The problem didn't happen with QTWEBENGINE_CHROMIUM_FLAGS=--disable-gpu rkward as suggested by Thomas Friedrichsmeier. I'm reassigning this report to qt6-qtwebengine based on Thomas' suggestion.

After the crash happened previously with RKWard on Wayland, when I ran QT_QPA_PLATFORM=xcb rkward &, RKWard on XWayland started normally. RKWard on Wayland then started normally after that during the same boot. On following boots, RKWard on Wayland crashed in the same way until I ran RKWard on XWayland. However, if I ran RKWard on XWayland first in a given boot, it crashed in the same way as with Wayland.

RKWard occasionally crashed when starting with Qt 6.10.1 only and a different trace and SIGTRAP. The crash was in qtwebengine/chromium according to the trace.

Core was generated by `/usr/bin/rkward --autoreuse'.
Program terminated with signal SIGTRAP, Trace/breakpoint trap.
#0  0x00007f5e3d2b9fbc in base::ImmediateCrash () at ../../../../../src/3rdparty/chromium/base/immediate_crash.h:186
186       TRAP_SEQUENCE_();
[Current thread is 1 (Thread 0x7f5de37fe6c0 (LWP 14871))]

(gdb) bt
#0  0x00007f5e3d2b9fbc in base::ImmediateCrash () at ../../../../../src/3rdparty/chromium/base/immediate_crash.h:186
#1  logging::LogMessage::HandleFatal () at ../../../../../src/3rdparty/chromium/base/logging.cc:1066
#2  0x00007f5e3d2bc3b6 in operator() () at ../../../../../src/3rdparty/chromium/base/logging.cc:772
#3  InvokeCallback () at ../../../../../src/3rdparty/chromium/third_party/abseil-cpp/absl/cleanup/internal/cleanup.h:87
#4  ~Cleanup () at ../../../../../src/3rdparty/chromium/third_party/abseil-cpp/absl/cleanup/cleanup.h:106
#5  logging::LogMessage::Flush () at ../../../../../src/3rdparty/chromium/base/logging.cc:955
#6  0x00007f5e3d2bd2eb in logging::LogMessage::~LogMessage ()
    at ../../../../../src/3rdparty/chromium/base/logging.cc:725
#7  0x00007f5e3d2bd3a3 in logging::ErrnoLogMessage::~ErrnoLogMessage ()
    at ../../../../../src/3rdparty/chromium/base/logging.cc:1150
#8  logging::ErrnoLogMessage::~ErrnoLogMessage () at ../../../../../src/3rdparty/chromium/base/logging.cc:1150
#9  0x00007f5e3d2c023c in std::default_delete<logging::LogMessage>::operator() ()
    at /usr/include/c++/15/bits/unique_ptr.h:92
#10 std::__uniq_ptr_impl<logging::LogMessage, std::default_delete<logging::LogMessage> >::reset ()
    at /usr/include/c++/15/bits/unique_ptr.h:204
#11 std::unique_ptr<logging::LogMessage, std::default_delete<logging::LogMessage> >::reset ()
    at /usr/include/c++/15/bits/unique_ptr.h:511
#12 logging::CheckNoreturnError::~CheckNoreturnError () at ./../../../../../src/3rdparty/chromium/base/check.cc:350
#13 0x00007f5e3d2dc207 in base::internal::ScopedFDCloseTraits::Free ()
    at ./../../../../../src/3rdparty/chromium/base/files/scoped_file.cc:45
#14 0x00007f5e38957610 in mojo::core::ipcz_driver::SharedBuffer::~SharedBuffer ()
    at ../../../../../src/3rdparty/chromium/mojo/core/ipcz_driver/shared_buffer.cc:91
#15 mojo::core::ipcz_driver::SharedBuffer::~SharedBuffer ()
    at ../../../../../src/3rdparty/chromium/mojo/core/ipcz_driver/shared_buffer.cc:91
#16 0x00007f5e38950ad6 in base::RefCountedThreadSafe<mojo::core::ipcz_driver::ObjectBase, base::DefaultRefCountedThreadSafeTraits<mojo::core::ipcz_driver::ObjectBase> >::DeleteInternal<mojo::core::ipcz_driver::ObjectBase> ()
    at ../../../../../src/3rdparty/chromium/base/memory/ref_counted.h:438
--Type <RET> for more, q to quit, c to continue without paging--c
#17 base::DefaultRefCountedThreadSafeTraits<mojo::core::ipcz_driver::ObjectBase>::Destruct ()
    at ../../../../../src/3rdparty/chromium/base/memory/ref_counted.h:391
#18 base::RefCountedThreadSafe<mojo::core::ipcz_driver::ObjectBase, base::DefaultRefCountedThreadSafeTraits<mojo::core::ipcz_driver::ObjectBase> >::Release () at ../../../../../src/3rdparty/chromium/base/memory/ref_counted.h:427
#19 base::RefCountedThreadSafe<mojo::core::ipcz_driver::ObjectBase, base::DefaultRefCountedThreadSafeTraits<mojo::core::ipcz_driver::ObjectBase> >::Release () at ../../../../../src/3rdparty/chromium/base/memory/ref_counted.h:424
#20 scoped_refptr<mojo::core::ipcz_driver::SharedBuffer>::Release ()
    at ../../../../../src/3rdparty/chromium/base/memory/scoped_refptr.h:395
#21 scoped_refptr<mojo::core::ipcz_driver::SharedBuffer>::~scoped_refptr ()
    at ../../../../../src/3rdparty/chromium/base/memory/scoped_refptr.h:280
#22 mojo::core::ipcz_driver::DataPipe::~DataPipe ()
    at ../../../../../src/3rdparty/chromium/mojo/core/ipcz_driver/data_pipe.cc:145
#23 0x00007f5e38950b11 in mojo::core::ipcz_driver::DataPipe::~DataPipe ()
    at ../../../../../src/3rdparty/chromium/mojo/core/ipcz_driver/data_pipe.cc:145
#24 0x00007f5e38952a99 in base::RefCountedThreadSafe<mojo::core::ipcz_driver::ObjectBase, base::DefaultRefCountedThreadSafeTraits<mojo::core::ipcz_driver::ObjectBase> >::DeleteInternal<mojo::core::ipcz_driver::ObjectBase> ()
    at ../../../../../src/3rdparty/chromium/base/memory/ref_counted.h:438
#25 base::DefaultRefCountedThreadSafeTraits<mojo::core::ipcz_driver::ObjectBase>::Destruct ()
    at ../../../../../src/3rdparty/chromium/base/memory/ref_counted.h:391
#26 base::RefCountedThreadSafe<mojo::core::ipcz_driver::ObjectBase, base::DefaultRefCountedThreadSafeTraits<mojo::core::ipcz_driver::ObjectBase> >::Release () at ../../../../../src/3rdparty/chromium/base/memory/ref_counted.h:427
#27 base::RefCountedThreadSafe<mojo::core::ipcz_driver::ObjectBase, base::DefaultRefCountedThreadSafeTraits<mojo::core::ipcz_driver::ObjectBase> >::Release () at ../../../../../src/3rdparty/chromium/base/memory/ref_counted.h:424
#28 scoped_refptr<mojo::core::ipcz_driver::ObjectBase>::Release ()
    at ../../../../../src/3rdparty/chromium/base/memory/scoped_refptr.h:395
#29 scoped_refptr<mojo::core::ipcz_driver::ObjectBase>::~scoped_refptr ()
    at ../../../../../src/3rdparty/chromium/base/memory/scoped_refptr.h:280
#30 Close () at ../../../../../src/3rdparty/chromium/mojo/core/ipcz_driver/driver.cc:41
#31 0x00007f5e38a7aa6a in absl::variant_internal::VariantStateBaseDestructorNontrivial<absl::monostate, ipcz::DriverObject, ipcz::ApplicationObject, ipcz::Ref<ipcz::ParcelWrapper> >::destroy ()
    at ../../../../../src/3rdparty/chromium/third_party/abseil-cpp/absl/types/internal/variant.h:1289
#32 absl::variant_internal::VariantCoreAccess::Destroy<absl::variant<absl::monostate, ipcz::DriverObject, ipcz::ApplicationObject, ipcz::Ref<ipcz::ParcelWrapper> > > ()
    at ../../../../../src/3rdparty/chromium/third_party/abseil-cpp/absl/types/internal/variant.h:567
#33 absl::variant_internal::VariantCoreAccess::Replace<0ul, absl::variant<absl::monostate, ipcz::DriverObject, ipcz::ApplicationObject, ipcz::Ref<ipcz::ParcelWrapper> >, absl::monostate> ()
    at ../../../../../src/3rdparty/chromium/third_party/abseil-cpp/absl/types/internal/variant.h:711
#34 absl::variant<absl::monostate, ipcz::DriverObject, ipcz::ApplicationObject, ipcz::Ref<ipcz::ParcelWrapper> >::emplace<0ul, absl::monostate, (void*)0> ()
    at ../../../../../src/3rdparty/chromium/third_party/abseil-cpp/absl/types/variant.h:660
#35 absl::variant_internal::VariantCoreAccess::ConversionAssignVisitor<absl::variant<absl::monostate, ipcz::DriverObject, ipcz::ApplicationObject, ipcz::Ref<ipcz::ParcelWrapper> >, absl::monostate>::operator()<1ul> ()
    at ../../../../../src/3rdparty/chromium/third_party/abseil-cpp/absl/types/internal/variant.h:685
#36 std::__invoke_impl<void, absl::variant_internal::VariantCoreAccess::ConversionAssignVisitor<absl::variant<absl::monostate, ipcz::DriverObject, ipcz::ApplicationObject, ipcz::Ref<ipcz::ParcelWrapper> >, absl::monostate>, std::integral_constant<unsigned long, 1ul> > () at /usr/include/c++/15/bits/invoke.h:63
#37 std::__invoke<absl::variant_internal::VariantCoreAccess::ConversionAssignVisitor<absl::variant<absl::monostate, ipcz::DriverObject, ipcz::ApplicationObject, ipcz::Ref<ipcz::ParcelWrapper> >, absl::monostate>, std::integral_constant<unsigned long, 1ul> > () at /usr/include/c++/15/bits/invoke.h:98
#38 std::invoke<absl::variant_internal::VariantCoreAccess::ConversionAssignVisitor<absl::variant<absl::monostate, ipcz::DriverObject, ipcz::ApplicationObject, ipcz::Ref<ipcz::ParcelWrapper> >, absl::monostate>, std::integral_constant<unsigned long, 1ul> > () at /usr/include/c++/15/functional:122
#39 absl::variant_internal::ReachableSwitchCase<absl::variant_internal::VariantCoreAccess::ConversionAssignVisitor<absl::variant<absl::monostate, ipcz::DriverObject, ipcz::ApplicationObject, ipcz::Ref<ipcz::ParcelWrapper> >, absl::monostate>, 1ul>::Run () at ../../../../../src/3rdparty/chromium/third_party/abseil-cpp/absl/types/internal/variant.h:283
#40 absl::variant_internal::VisitIndicesSwitch<4ul>::Run<absl::variant_internal::VariantCoreAccess::ConversionAssignVisitor<absl::variant<absl::monostate, ipcz::DriverObject, ipcz::ApplicationObject, ipcz::Ref<ipcz::ParcelWrapper> >, absl::monostate> > () at ../../../../../src/3rdparty/chromium/third_party/abseil-cpp/absl/types/internal/variant.h:350
#41 absl::variant<absl::monostate, ipcz::DriverObject, ipcz::ApplicationObject, ipcz::Ref<ipcz::ParcelWrapper> >::operator=<absl::monostate, 0ul, absl::monostate, (void*)0> ()
    at ../../../../../src/3rdparty/chromium/third_party/abseil-cpp/absl/types/variant.h:591
#42 ipcz::Box::Close () at ../../../../../src/3rdparty/chromium/third_party/ipcz/src/ipcz/box.cc:31
#43 0x00007f5e38a78dac in Close () at ../../../../../src/3rdparty/chromium/third_party/ipcz/src/api.cc:32
#44 0x00007f5e3bafbdc1 in std::default_delete<mojo::DataPipeProducer>::operator() ()
    at /usr/include/c++/15/bits/unique_ptr.h:92
#45 std::default_delete<mojo::DataPipeProducer>::operator() () at /usr/include/c++/15/bits/unique_ptr.h:86
#46 std::__uniq_ptr_impl<mojo::DataPipeProducer, std::default_delete<mojo::DataPipeProducer> >::reset ()
    at /usr/include/c++/15/bits/unique_ptr.h:204
#47 std::unique_ptr<mojo::DataPipeProducer, std::default_delete<mojo::DataPipeProducer> >::reset ()
    at /usr/include/c++/15/bits/unique_ptr.h:511
#48 OnFileWritten () at ../../../../../src/3rdparty/chromium/content/browser/loader/file_url_loader_factory.cc:786
#49 0x00007f5e3bafabd5 in Invoke<void (content::(anonymous namespace)::FileURLLoader::*)(std::unique_ptr<content::FileURLLoaderObserver>, unsigned int), content::(anonymous namespace)::FileURLLoader*, std::nullptr_t, unsigned int> ()
    at ../../../../../src/3rdparty/chromium/base/functional/bind_internal.h:729
#50 MakeItSo<void (content::(anonymous namespace)::FileURLLoader::*)(std::unique_ptr<content::FileURLLoaderObserver>, unsigned int), std::tuple<base::internal::UnretainedWrapper<content::(anonymous namespace)::FileURLLoader, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, std::nullptr_t>, unsigned int> ()
    at ../../../../../src/3rdparty/chromium/base/functional/bind_internal.h:921
#51 RunImpl<void (content::(anonymous namespace)::FileURLLoader::*)(std::unique_ptr<content::FileURLLoaderObserver>, unsigned int), std::tuple<base::internal::UnretainedWrapper<content::(anonymous namespace)::FileURLLoader, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0>, std::nullptr_t>, 0, 1> ()
    at ../../../../../src/3rdparty/chromium/base/functional/bind_internal.h:1058
#52 RunOnce () at ../../../../../src/3rdparty/chromium/base/functional/bind_internal.h:971
#53 0x00007f5e3dcdaf89 in base::OnceCallback<void (unsigned int)>::Run(unsigned int) && ()
    at ../../../../../src/3rdparty/chromium/base/functional/callback.h:156
#54 mojo::DataPipeProducer::OnWriteComplete ()
    at ../../../../../src/3rdparty/chromium/mojo/public/cpp/system/data_pipe_producer.cc:212
#55 0x00007f5e3dcdadb2 in base::internal::DecayedFunctorTraits<void (mojo::DataPipeProducer::*)(base::OnceCallback<void(unsigned int)>, mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int), base::WeakPtr<mojo::DataPipeProducer>&&, base::OnceCallback<void(unsigned int)>&&>::Invoke<void (mojo::DataPipeProducer::*)(base::OnceCallback<void(unsigned int)>, mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int), base::WeakPtr<mojo::DataPipeProducer> const&, base::OnceCallback<void(unsigned int)>, mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int> ()
    at ../../../../../src/3rdparty/chromium/base/functional/bind_internal.h:729
#56 base::internal::InvokeHelper<true, base::internal::FunctorTraits<void (mojo::DataPipeProducer::*&&)(base::OnceCallback<void(unsigned int)>, mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int), base::WeakPtr<mojo::DataPipeProducer>&&, base::OnceCallback<void(unsigned int)>&&>, void, 0ul, 1ul>::MakeItSo<void (mojo::DataPipeProducer::*)(base::OnceCallback<void(unsigned int)>, mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int), std::tuple<base::WeakPtr<mojo::DataPipeProducer>, base::OnceCallback<void(unsigned int)> >, mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int> () at ../../../../../src/3rdparty/chromium/base/functional/bind_internal.h:945
#57 base::internal::Invoker<base::internal::FunctorTraits<void (mojo::DataPipeProducer::*&&)(base::OnceCallback<void(unsigned int)>, mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int), base::WeakPtr<mojo::DataPipeProducer>&&, base::OnceCallback<void(unsigned int)>&&>, base::internal::BindState<true, true, false, void (mojo::DataPipeProducer::*)(base::OnceCallback<void(unsigned int)>, mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int), base::WeakPtr<mojo::DataPipeProducer>, base::OnceCallback<void(unsigned int)> >, void(mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int)>::RunImpl<void (mojo::DataPipeProducer::*)(base::OnceCallback<void(unsigned int)>, mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int), std::tuple<base::WeakPtr<mojo::DataPipeProducer>, base::OnceCallback<void(unsigned int)> >, 0ul, 1ul> () at ../../../../../src/3rdparty/chromium/base/functional/bind_internal.h:1058
#58 base::internal::Invoker<base::internal::FunctorTraits<void (mojo::DataPipeProducer::*&&)(base::OnceCallback<void(unsigned int)>, mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int), base::WeakPtr<mojo::DataPipeProducer>&&, base::OnceCallback<void(unsigned int)>&&>, base::internal::BindState<true, true, false, void (mojo::DataPipeProducer::*)(base::OnceCallback<void(unsigned int)>, mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int), base::WeakPtr<mojo::DataPipeProducer>, base::OnceCallback<void(unsigned int)> >, void(mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int)>::RunOnce () at ../../../../../src/3rdparty/chromium/base/functional/bind_internal.h:971
#59 0x00007f5e3dcdacaa in base::OnceCallback<void (mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int)>::Run(mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int) && ()
    at ../../../../../src/3rdparty/chromium/base/functional/callback.h:156
#60 base::internal::DecayedFunctorTraits<base::OnceCallback<void(mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int)>, mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>&&, unsigned int&&>::Invoke<base::OnceCallback<void(mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int)>, mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int> () at ../../../../../src/3rdparty/chromium/base/functional/bind_internal.h:804
#61 base::internal::InvokeHelper<false, base::internal::FunctorTraits<base::OnceCallback<void (mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int)>&&, mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>&&, unsigned int&&>, void, 0ul, 1ul>::MakeItSo<base::OnceCallback<void (mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int)>, std::tuple<mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int>>(base::OnceCallback<void (mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int)>&&, std::tuple<mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int>&&) () at ../../../../../src/3rdparty/chromium/base/functional/bind_internal.h:921
#62 base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void(mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int)>&&, mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>&&, unsigned int&&>, base::internal::BindState<false, true, true, base::OnceCallback<void(mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int)>, mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int>, void()>::RunImpl<base::OnceCallback<void(mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int)>, std::tuple<mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int>, 0ul, 1ul> () at ../../../../../src/3rdparty/chromium/base/functional/bind_internal.h:1058
#63 base::internal::Invoker<base::internal::FunctorTraits<base::OnceCallback<void(mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int)>&&, mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>&&, unsigned int&&>, base::internal::BindState<false, true, true, base::OnceCallback<void(mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int)>, mojo::ScopedHandleBase<mojo::DataPipeProducerHandle>, unsigned int>, void()>::RunOnce ()
    at ../../../../../src/3rdparty/chromium/base/functional/bind_internal.h:971
#64 0x00007f5e3d34866e in base::OnceCallback<void ()>::Run() && ()
    at ../../../../../src/3rdparty/chromium/base/functional/callback.h:156
#65 base::TaskAnnotator::RunTaskImpl () at ./../../../../../src/3rdparty/chromium/base/task/common/task_annotator.cc:209
#66 0x00007f5e3d37e539 in RunTask<base::internal::TaskTracker::RunTaskImpl(base::internal::Task&, const base::TaskTraits&, base::internal::TaskSource*, const base::internal::SequenceToken&)::<lambda(perfetto::EventContext&)> > ()
    at ../../../../../src/3rdparty/chromium/base/task/common/task_annotator.h:106
#67 base::internal::TaskTracker::RunTaskImpl ()
    at ./../../../../../src/3rdparty/chromium/base/task/thread_pool/task_tracker.cc:691
#68 0x00007f5e3d37ee14 in base::internal::TaskTracker::RunSkipOnShutdown ()
    at ./../../../../../src/3rdparty/chromium/base/task/thread_pool/task_tracker.cc:676
#69 0x00007f5e3d37f0b0 in base::internal::TaskTracker::RunTask ()
    at ./../../../../../src/3rdparty/chromium/base/task/thread_pool/task_tracker.cc:504
#70 0x00007f5e3d37dcbb in base::internal::TaskTracker::RunAndPopNextTask ()
    at ./../../../../../src/3rdparty/chromium/base/task/thread_pool/task_tracker.cc:394
#71 0x00007f5e3d38b719 in base::internal::WorkerThread::RunWorker ()
    at ./../../../../../src/3rdparty/chromium/base/task/thread_pool/worker_thread.cc:473
#72 0x00007f5e3d38bf4d in base::internal::WorkerThread::RunPooledWorker ()
    at ./../../../../../src/3rdparty/chromium/base/task/thread_pool/worker_thread.cc:359
#73 0x00007f5e3d38c0db in base::internal::WorkerThread::ThreadMain ()
    at ./../../../../../src/3rdparty/chromium/base/task/thread_pool/worker_thread.cc:339
#74 0x00007f5e3d3a77c5 in ThreadFunc ()
    at ./../../../../../src/3rdparty/chromium/base/threading/platform_thread_posix.cc:103
#75 0x00007f5e32e7b464 in start_thread (arg=<optimized out>) at pthread_create.c:448
#76 0x00007f5e32efe5ac in __GI___clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

When RKWard crashed with SIGTRAP, the error message involved a bad file descriptor in scoped_file.cc(45) which corresponded with frame #13 in base::internal::ScopedFDCloseTraits::Free () at ./../../../../../src/3rdparty/chromium/base/files/scoped_file.cc:45

rkward
KCrash: Application 'rkward' crashing... crashRecursionCounter = 2
KCrash: Attempting to start /usr/libexec/drkonqi
[4340:4391:1127/090747.140404:FATAL:scoped_file.cc(45)] Check failed: . : Bad file descriptor (9)
kf5idletime_wayland: This plugin does not support polling idle time
Trace/breakpoint trap      (core dumped) rkward

In the trace of all threads, which I attached at https://bugs.kde.org/show_bug.cgi?id=512460#c6 , thread 3 showed a crash in QtWebEngineCore::ContentClientQt::SetGpuInfo with a trace like that in the first type of crash. There might be a race condition between which of the SIGSEGV in QtWebEngineCore::ContentClientQt::SetGpuInfo and the SIGTRAP due to the bad file descriptor in the check in base::internal::ScopedFDCloseTraits::Free happened first.

I ran QSG_RHI_BACKEND=software rkward with 0.8.2 from rkward-0.8.2-1.fc43.x86_64 as suggested by Thomas, and the first type of crash happened. I previously booted with nomodeset on the kernel command line to use the llvmpipe mesa driver and simpledrm kernel driver, and the problem also happened. So the problem wasn't specific to the radeonsi and amdgpu drivers I normally used. There might be some incompatibility in qtwebengine between Qt 6.10.0 and 6.10.1.

The program slitherer sometimes crashed when used in Fedora Rawhide KDE live images running the installer anaconda as reported by Adam Williamson at https://bugzilla.redhat.com/show_bug.cgi?id=2417493 slitherer started crashing with Qt 6.10.1, and it uses qtwebengine.

I reproduced the slitherer crash in a Rawhide KDE live image VM the second time I started the installer from Welcome Center. The trace looked similar to the first one I reported.  The top of the trace was in the same function and line QtWebEngineCore::ContentClientQt::SetGpuInfo () at /usr/src/debug/qt6-qtwebengine-6.10.1-2.fc44.x86_64/src/core/content_client_qt.cpp:528 as the RKWard crashes.

I reported the RKWard and slitherer crashes at https://qt-project.atlassian.net/browse/QTBUG-142497.

The patch at https://codereview.qt-project.org/c/qt/qtwebengine/+/702597 was marked as fixing https://qt-project.atlassian.net/browse/QTBUG-142497 and https://qt-project.atlassian.net/browse/QTBUG-142720 The problem was made a blocker for Qt 6.10.2 https://qt-project.atlassian.net/browse/QTBUG-142497?focusedCommentId=2604230

FEDORA-2026-d3f6fb57b0 (qt6-qtwebengine-6.10.1-3.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-d3f6fb57b0

I upgraded to qt6-qtwebengine-6.10.1-3.fc43 and rebooted. RKWard crashed with the same kind of trace. 

(gdb) bt
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=11, no_tid=no_tid@entry=0)
    at pthread_kill.c:44
#1  0x00007ffa69e7b493 in __pthread_kill_internal (threadid=<optimized out>, signo=11) at pthread_kill.c:89
#2  0x00007ffa69e2115e in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
#3  0x00007ffa6eeac573 in KCrash::defaultCrashHandler(int) () at /lib64/libKF6Crash.so.6
#4  0x00007ffa69e21290 in <signal handler called> () at /lib64/libc.so.6
#5  QtWebEngineCore::ContentClientQt::SetGpuInfo ()
    at /usr/src/debug/qt6-qtwebengine-6.10.1-3.fc43.x86_64/src/core/content_client_qt.cpp:528
#6  0x00007ffa7298a869 in content::GpuDataManagerImplPrivate::UpdateGpuInfo ()
    at ../../../../../src/3rdparty/chromium/content/browser/gpu/gpu_data_manager_impl_private.cc:1051
#7  0x00007ffa72982dbb in content::GpuDataManagerImpl::UpdateGpuInfo ()
    at ../../../../../src/3rdparty/chromium/content/browser/gpu/gpu_data_manager_impl.cc:168
#8  0x00007ffa7299ae04 in content::GpuProcessHost::DidInitialize ()
    at ../../../../../src/3rdparty/chromium/content/browser/gpu/gpu_process_host.cc:988
#9  0x00007ffa75df9358 in viz::GpuHostImpl::DidInitialize ()
    at ./../../../../../src/3rdparty/chromium/components/viz/host/gpu_host_impl.cc:498
#10 0x00007ffa70c2fb54 in viz::mojom::GpuHostStubDispatch::Accept ()
    at ./gen/services/viz/privileged/mojom/gl/gpu_host.mojom.cc:1297
#11 0x00007ffa74cbce32 in mojo::InterfaceEndpointClient::HandleValidatedMessage ()
    at ../../../../../src/3rdparty/chromium/mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1052
#12 0x00007ffa74cbe7be in mojo::MessageDispatcher::Accept ()
    at ../../../../../src/3rdparty/chromium/mojo/public/cpp/bindings/lib/message_dispatcher.cc:43
#13 0x00007ffa74cbcadc in mojo::InterfaceEndpointClient::HandleIncomingMessage ()
    at ../../../../../src/3rdparty/chromium/mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:724
#14 0x00007ffa74cc20e2 in mojo::internal::MultiplexRouter::ProcessIncomingMessage ()
    at ../../../../../src/3rdparty/chromium/mojo/public/cpp/bindings/lib/multiplex_router.cc:1121
#15 0x00007ffa74cc5952 in mojo::internal::MultiplexRouter::Accept ()
--Type <RET> for more, q to quit, c to continue without paging--c
    at ../../../../../src/3rdparty/chromium/mojo/public/cpp/bindings/lib/multiplex_router.cc:734
#16 0x00007ffa74cbe7be in mojo::MessageDispatcher::Accept ()
    at ../../../../../src/3rdparty/chromium/mojo/public/cpp/bindings/lib/message_dispatcher.cc:43
#17 0x00007ffa74cb6311 in mojo::Connector::DispatchMessage ()
    at ../../../../../src/3rdparty/chromium/mojo/public/cpp/bindings/lib/connector.cc:562
#18 0x00007ffa74cb700c in mojo::Connector::ReadAllAvailableMessages ()
    at ../../../../../src/3rdparty/chromium/mojo/public/cpp/bindings/lib/connector.cc:620
#19 0x00007ffa74cb715e in mojo::Connector::OnHandleReadyInternal ()
    at ../../../../../src/3rdparty/chromium/mojo/public/cpp/bindings/lib/connector.cc:452
#20 mojo::Connector::OnWatcherHandleReady ()
    at ../../../../../src/3rdparty/chromium/mojo/public/cpp/bindings/lib/connector.cc:418
#21 0x00007ffa70ba4a3e in base::RepeatingCallback<void (unsigned int)>::Run(unsigned int) const & ()
    at ../../../../../src/3rdparty/chromium/base/functional/callback.h:344
#22 mojo::SimpleWatcher::DiscardReadyState ()
    at ../../../../../src/3rdparty/chromium/mojo/public/cpp/system/simple_watcher.h:192
#23 0x00007ffa74cded1d in base::RepeatingCallback<void (unsigned int, mojo::HandleSignalsState const&)>::Run(unsigned int, mojo::HandleSignalsState const&) const & () at ../../../../../src/3rdparty/chromium/base/functional/callback.h:344
#24 mojo::SimpleWatcher::OnHandleReady ()
    at ../../../../../src/3rdparty/chromium/mojo/public/cpp/system/simple_watcher.cc:278
#25 0x00007ffa7434866e in base::OnceCallback<void ()>::Run() && ()
    at ../../../../../src/3rdparty/chromium/base/functional/callback.h:156
#26 base::TaskAnnotator::RunTaskImpl () at ./../../../../../src/3rdparty/chromium/base/task/common/task_annotator.cc:209
#27 0x00007ffa7436d671 in RunTask<base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)::<lambda(perfetto::EventContext&)> > ()
    at ../../../../../src/3rdparty/chromium/base/task/common/task_annotator.h:106
#28 base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl ()
    at ./../../../../../src/3rdparty/chromium/base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:456
#29 0x00007ffa7436e672 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork ()
    at ./../../../../../src/3rdparty/chromium/base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:330
#30 0x00007ffa6f534d0a in QtWebEngineCore::MessagePumpForUIQt::handleScheduledWork ()
    at /usr/src/debug/qt6-qtwebengine-6.10.1-3.fc43.x86_64/src/core/browser_main_parts_qt.cpp:154
#31 QtWebEngineCore::MessagePumpForUIQt::MessagePumpForUIQt()::{lambda()#1}::operator()() const ()
    at /usr/src/debug/qt6-qtwebengine-6.10.1-3.fc43.x86_64/src/core/browser_main_parts_qt.cpp:107
#32 std::__invoke_impl<void, QtWebEngineCore::MessagePumpForUIQt::MessagePumpForUIQt()::{lambda()#1}&>(std::__invoke_other, QtWebEngineCore::MessagePumpForUIQt::MessagePumpForUIQt()::{lambda()#1}&) () at /usr/include/c++/15/bits/invoke.h:63
#33 std::__invoke_r<void, QtWebEngineCore::MessagePumpForUIQt::MessagePumpForUIQt()::{lambda()#1}&>(QtWebEngineCore::MessagePumpForUIQt::MessagePumpForUIQt()::{lambda()#1}&) () at /usr/include/c++/15/bits/invoke.h:113
#34 std::_Function_handler<void (), QtWebEngineCore::MessagePumpForUIQt::MessagePumpForUIQt()::{lambda()#1}>::_M_invoke(std::_Any_data const&) () at /usr/include/c++/15/bits/std_function.h:292
#35 0x00007ffa6a558f55 in QObject::event (this=<optimized out>, e=<optimized out>)
    at /usr/src/debug/qt6-qtbase-6.10.1-3.fc43.x86_64/src/corelib/kernel/qobject.cpp:1443
#36 0x00007ffa6d63db9f in QApplicationPrivate::notify_helper
    (this=<optimized out>, receiver=0x565267aed020, e=0x56526824e320)
    at /usr/src/debug/qt6-qtbase-6.10.1-3.fc43.x86_64/src/widgets/kernel/qapplication.cpp:3305
#37 0x00007ffa6a4fc4e8 in QCoreApplication::notifyInternal2 (receiver=0x565267aed020, event=0x56526824e320)
    at /usr/src/debug/qt6-qtbase-6.10.1-3.fc43.x86_64/src/corelib/kernel/qcoreapplication.cpp:1109
#38 0x00007ffa6a4fc74d in QCoreApplication::sendEvent (receiver=<optimized out>, event=<optimized out>)
    at /usr/src/debug/qt6-qtbase-6.10.1-3.fc43.x86_64/src/corelib/kernel/qcoreapplication.cpp:1549
#39 0x00007ffa6a4ffb09 in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x5652668eaf30)
    at /usr/src/debug/qt6-qtbase-6.10.1-3.fc43.x86_64/src/corelib/kernel/qcoreapplication.cpp:1904
#40 0x00007ffa6a81efcf in postEventSourceDispatch (s=0x5652668feba0)
    at /usr/src/debug/qt6-qtbase-6.10.1-3.fc43.x86_64/src/corelib/kernel/qeventdispatcher_glib.cpp:246
#41 0x00007ffa6a2e82a3 in g_main_dispatch (context=0x7ffa48000f60) at ../glib/gmain.c:3565
#42 g_main_context_dispatch_unlocked (context=0x7ffa48000f60) at ../glib/gmain.c:4425
#43 0x00007ffa6a2f11f8 in g_main_context_iterate_unlocked
    (context=context@entry=0x7ffa48000f60, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>)
    at ../glib/gmain.c:4490
#44 0x00007ffa6a2f13a3 in g_main_context_iteration (context=0x7ffa48000f60, may_block=1) at ../glib/gmain.c:4556
#45 0x00007ffa6a81e80d in QEventDispatcherGlib::processEvents (this=0x5652668fead0, flags=...)
    at /usr/src/debug/qt6-qtbase-6.10.1-3.fc43.x86_64/src/corelib/kernel/qeventdispatcher_glib.cpp:399
#46 0x00007ffa6a509063 in QEventLoop::exec (this=this@entry=0x7fffc8a1ef40, flags=..., flags@entry=...)
    at /usr/src/debug/qt6-qtbase-6.10.1-3.fc43.x86_64/src/corelib/global/qflags.h:77
#47 0x00007ffa6a504819 in QCoreApplication::exec ()
    at /usr/src/debug/qt6-qtbase-6.10.1-3.fc43.x86_64/src/corelib/kernel/qcoreapplication.cpp:1452
#48 0x00007ffa6acdf19d in QGuiApplication::exec ()
    at /usr/src/debug/qt6-qtbase-6.10.1-3.fc43.x86_64/src/gui/kernel/qguiapplication.cpp:1973
#49 0x00007ffa6d63db09 in QApplication::exec ()
    at /usr/src/debug/qt6-qtbase-6.10.1-3.fc43.x86_64/src/widgets/kernel/qapplication.cpp:2575
#50 0x000056522a98ed28 in main (argc=<optimized out>, argv=<optimized out>)
    at /usr/src/debug/rkward-0.8.2-1.fc43.x86_64/rkward/main.cpp:294
(gdb) frame 5
#5  QtWebEngineCore::ContentClientQt::SetGpuInfo ()
    at /usr/src/debug/qt6-qtwebengine-6.10.1-3.fc43.x86_64/src/core/content_client_qt.cpp:528
528                         .status_values[gpu::GPU_FEATURE_TYPE_ACCELERATED_GL];

The patch https://codereview.qt-project.org/c/qt/qtwebengine/+/702597 moved the crashing line from content_client_qt.cpp to content_gpu_client_qt.cpp, but the trace still showed it as in content_client_qt.cpp. The change at https://src.fedoraproject.org/rpms/qt6-qtwebengine/c/5cba9df9f5fe02b4e5d2c2b8717e2fb5af742f98?branch=rawhide added 
+            # https://codereview.qt-project.org/c/qt/qtwebengine/+/702597            
+            Patch81:  qtwebengine-move-gpu-info-logging-to-gpu-thread.patch

The %patch line didn't appear to be added in that change though as it was for other patches. qtwebengine-move-gpu-info-logging-to-gpu-thread.patch didn't seem to be applied in https://kojipkgs.fedoraproject.org//packages/qt6-qtwebengine/6.10.1/3.fc43/data/logs/x86_64/build.log
...
Patch #80 (qtwebengine-fix-arm-build.patch):
+ echo 'Patch #80 (qtwebengine-fix-arm-build.patch):'
+ /usr/bin/patch --no-backup-if-mismatch -f -p1 -b --suffix .fix-arm-build --fuzz=0
patching file src/core/CMakeLists.txt
Hunk #1 succeeded at 599 (offset 29 lines).
Patch #100 (qtwebengine-add-missing-pipewire-headers.patch):
+ echo 'Patch #100 (qtwebengine-add-missing-pipewire-headers.patch):'
+ /usr/bin/patch --no-backup-if-mismatch -f -p1 -b --suffix .add-missing-pipewire-headers --fuzz=0
patching file src/3rdparty/chromium/third_party/webrtc/modules/video_capture/linux/pipewire_session.h
patching file src/3rdparty/chromium/third_party/webrtc/modules/video_capture/linux/video_capture_pipewire.cc
patching file src/3rdparty/chromium/third_party/webrtc/modules/video_capture/linux/video_capture_pipewire.h

The file content_gpu_client_qt.cpp which was created in qtwebengine-move-gpu-info-logging-to-gpu-thread.patch wasn't in the qt6-qtwebengine-debugsource-6.10.1-3.fc43.x86_64.rpm which I installed. 
ll /usr/src/debug/qt6-qtwebengine-6.10.1-3.fc43.x86_64/src/core/content_client_qt.cpp
-rw-r--r--. 1 root root 27720 Nov 14 02:55 /usr/src/debug/qt6-qtwebengine-6.10.1-3.fc43.x86_64/src/core/content_client_qt.cpp
ll /usr/src/debug/qt6-qtwebengine-6.10.1-3.fc43.x86_64/src/core/content_gpu_client_qt.cpp
ls: cannot access '/usr/src/debug/qt6-qtwebengine-6.10.1-3.fc43.x86_64/src/core/content_gpu_client_qt.cpp': No such file or directory

FEDORA-2026-d3f6fb57b0 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-d3f6fb57b0`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-d3f6fb57b0

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

FEDORA-2026-d3f6fb57b0 (qt6-qtwebengine-6.10.1-3.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.

FEDORA-2026-fc93919310 (qt6-qtwebengine-6.10.1-4.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-fc93919310

FEDORA-2026-fc93919310 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-fc93919310`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-fc93919310

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

FEDORA-2026-fc93919310 (qt6-qtwebengine-6.10.1-4.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.