<!--  As an open source project with a dedicated but small maintainer team, it can sometimes take a long time for issues to be addressed so please be patient and we will get back to you as soon as we can.
-->

### Preflight Checklist
<!-- Please ensure you've completed the following steps by replacing [ ] with [x]-->

* [X] I have read the [Contributing Guidelines](https://github.com/electron/electron/blob/master/CONTRIBUTING.md) for this project.
* [X] I agree to follow the [Code of Conduct](https://github.com/electron/electron/blob/master/CODE_OF_CONDUCT.md) that this project adheres to.
* [X] I have searched the issue tracker for an issue that matches the one I want to file, without success.

### Issue Details

* **Electron Version:**
  * 4.2.9
  * 5.0.10
  * 6.0.2
  * 6.0.3
* **Operating System:** 
  * macOS 10.14.5
* **Last Known Working Electron version:**
  * N/A

Hi,

I intercept the app shutdown using `before-quit` event handler and call `preventDefault` when I receive the event in the very first time. Then I do some clean up and call `app.quit()` once again to make sure that the normal termination happens.

The app terminates and a crash report dialog appears (excerpt below)

```
Process:               Electron [13005]
Path:                  /Users/USER/*/Electron.app/Contents/MacOS/Electron
Identifier:            com.github.Electron
Version:               5.0.10 (5.0.10)
Code Type:             X86-64 (Native)
Parent Process:        ??? [1]
Responsible:           Electron [13005]
User ID:               501

Date/Time:             2019-08-20 17:56:13.682 +0200
OS Version:            Mac OS X 10.14.5 (18F203)
Report Version:        12
Bridge OS Version:     3.5 (16P5200)
Anonymous UUID:        A6609847-C7B4-9C4A-35BF-39025881C86C

Sleep/Wake UUID:       CC7BA0DC-7A56-49AC-AC04-7B847DDBA7B1

Time Awake Since Boot: 20000 seconds
Time Since Wake:       95 seconds

System Integrity Protection: enabled

Crashed Thread:        0  CrBrowserMain  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0x0000000000000000
Exception Note:        EXC_CORPSE_NOTIFY

Termination Signal:    Segmentation fault: 11
Termination Reason:    Namespace SIGNAL, Code 0xb
Terminating Process:   exc handler [13005]

VM Regions Near 0:
--> 
    __TEXT                 00000001077ec000-0000000107815000 [  164K] r-x/rwx SM=COW  /Users/USER/*/Electron.app/Contents/MacOS/Electron

Thread 0 Crashed:: CrBrowserMain  Dispatch queue: com.apple.main-thread
0   com.github.Electron.framework 	0x0000000109a43c8f 0x107821000 + 35794063
1   com.github.Electron.framework 	0x0000000109a4220e 0x107821000 + 35787278
2   com.github.Electron.framework 	0x0000000109a43d9f 0x107821000 + 35794335
3   com.github.Electron.framework 	0x0000000109a436e0 0x107821000 + 35792608
4   com.github.Electron.framework 	0x0000000109a05f07 0x107821000 + 35540743
5   com.github.Electron.framework 	0x0000000109a05f9e 0x107821000 + 35540894
6   com.github.Electron.framework 	0x000000010782379f AtomMain + 95
7   com.github.Electron           	0x00000001077ed9b0 0x1077ec000 + 6576
8   libdyld.dylib                 	0x00007fff5c0553d5 start + 1

```

Symbolicated crash report:
[crash.txt](https://github.com/electron/electron/files/3525362/crash.txt)

Based on the crash report, the `Notification` destructor triggers the crash. So I've poked around creating Notifications in JS and somehow I've managed to crash the app when creating notifications from the `before-quit` handler.

I can't really explain why creating notifications from the `before-quit` does crash the app, because in the case of my own app, it does crash regardless that, i.e I can just create one notification at the start and the app will crash on exit anyway. 

It's possible that the amount of allocated memory plays its role. Perhaps some of notifications are being evicted from memory sooner when more JS objects are being allocated. It's possible that it's a double-release issue.

Also, I think the fact that I retain the notifications in array affects the garbage collection somehow.

The crash itself is not 100% reproducible but it happens often enough. So if you run my branch a few times in a row, you should see the crash dialog. 

You can observe the `ReportCrash` process in activity monitor (see the screenshot I've attached to the issue). If you see the `ReportCrash` spike in CPU usage, wait a little before it pops the crash report dialog. It takes some time to symbolicate the crash log if you have DSYMs installed.

I've also tried to `destroy()` notifications manually which caused the following output in console:

```
Electron(64844,0x10ce985c0) malloc: Incorrect checksum for freed object 0x7fc124259c00: probably modified after being freed.
Corrupt value: 0x701124226b4
Electron(64844,0x10ce985c0) malloc: *** set a breakpoint in malloc_error_break to debug
```

and such output too:

```
Electron(64867,0x105c925c0) malloc: *** error for object 0x7fc797ecd490: pointer being freed was not allocated
Electron(64867,0x105c925c0) malloc: *** set a breakpoint in malloc_error_break to debug
```

So I suppose something is over-releasing the memory...

### Expected Behavior
No crash

### Actual Behavior
Crash

### To Reproduce

1. Clone the repo and run the app

```sh
$ git clone https://github.com/pronebird/electron.git -b issue19842
$ npm install
$ npm start
```

2. Press "quit" button in the application window

3. See the crash report dialog appear (with a certain success rate)

### Screenshots

<img width="1632" alt="Screenshot 2019-08-22 at 14 44 38" src="https://user-images.githubusercontent.com/704044/63515912-314d8280-c4ec-11e9-9fcc-08a2c12864a7.png">


### Additional Information
<!-- Add any other context about the problem here. -->
shell/browser/api/atom_api_notification.cc
v8::Local<v8::Value> val,
                     electron::NotificationAction* out) {
    gin::Dictionary dict(isolate);
    if (!ConvertFromV8(isolate, val, &dict))
      return false;
    if (!dict.Get("type", &(out->type))) {
      return false;
    }
    dict.Get("text", &(out->text));
    return true;
  }
  static v8::Local<v8::Value> ToV8(v8::Isolate* isolate,
                                   electron::NotificationAction val) {
    gin::Dictionary dict = gin::Dictionary::CreateEmpty(isolate);
    dict.Set("text", val.text);
    dict.Set("type", val.type);
    return ConvertToV8(isolate, dict);
  }
};
}  
namespace electron {
namespace api {
Notification::Notification(gin::Arguments* args) {