Upstream bug report: https://github.com/vector-im/element-web/issues/21996

Upstream bug report is mine, here's stack traces I obtained by running the same app through the official electron builds for which debug info is available. The first was with native wayland support enabled and ended up as SIGSEGV, the second one was without native wayland and ended up as SIGTRAP (though I only obtained these two traces and don't know whether there's a strong correlation).

(1)

#0 base::internal::PartitionFreelistEntry::GetNextInternal(unsigned long, bool) const
(this=0x0, for_thread_cache=true, extra=<optimized out>) at ../../base/allocator/partition_allocator/partition_freelist_entry.h:232
#1 base::internal::PartitionFreelistEntry::GetNextForThreadCache(unsigned long) const (this=0x0, extra=<optimized out>)
at ../../base/allocator/partition_allocator/partition_freelist_entry.h:258
#2 base::internal::ThreadCache::ClearBucket(base::internal::ThreadCache::Bucket&, unsigned long) (this=0x17b8002c8600, bucket=..., limit=64)
at ../../base/allocator/partition_allocator/thread_cache.cc:632
#3 0x000055555a215adb in base::internal::ThreadCache::MaybePutInCache(void*, unsigned long)
(this=0x17b8002c8600, slot_start=0x17b80160f540, bucket_index=<optimized out>)
at ../../base/allocator/partition_allocator/thread_cache.h:458
#4 base::PartitionRoot<true>::RawFreeWithThreadCache(void*, base::internal::SlotSpanMetadata<true>*)
(this=0x55555e2d4cc0 <(anonymous namespace)::g_root+64>, slot_start=<optimized out>, slot_span=0x17b801601060)
at ../../base/allocator/partition_allocator/partition_root.h:1297
#5 base::PartitionRoot<true>::FreeNoHooksImmediate(void*, base::internal::SlotSpanMetadata<true>*, void*)
(this=<optimized out>, ptr=<optimized out>, slot_span=<optimized out>, slot_start=<optimized out>)
at ../../base/allocator/partition_allocator/partition_root.h:1202
#6 base::PartitionRoot<true>::FreeNoHooks(void*) (ptr=<optimized out>) at ../../base/allocator/partition_allocator/partition_root.h:1101
#7 base::internal::PartitionFree(base::allocator::AllocatorDispatch const*, void*, void*) (address=<optimized out>, context=<optimized out>)
at ../../base/allocator/allocator_shim_default_dispatch_to_partition_alloc.cc:393
#8 0x000055555859ac07 in std::__1::__libcpp_operator_delete<void*>(void*) (__args=0x17b80160f540)
at ../../buildtools/third_party/libc++/trunk/include/new:245
#9 std::__1::__do_deallocate_handle_size<>(void*, unsigned long) (__ptr=0x17b80160f540, __size=40)
at ../../buildtools/third_party/libc++/trunk/include/new:269
#10 std::__1::__libcpp_deallocate(void*, unsigned long, unsigned long) (__ptr=0x17b80160f540, __size=40, __align=8)
at ../../buildtools/third_party/libc++/trunk/include/new:279
#11 std::__1::allocator<std::__1::__hash_node<std::__1::__hash_value_type<unsigned int, mojo::core::HandleTable::Entry>, void*> >::deallocate(std::__1::__hash_node<std::__1::__hash_value_type<unsigned int, mojo::core::HandleTable::Entry>, void*>*, unsigned long)
(__p=0x17b80160f540, __n=1, this=<optimized out>) at ../../buildtools/third_party/libc++/trunk/include/__memory/allocator.h:91
#12 std::__1::allocator_traits<std::__1::allocator<std::__1::__hash_node<std::__1::__hash_value_type<unsigned int, mojo::core::HandleTable::Entry>, void*> > >::deallocate(std::__1::allocator<std::__1::__hash_node<std::__1::__hash_value_type<unsigned int, mojo::core::HandleTable::Entry>, void*> >&, std::__1::__hash_node<std::__1::__hash_value_type<unsigned int, mojo::core::HandleTable::Entry>, void*>*, unsigned long)
(__p=0x17b80160f540, __n=1, __a=<optimized out>) at ../../buildtools/third_party/libc++/trunk/include/__memory/allocator_traits.h:281
#13 std::__1::__hash_node_destructor<std::__1::allocator<std::__1::__hash_node<std::__1::__hash_value_type<unsigned int, mojo::core::HandleTable::Entry>, void*> > >::operator()(std::__1::__hash_node<std::__1::__hash_value_type<unsigned int, mojo::core::HandleTable::Entry>, void*>*)
(__p=0x17b80160f540, this=<optimized out>) at ../../buildtools/third_party/libc++/trunk/include/__hash_table:851
#14 std::__1::unique_ptr<std::__1::__hash_node<std::__1::__hash_value_type<unsigned int, mojo::core::HandleTable::Entry>, void*>, std::__1::__hash_node_destructor<std::__1::allocator<std::__1::__hash_node<std::__1::__hash_value_type<unsigned int, mojo::core::HandleTable::Entry>, void*> > > >::reset(std::__1::__hash_node<std::__1::__hash_value_type<unsigned int, mojo::core::HandleTable::Entry>, void*>*)
(__p=0x0, this=<optimized out>) at ../../buildtools/third_party/libc++/trunk/include/__memory/unique_ptr.h:315
#15 std::__1::unique_ptr<std::__1::__hash_node<std::__1::__hash_value_type<unsigned int, mojo::core::HandleTable::Entry>, void*>, std::__1::__hash_node_destructor<std::__1::allocator<std::__1::__hash_node<std::__1::__hash_value_type<unsigned int, mojo::core::HandleTable::Entry>, void*> > > >::~unique_ptr() (this=<optimized out>) at ../../buildtools/third_party/libc++/trunk/include/__memory/unique_ptr.h:269
#16 std::__1::__hash_table<std::__1::__hash_value_type<unsigned int, mojo::core::HandleTable::Entry>, std::__1::__unordered_map_hasher<unsigned int, std::__1::__hash_value_type<unsigned int, mojo::core::HandleTable::Entry>, std::__1::hash<unsigned int>, std::__1::equal_to<unsigned int>, true>, std::__1::__unordered_map_equal<unsigned int, std::__1::__hash_value_type<unsigned int, mojo::core::HandleTable::Entry>, std::__1::equal_to<unsigned int>, std::__1::hash<unsigned int>, true>, std::__1::allocator<std::__1::__hash_value_type<unsigned int, mojo::core::HandleTable::Entry> > >::erase(std::__1::__hash_const_iterator<std::__1::__hash_node<std::__1::__hash_value_type<unsigned int, mojo::core::HandleTable::Entry>, void*>*>) (this=<optimized out>, __p=...) at ../../buildtools/third_party/libc++/trunk/include/__hash_table:2498
#17 0x00005555585997ef in std::__1::unordered_map<unsigned int, mojo::core::HandleTable::Entry, std::__1::hash<unsigned int>, std::__1::equal_to<unsigned int>, std::__1::allocator<std::__1::pair<unsigned int const, mojo::core::HandleTable::Entry> > >::erase(std::__1::__hash_map_iterator<std::__1::__hash_iterator<std::__1::__hash_node<std::__1::__hash_value_type<unsigned int, mojo::core::HandleTable::Entry>, void*>*> >)
(__p=..., this=<optimized out>) at ../../buildtools/third_party/libc++/trunk/include/unordered_map:1269
#18 mojo::core::HandleTable::GetAndRemoveDispatcher(unsigned int, scoped_refptr<mojo::core::Dispatcher>*)
(this=<optimized out>, handle=<optimized out>, dispatcher=<optimized out>) at ../../mojo/core/handle_table.cc:113
#19 0x000055555858fbae in mojo::core::Core::Close(unsigned int)
(this=0x55555e291828 <mojo::core::InitializeCore()::core_instance>, handle=3515) at ../../mojo/core/core.cc:259
#20 0x000055555a50a1f7 in mojo::Handle::Close() (this=0x17b801875a04) at ../../mojo/public/cpp/system/handle.h:178
#21 mojo::ScopedHandleBase<mojo::TrapHandle>::CloseIfNecessary() (this=0x17b801875a04) at ../../mojo/public/cpp/system/handle.h:140
#22 mojo::ScopedHandleBase<mojo::TrapHandle>::~ScopedHandleBase() (this=0x17b801875a04) at ../../mojo/public/cpp/system/handle.h:83
#23 mojo::SimpleWatcher::~SimpleWatcher() (this=0x17b8018759f0) at ../../mojo/public/cpp/system/simple_watcher.cc:132
#24 0x000055555a4e63a5 in std::__1::default_delete<mojo::SimpleWatcher>::operator()(mojo::SimpleWatcher*) const (this=0x17b80419c788, __ptr=0x17b8018759f0) at ../../buildtools/third_party/libc++/trunk/include/__memory/unique_ptr.h:54
#25 std::__1::unique_ptr<mojo::SimpleWatcher, std::__1::default_delete<mojo::SimpleWatcher> >::reset(mojo::SimpleWatcher*) (this=0x17b80419c788, __p=0x0) at ../../buildtools/third_party/libc++/trunk/include/__memory/unique_ptr.h:315
#26 mojo::Connector::CancelWait() (this=0x17b80419c760) at ../../mojo/public/cpp/bindings/lib/connector.cc:660
#27 mojo::Connector::HandleError(bool, bool) (this=0x17b80419c760, force_pipe_reset=false, force_async_handler=<optimized out>) at ../../mojo/public/cpp/bindings/lib/connector.cc:685
#28 mojo::Connector::OnHandleReadyInternal(unsigned int) (result=<optimized out>, this=<optimized out>) at ../../mojo/public/cpp/bindings/lib/connector.cc:439
#29 mojo::Connector::OnWatcherHandleReady(unsigned int) (this=0x17b80419c760, result=<optimized out>) at ../../mojo/public/cpp/bindings/lib/connector.cc:419
#30 0x000055555a50ad17 in base::RepeatingCallback<void (unsigned int, mojo::HandleSignalsState const&)>::Run(unsigned int, mojo::HandleSignalsState const&) const & (this=0x7fffffffd178, args=9, args=...) at ../../base/callback.h:241
#31 mojo::SimpleWatcher::OnHandleReady(int, unsigned int, mojo::HandleSignalsState const&) (this=0x17b8018759f0, watch_id=<optimized out>, result=9, state=...) at ../../mojo/public/cpp/system/simple_watcher.cc:278
#32 base::internal::FunctorTraits<void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), void>::Invoke<void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>(void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>&&, int&&, unsigned int&&, mojo::HandleSignalsState&&)
(method=<optimized out>, receiver_ptr=<optimized out>, args=<optimized out>, args=<optimized out>, args=...) at ../../base/bind_internal.h:535
#33 base::internal::InvokeHelper<true, void>::MakeItSo<void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>(void (mojo::SimpleWatcher::*&&)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>&&, int&&, unsigned int&&, mojo::HandleSignalsState&&) (functor=<optimized out>, weak_ptr=<optimized out>, args=<optimized out>, args=<optimized out>, args=...) at ../../base/bind_internal.h:719
#34 base::internal::Invoker<base::internal::BindState<void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunImpl<void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), std::__1::tuple<base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>, 0ul, 1ul, 2ul, 3ul>(void (mojo::SimpleWatcher::*&&)(int, unsigned int, mojo::HandleSignalsState const&), std::__1::tuple<base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>&&, std::__1::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul>) (functor=<optimized out>, bound=<optimized out>) at ../../base/bind_internal.h:772
#35 base::internal::Invoker<base::internal::BindState<void (mojo::SimpleWatcher::*)(int, unsigned int, mojo::HandleSignalsState const&), base::WeakPtr<mojo::SimpleWatcher>, int, unsigned int, mojo::HandleSignalsState>, void ()>::RunOnce(base::internal::BindStateBase*)
(base=<optimized out>) at ../../base/bind_internal.h:741
#36 0x000055555a1b33b6 in base::OnceCallback<void ()>::Run() && (this=0x17b8013aa000) at ../../base/callback.h:142
#37 base::TaskAnnotator::RunTaskImpl(base::PendingTask&) (this=<optimized out>, pending_task=...) at ../../base/task/common/task_annotator.cc:135
#38 0x000055555a1cf16d in non-virtual thunk to base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() () at ../../base/task/common/task_annotator.h:74
#39 0x000055555a17e8a6 in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) (this=0x17b80024b640, delegate=<optimized out>) at ../../base/message_loop/message_pump_glib.cc:405
#40 0x000055555a1cfaf4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) (this=0x17b8002d4540, application_tasks_allowed=true, timeout=...) at ../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:468
#41 0x000055555a19c87c in base::RunLoop::Run(base::Location const&) (this=0x17b8014270b0, location=<optimized out>) at ../../base/run_loop.cc:140
#42 0x00005555594d27bf in content::BrowserMainLoop::RunMainMessageLoop() (this=<optimized out>) at ../../content/browser/browser_main_loop.cc:1048
#43 0x00005555594d4342 in content::BrowserMainRunnerImpl::Run() (this=0x17b800369b50) at ../../content/browser/browser_main_runner_impl.cc:153
#44 0x00005555594cff9e in content::BrowserMain(content::MainFunctionParams) (parameters=...) at ../../content/browser/browser_main.cc:30
#45 0x00005555577ff9e1 in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) (main_function_params=..., delegate=<optimized out>) at ../../content/app/content_main_runner_impl.cc:643
#46 0x0000555557800e48 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) (this=0x17b800278200, main_params=..., start_minimal_browser=false) at ../../content/app/content_main_runner_impl.cc:1157
#47 0x000055555780081b in content::ContentMainRunnerImpl::Run() (this=0x17b800278200) at ../../content/app/content_main_runner_impl.cc:1023
#48 0x00005555577fdd5e in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) (params=..., content_main_runner=0x17b800278200) at ../../content/app/content_main.cc:402
#49 0x00005555577fe773 in content::ContentMain(content::ContentMainParams) (params=...) at ../../content/app/content_main.cc:430
#50 0x000055555758dc88 in main(int, char**) (argc=4, argv=<optimized out>) at ../../electron/shell/app/electron_main_linux.cc:51

(2)

#0 0x000055555a215c43 in base::PartitionRoot<true>::FreeNoHooks(void*)::{lambda()#1}::operator()() const (this=<optimized out>) at ../../base/allocator/partition_allocator/partition_root.h:1048
#1 base::PartitionRoot<true>::FreeNoHooks(void*) (ptr=0xdeadbeefdeadbeef) at ../../base/allocator/partition_allocator/partition_root.h:1048
#2 base::internal::PartitionFree(base::allocator::AllocatorDispatch const*, void*, void*) (address=0xdeadbeefdeadbeef, context=<optimized out>) at ../../base/allocator/allocator_shim_default_dispatch_to_partition_alloc.cc:393
#3 0x00007fffd1d248ae in () at /usr/lib/libnotify.so.4
#4 0x00007ffff7a57f8f in g_closure_invoke () at /usr/lib/libgobject-2.0.so.0
#5 0x00007ffff7a73ba8 in () at /usr/lib/libgobject-2.0.so.0
#6 0x00007ffff7a755c7 in g_signal_emit_valist () at /usr/lib/libgobject-2.0.so.0
#7 0x00007ffff7a75824 in g_signal_emit () at /usr/lib/libgobject-2.0.so.0
#8 0x00007ffff7843816 in () at /usr/lib/libgio-2.0.so.0
#9 0x00007ffff7830348 in () at /usr/lib/libgio-2.0.so.0
#10 0x00007ffff795b163 in g_main_context_dispatch () at /usr/lib/libglib-2.0.so.0
#11 0x00007ffff79b19e9 in () at /usr/lib/libglib-2.0.so.0
#12 0x00007ffff79586c5 in g_main_context_iteration () at /usr/lib/libglib-2.0.so.0
#13 0x000055555a17e88b in base::MessagePumpGlib::Run(base::MessagePump::Delegate*) (this=0x74e0024b640, delegate=<optimized out>) at ../../base/message_loop/message_pump_glib.cc:401
#14 0x000055555a1cfaf4 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) (this=0x74e002d4540, application_tasks_allowed=true, timeout=...) at ../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:468
#15 0x000055555a19c87c in base::RunLoop::Run(base::Location const&) (this=0x74e015847b0, location=<optimized out>) at ../../base/run_loop.cc:140
#16 0x00005555594d27bf in content::BrowserMainLoop::RunMainMessageLoop() (this=<optimized out>) at ../../content/browser/browser_main_loop.cc:1048
#17 0x00005555594d4342 in content::BrowserMainRunnerImpl::Run() (this=0x74e00369ac0) at ../../content/browser/browser_main_runner_impl.cc:153
#18 0x00005555594cff9e in content::BrowserMain(content::MainFunctionParams) (parameters=...) at ../../content/browser/browser_main.cc:30
#19 0x00005555577ff9e1 in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) (main_function_params=..., delegate=<optimized out>) at ../../content/app/content_main_runner_impl.cc:643
#20 0x0000555557800e48 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) (this=0x74e00278000, main_params=..., start_minimal_browser=false) at ../../content/app/content_main_runner_impl.cc:1157
#21 0x000055555780081b in content::ContentMainRunnerImpl::Run() (this=0x74e00278000) at ../../content/app/content_main_runner_impl.cc:1023
#22 0x00005555577fdd5e in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) (params=..., content_main_runner=0x74e00278000) at ../../content/app/content_main.cc:402
#23 0x00005555577fe773 in content::ContentMain(content::ContentMainParams) (params=...) at ../../content/app/content_main.cc:430
#24 0x000055555758dc88 in main(int, char**) (argc=3, argv=<optimized out>) at ../../electron/shell/app/electron_main_linux.cc:51

Seems to be fixed by libnotify 0.7.11-2, which backports the fix (https://gitlab.gnome.org/GNOME/libnotify/-/commit/596d09a78fe1138e1ec4cba56b269631985e6b74) from 0.7.12.