The problem was in uninitialized value returned by ResultCache::cachedResult() which is called from ProjectItemDataProvider::itemCount() and ProjectItemDataProvider::unfilteredItemCount() methods.
The crash happens only if uninitialized value is sufficiently big and ResultCache::markDirty() was not called before.
BUG: 374894