GNOME Shell crashes when changing outputs back and forth

The second time I run systemctl --user restart pipewire.service, GNOME Shell crashes. It seems to be caused by a double-free. Here's the backtrace:

Core was generated by `/usr/bin/gnome-shell'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f8cac147451 in loop_destroy_source (object=0x7f8c680a0fc8, source=0x4) at ../spa/plugins/support/loop.c:651
651		spa_log_trace(impl->impl->log, NAME" %p ", impl);
[Current thread is 1 (Thread 0x7f8c63f40640 (LWP 56362))]
(gdb) bt
#0  0x00007f8cac147451 in loop_destroy_source (object=0x7f8c680a0fc8, source=0x4) at ../spa/plugins/support/loop.c:651
#1  0x00007f8c8c582662 in on_remote_data (data=0x7f8c340187f0, fd=<optimized out>, mask=<optimized out>) at ../src/modules/module-protocol-native.c:762
#2  0x00007f8cac146b7b in loop_iterate (object=0x7f8c680a0fc8, timeout=<optimized out>) at ../spa/plugins/support/loop.c:306
#3  0x00007f8cbf57ec86 in do_loop (user_data=0x7f8c680156e0) at ../src/pipewire/thread-loop.c:241
#4  0x00007f8cc1a8f3e9 in start_thread () at /usr/lib/libpthread.so.0
#5  0x00007f8cc2684293 in clone () at /usr/lib/libc.so.6

Full backtrace:

Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f8cac147451 in loop_destroy_source (object=0x7f8c680a0fc8, source=0x4) at ../spa/plugins/support/loop.c:651
651		spa_log_trace(impl->impl->log, NAME" %p ", impl);
[Current thread is 1 (Thread 0x7f8c63f40640 (LWP 56362))]
(gdb) bt full
#0  0x00007f8cac147451 in loop_destroy_source (object=0x7f8c680a0fc8, source=0x4) at ../spa/plugins/support/loop.c:651
        _l = <optimized out>
        impl = 0x4
        __func__ = "loop_destroy_source"
#1  0x00007f8c8c582662 in on_remote_data (data=0x7f8c340187f0, fd=<optimized out>, mask=<optimized out>) at ../src/modules/module-protocol-native.c:762
        _f = <optimized out>
        _o = <optimized out>
        impl = 0x7f8c340187f0
        this = 0x7f8c34035150
        conn = <optimized out>
        context = <optimized out>
        loop = 0x7f8c6804c200
        res = -32
        __func__ = "on_remote_data"
#2  0x00007f8cac146b7b in loop_iterate (object=0x7f8c680a0fc8, timeout=<optimized out>) at ../spa/plugins/support/loop.c:306
        s = <optimized out>
        impl = 0x7f8c680a0fc8
        loop = 0x7f8c680a0fe0
        ep = 
            {{events = 17, data = 0x7f8c34004930}, {events = 0, data = 0x0}, {events = 1021088792, data = 0x0}, {events = 4294967295, data = 0x0}, {events = 1073751872, data = 0x45b19132a76cf900}, {events = 4294967295, data = 0x557c9c6a7a10}, {events = 1074025104, data = 0x7f8c40046ac0}, {events = 3052, data = 0x1}, {events = 1676936768, data = 0x7f8cc34c2b5d}, {events = 2, data = 0x800000000000000e}, {events = 0, data = 0x0}, {events = 0, data = 0x0}, {events = 0, data = 0x0}, {events = 2048, data = 0x7f0}, {events = 128, data = 0x6e}, {events = 119, data = 0x7f8cc260ed59 <_int_malloc+3465>}, {events = 0, data = 0x7f8c40000080}, {events = 126, data = 0x7}, {events = 0, data = 0x7f0}, {events = 80, data = 0x8e}, {events = 2080, data = 0x20}, {events = 128, data = 0x0}, {events = 0, data = 0x7f8cc260c305 <malloc_consolidate+373>}, {events = 1811939456, data = 0x7f8cc260c9cb <_int_free+1675>}, {events = 8, data = 0x7f8c63f3f890}, {events = 1676933200, data = 0x45b19132a76cf900}, {events = 1811939360, data = 0x7f8c680157e0}, {events = 1744918496, data = 0x20}, {events = 1676936768, data = 0x27}, {events = 2690000160, data = 0x7f8cc1a9b20f <pthread_setname_np+255>}, {events = 0, data = 0x0}, {events = 1676936768, data = 0x7f8cc3a19397 <_dl_deallocate_tls+87>}}
        i = 0
        nfds = <optimized out>
#3  0x00007f8cbf57ec86 in do_loop (user_data=0x7f8c680156e0) at ../src/pipewire/thread-loop.c:241
        _f = <optimized out>
        _res = -95
        _o = <optimized out>
        this = 0x7f8c680156e0
        res = <optimized out>
        __func__ = "do_loop"
#4  0x00007f8cc1a8f3e9 in start_thread () at /usr/lib/libpthread.so.0
#5  0x00007f8cc2684293 in clone () at /usr/lib/libc.so.6