[Bug]: Occasional segfault when closing window on Linux

[cptpcrd]

Preflight Checklist

• I have read the Contributing Guidelines for this project.
• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for a bug report that matches the one I want to file, without success.

Electron Version

29.3.1

What operating system are you using?

Other Linux

Operating System Version

Kernel 6.8.8-arch1-1

What arch are you using?

x64

Last Known Working Electron version

28.3.1

Expected Behavior

Closing windows does not cause Electron to segfault.

Actual Behavior

Occasionally, closing windows triggers a segfault.

Testcase Gist URL

https://gist.github.com/cptpcrd/5b8429d727dcb866ac271b8610b97f9f

Additional Information

On Arch Linux, I have only been able to reproduce this when running under Sway. However, we have seen crashes from users who were on e.g. Ubuntu (and probably running GNOME), so it can likely appear in certain other circumstances too.

Note that Sway, like many Wayland compositors, can run within a window on other WMs/DEs/compositors, so it's also possible to test this on Sway without completely switching over:

$ echo 'exec echo $DISPLAY' >sway-config
$ sway -c sway-config
:2
# Leave this running and note the Xwayland display number printed on stdout, which here is :2

# Run in a separate terminal, substituting the Xwayland display number from above
$ DISPLAY=:2 electron main.js
# Wait for crash

It doesn't consistently reproduce -- occasionally when I run the linked testcase it will crash immediately, occasionally it will open and close the window a few dozen (or hundred) times before segfaulting. However, it always crashes eventually when I run it under Sway. Note that the linked testcase uses window.open from a renderer process, but creating a new BrowserWindow from the main process reproduces this too: https://gist.github.com/cptpcrd/202db28d330fe55dfe646b3f38f4f9db.

I've taken gdb backtraces -- this one was captured from the Electron 29 package from Arch's repos; this one is from a local Testing build of 29.3.1 (which has a few local patches applied, but nothing huge).

This is probably a distinct bug from #41839, though there could theoretically be some common thread.