = 0x98b7c38, 
            static staticQtMetaObject = {d = {superdata = 0x0, 
                stringdata = 0x8484380 "Qt", data = 0x8487700, 
                extradata = 0x0}}}, static staticMetaObject = {d = {
              superdata = 0x80b7540, 
              stringdata = 0x848c820 "QCoreApplication", data = 0x848c8c0, 
              extradata = 0x0}}, static self = 0xbf93847c}, 
        static staticMetaObject = {d = {superdata = 0x84d27e4, 
            stringdata = 0x29aa860 "QApplication", data = 0x29aaa60, 
            extradata = 0x0}}}, static staticMetaObject = {d = {
          superdata = 0x2b73f48, stringdata = 0xa61500 "KApplication", 
          data = 0xa616a0, extradata = 0x0}}, static loadedByKdeinit = false, 
      static KApp = 0xbf93847c, d = 0x98ecb18}, static staticMetaObject = {
      d = {superdata = 0xa89ba0, stringdata = 0xa61dc0 "KUniqueApplication", 
        data = 0xa61ec0, extradata = 0x0}}, d = 0x993d0d8}, 
  static staticMetaObject = {d = {superdata = 0x80b7820, 
      stringdata = 0x80a8f80 "DolphinApplication", data = 0x80a9020, 
      extradata = 0x0}}, m_mainWindows = {{p = {static shared_null = {ref = {
            _q_value = 23211}, alloc = 0, begin = 0, end = 0, sharable = 1, 
          array = {0x0}}, d = 0x9a95a08}, d = 0x9a95a08}}, m_lastId = 3}
	__PRETTY_FUNCTION__ = "int main(int, char**)"