Extension host crash loop: EXC_BREAKPOINT on V8Worker thread during Maglev concurrent compilation (macOS arm64, VS Code 1.126+/Electron 42.2.0)

[miles-augment]

vscode-maglev-crash-minidumps.zip

this issue occur when all extensions are disabled?: No — the trigger requires a
sustained extension-host JS workload (see Steps to Reproduce). However, the crash site is
entirely inside V8's background compiler; there are no extension frames on the crashing stack.

• VS Code Version: 1.126.0, 1.127.0, and 1.128.0-insider commit 86df0e5 (all reproduce; stock downloads, untouched)
• OS Version: macOS 15.x, Apple Silicon (arm64)
• Electron: 42.2.0, Node 22.x

Summary

Under a sustained agent-style chat workload, the extension host process
(Code Helper (Plugin)) deterministically crashes with exit code 5 after
2–8 minutes. The crash is an EXC_BREAKPOINT (V8 CHECK/trap, brk #0) on a
background V8Worker thread, at a byte-identical PC in every crash:

Electron Framework +0x8fa45c

We collected 9 Crashpad minidumps across three VS Code versions (including
1.128.0-insider), two storage backends, an automated test harness and an
interactive developer session. All 8 stable-build dumps have a frame-for-frame
identical crash-thread stack (heatmap below), the Insiders dump shows the same
EXC_BREAKPOINT-in-Electron-Framework-background-thread signature (different raw
offsets, as Insiders ships a different Electron Framework build), and disabling
V8's Maglev compiler (--js-flags=--no-maglev) makes the crash disappear
entirely in an otherwise unchanged A/B.

Conclusion: a V8 Maglev concurrent (background) compilation bug in
Electron 42.2.0 tripping an internal CHECK while compiling extension-host JS.

Dump heatmap (8/8 dumps, single failure path)

Symbolicated against stock Electron 42.2.0 breakpad symbols. VS Code ships a
patched Electron build, so some neighboring symbol names are approximate (*),
but the Maglev frames form the exact real nesting order of a concurrent Maglev
compile — not producible by symbol skew.

Heat	Frame	Symbol
8/8	pc, lr	+0x8fa45c / +0x8fa1fc — CHECK/trap site (*)
8/8	frame[0]	turboshaft::GraphEmitter<...> (*)
8/8	frame[1]	v8::internal::maglev::MaglevGraphBuilder::VisitSingleBytecode()
8/8	frame[2]	(*)
8/8	frame[3]	v8::internal::maglev::MaglevGraphBuilder::Build()
8/8	frame[4,5]	v8::internal::maglev::MaglevCompiler::Compile(LocalIsolate*, ...)
8/8	frame[6,7]	v8::internal::maglev::MaglevConcurrentDispatcher::JobTask::Run(v8::JobDelegate*)
8/8	frame[8,9]	worker-pool thread bootstrap (*)
8/8	frame[10,11]	libsystem_pthread (_pthread_start)

Zero variance across all 8 dumps: same PC, same LR, same 12-frame stack.

The discriminating A/B: --js-flags=--no-maglev

Same machine, same day, same stock 1.127.0 binary, same test, same config:

Run	--js-flags=--no-maglev	Outcome
A	yes	passed — 1031 s sustained session, 45 chat turns, clean exit 0, peak ext-host RSS 405 MB
B (30 min later)	no	crashed — 334 s, exit code 5, minidump with the identical +0x8fa45c stack

Two flagged runs survived a combined ~33 minutes of the workload that reliably
kills unflagged instances in 2–8 minutes.

Ruled out

• Native modules — reproduced with the extension's only native module
  (classic-level.node / LevelDB) fully replaced by an in-memory Map.
• Window reloads — reproduced with reload cycles disabled.
• Version-specific regression — reproduces on 1.126.0, 1.127.0, and
  1.128.0-insider (commit 86df0e5, 2026-07-06 build): extension host crashed
  with code 5 at t=344s (16 turns), t=99s (4 turns) on retry, and t=454s
  (13 turns) in a third run that captured a minidump (included in the
  attachment): EXC_BREAKPOINT, PC in Electron Framework +0x6f72d8, background
  (pthread) thread — same signature class; raw offsets differ because Insiders
  ships a different Electron Framework build.
• Memory pressure / OOM — ext-host RSS stays < ~500 MB throughout; crash
  is a CHECK trap, not FatalProcessOutOfMemory.
• Extension/JS code — crash thread is a V8 background compiler thread; no
  extension frames on the crashing stack.

Steps to Reproduce

1. Install our extension (Augment) in stock VS Code 1.126.0, 1.127.0, or 1.128.0-insider on macOS arm64.
2. Run a long-lived AI-agent chat session in the extension host: repeated
   multi-turn streaming requests, large JSON message payloads, and periodic
   state persistence, sustained for up to 30 minutes.
3. The extension host (Code Helper (Plugin)) crashes with exit code 5 after
   2–8 minutes (149–480 s across runs in our automated Playwright harness).
4. Repeat with --js-flags=--no-maglev on the extension host (e.g. via
   argv.json): the identical workload runs to completion.

The workload requires our extension + backend, so it is not trivially
portable; we are happy to run the reproducer on request, capture additional
dumps, or test candidate fixes/flag combinations. The crashing stack itself
contains no extension frames.

Crash log excerpt (renderer/main log)

Extension host with pid <N> exited with code: 5, signal: unknown.
[UtilityProcess type: extensionHost, pid: <N>]: crashed with code 5 and reason 'crashed'

Crashed thread name: V8Worker; exception: EXC_BREAKPOINT (SIGTRAP).

Workaround

--js-flags=--no-maglev on the extension-host process fully mitigates.

Verified end-user delivery path: adding "js-flags": "--no-maglev" to
argv.json propagates the flag to the extension-host utility process
(Code Helper (Plugin), --utility-sub-type=node.mojom.NodeService — flag
visible on its command line), as well as renderer and other utility
processes. A stock instance without the argv.json entry does not carry the
flag (negative control).

Attachments

• 9 Crashpad minidumps (.dmp): 8 from VS Code 1.126.0/1.127.0 and 1 from
  1.128.0-insider (insiders-crash-52340899.dmp, commit 86df0e5)
• Symbolicated per-dump stacks (identical across the 8 stable dumps;
  representative one below)

pc        +0x8fa45c   (CHECK/trap site)
frame[1]  +0x2e481c   v8::internal::maglev::MaglevGraphBuilder::VisitSingleBytecode()
frame[3]  +0x35f45c   v8::internal::maglev::MaglevGraphBuilder::Build()
frame[4]  +0x7d4f4c   v8::internal::maglev::MaglevCompiler::Compile(...)
frame[5]  +0x7d4d2c   v8::internal::maglev::MaglevCompiler::Compile(...)
frame[6]  +0x4d9730   v8::internal::maglev::MaglevConcurrentDispatcher::JobTask::Run(...)
frame[7]  +0x4d92f8   v8::internal::maglev::MaglevConcurrentDispatcher::JobTask::Run(...)
frame[10] libsystem_pthread +0x6bc8
frame[11] libsystem_pthread +0x1b80   (_pthread_start)

Dump UUIDs: 1d1aa1cd, 25e67d29, 3debc2ad, 43f6e320, a9dc47d0, aa8d9657, af77f303, c6ed8c2b (stable); 52340899 (1.128.0-insider)

Insiders dump crash thread (raw offsets, Insiders Electron Framework build):

pc        Electron Framework +0x6f72d8   (EXC_BREAKPOINT / trap site)
lr        Electron Framework +0x6f7178
frames    Electron Framework +0x6f6fe8, +0x11cedf0, +0x72ea40, +0x86c1c8,
          +0x24571cc, +0x1413534, +0x251c158, +0xfebc9c
          libsystem_pthread +0x6bc8, +0x1b80 (_pthread_start)

[deepak1556]

Thanks for attaching the crash dump, symbols for our builds are different, here is the actual maglev crashing stack

Thread 8 (crashed)
 0  Electron Framework!v8::internal::maglev::MaglevGraphBuilder::GetContextAtDepth(v8::internal::maglev::ValueNode*, unsigned long, v8::internal::compiler::ScopeInfoRef*) [maglev-graph-builder.cc : 7724 + 0x0]
     x0 = 0x0000000000000000    x1 = 0x0000013c07317800
     x2 = 0x0000013c04d3fed8    x3 = 0x0000000000000800
     x4 = 0x0000000000000000    x5 = 0x0000000000000000
     x6 = 0x0000013c04f24648    x7 = 0x0000000000000000
     x8 = 0x00000000200171c4    x9 = 0xf578c1d0faf9003e
    x10 = 0x00000000000007e0   x11 = 0x000000000000002a
    x12 = 0x000000010fcabec0   x13 = 0x0000000000000010
    x14 = 0x0000000000000001   x15 = 0x0000000000000000
    x16 = 0x00000001849c6bf0   x17 = 0x0000000000380002
    x18 = 0x0000000000000000   x19 = 0x000000016ec5dd98
    x20 = 0x000000016ec5e198   x21 = 0x0000013c04d3fed8
    x22 = 0x0000000000000002   x23 = 0x0000000000000031
    x24 = 0x000000000000000c   x25 = 0x00000000000000d6
    x26 = 0x000000011a55c000   x27 = 0x000000011a779000
    x28 = 0x00000001185efb8e    fp = 0x000000016ec5dd80
     lr = 0x00000001102b3178    sp = 0x000000016ec5dd20
     pc = 0x00000001102b32d8
    Found by: given as instruction pointer in context
 1  Electron Framework!v8::internal::maglev::MaglevGraphBuilder::GetContextAtDepth(v8::internal::maglev::ValueNode*, unsigned long, v8::internal::compiler::ScopeInfoRef*) [maglev-graph-builder.h : 350 + 0xc]
     fp = 0x000000016ec5ddd0    lr = 0x00000001102b2fe8
     sp = 0x000000016ec5dd90    pc = 0x00000001102b3178
    Found by: previous frame's frame pointer
 2  Electron Framework!v8::internal::maglev::MaglevGraphBuilder::VisitLdaContextSlotNoCell() [maglev-graph-builder.cc : 3423 + 0xc]
     fp = 0x000000016ec5e000    lr = 0x0000000110d8adf0
     sp = 0x000000016ec5dde0    pc = 0x00000001102b2fe8
    Found by: previous frame's frame pointer
 3  Electron Framework!v8::internal::maglev::MaglevGraphBuilder::BuildBody() [maglev-graph-builder.cc : 17606 + 0x4]
     fp = 0x000000016ec5e0a0    lr = 0x00000001102eaa40
     sp = 0x000000016ec5e010    pc = 0x0000000110d8adf0
    Found by: previous frame's frame pointer
 4  Electron Framework!v8::internal::maglev::MaglevGraphBuilder::Build() [maglev-graph-builder.cc : 17087 + 0x4]
     fp = 0x000000016ec5e600    lr = 0x00000001104281c8
     sp = 0x000000016ec5e0b0    pc = 0x00000001102eaa40
    Found by: previous frame's frame pointer
 5  Electron Framework!v8::internal::maglev::MaglevCompiler::Compile(v8::internal::LocalIsolate*, v8::internal::maglev::MaglevCompilationInfo*) [maglev-compiler.cc : 105 + 0x4]
     fp = 0x000000016ec5e630    lr = 0x00000001120131cc
     sp = 0x000000016ec5e610    pc = 0x00000001104281c8
    Found by: previous frame's frame pointer
 6  Electron Framework!v8::internal::maglev::MaglevCompilationJob::ExecuteJobImpl(v8::internal::RuntimeCallStats*, v8::internal::LocalIsolate*) [maglev-concurrent-dispatcher.cc : 132 + 0x4]
     fp = 0x000000016ec5ee50    lr = 0x0000000110fcf534
     sp = 0x000000016ec5e640    pc = 0x00000001120131cc
    Found by: previous frame's frame pointer
 7  Electron Framework!v8::platform::DefaultJobWorker::Run() [default-job.h : 147 + 0xc]
    x19 = 0x0000013c000b1950   x20 = 0x0000013c07cdac20
     fp = 0x000000016ec5ef00    sp = 0x000000016ec5ee60
     pc = 0x00000001120d8158
    Found by: call frame info
 8  Electron Framework!v8::platform::DefaultJobWorker::Run() [default-job.h : 147 + 0xc]
     fp = 0x000000016ec5efc0    lr = 0x0000000110ba7c9c
     sp = 0x000000016ec5ef10    pc = 0x00000001120d8158
    Found by: previous frame's frame pointer
 9  Electron Framework!node::(anonymous namespace)::PlatformWorkerThread(void*) [node_platform.cc : 80 + 0x8]
     fp = 0x000000016ec5efe0    lr = 0x00000001849cbbc8
     sp = 0x000000016ec5efd0    pc = 0x0000000110ba7c9c
    Found by: previous frame's frame pointer
10  libsystem_pthread.dylib + 0x6bc4
     fp = 0x0000000000000000    lr = 0x00000001849c6b80
     sp = 0x000000016ec5eff0    pc = 0x00000001849cbbc8
    Found by: previous frame's frame pointer

This is very likely addressed by https://chromium-review.googlesource.com/c/v8/v8/+/7883336, can you confirm if its the OSR path triggering by running with --js-flags="--no-maglev-osr". Can you maybe isolate a minimal repro with the steps

1. --js-flags="--trace-opt --trace-deopt --maglev-print-filter=*" to narrow down the function just before the crash
2. Once you have a minimal JS run with --js-flags="--stress-maglev --always-osr --invocation-count-for-osr=1 --invocation-count-for-maglev-osr=1"

[miles-augment]

vscode-maglev-trace-run-minidumps.zip
vscode-maglev-osr-run-minidumps.zip

@deepak1556 We tested the OSR-only hypothesis — unfortunately it's a negative result: --no-maglev-osr does not prevent the crash.

Test setup

• VS Code 1.127.0 stable, macOS arm64 (Apple Silicon), same machine and workload harness as the earlier reports (sustained AI-agent workload in the extension host, crash typically within 2–9 minutes)
• Launched with --js-flags=--no-maglev-osr
• Our extension's own runtime workaround (v8.setFlagsFromString("--no-maglev")) was explicitly opted out for these runs, so Maglev itself was active with only OSR disabled
• Flag propagation verified two ways:
  • main process argv contains "js-flags":"--no-maglev-osr" (main.log)
  • inspected the live node.mojom.NodeService utility processes (the process type the extension host runs as) via ps and confirmed the flag is present on their command lines

Result

2 independent runs, 4 crashes — every one at the identical crash site as the stock-Maglev crashes:

Run	Dump	Exception	PC / LR (Electron Framework offset)
1	8dc1741b-…	EXC_BREAKPOINT (SIGTRAP), background thread	+0x8fa45c / +0x8fa1fc
1	0b8e0fdf-…	EXC_BREAKPOINT, background thread	+0x8fa45c / +0x8fa1fc
2	81fe2a26-…	EXC_BREAKPOINT, background thread	+0x8fa45c / +0x8fa1fc
2	018130fe-…	EXC_BREAKPOINT, background thread	+0x8fa45c / +0x8fa1fc

Same binary as the earlier dumps, so this is the same MaglevGraphBuilder::GetContextAtDepth CHECK you symbolicated (maglev-graph-builder.cc:7724). Crash timing was also unchanged (~5–9 minutes in).

For reference, in the shipped V8 (14.8.178.14) that line is the scope-info safety net inside the context-chain walk in GetContextAtDepth:

for (size_t i = 0; i < depth; i++) {
  GET_VALUE(context, LoadAndCacheContextSlot(context, Context::PREVIOUS_INDEX,
                                             ContextMode::kNoContextCells,
                                             *scope_info));
  EnsureType(context, NodeType::kContext);
  DCHECK(!IsEmptyNodeType(GetType(context)));
  CHECK(scope_info->HasOuterScopeInfo());   // <-- line 7724
  *scope_info = scope_info->OuterScopeInfo(broker());
}

i.e. the compile-time ScopeInfo chain runs out before the bytecode's context depth is exhausted — the same class of scope-info/context mismatch that CL 7883336 fixed for the OSR prewalk, but reached here through the regular graph-build path.

Sanitized minidumps attached: vscode-maglev-osr-run-minidumps.zip (the four crashes above) and vscode-maglev-trace-run-minidumps.zip (the two trace-run crashes below).

Implications

1. The CHECK is reachable via the regular (non-OSR) concurrent Maglev compilation path — VisitLdaContextSlotNoCell → GetContextAtDepth trips it during ordinary background tiering too.
2. That suggests the OSR-path fix in https://chromium-review.googlesource.com/c/v8/v8/+/7883336 likely does not fully cover this bug.
3. --no-maglev remains the only mitigation that has held up in our testing (20+ runs, zero crashes with it; crashes reproduce reliably without it).

Trace run (--trace-opt --trace-deopt --maglev-print-filter=*)

We also ran the trace you asked for (stock Maglev, no OSR flag). It crashed twice, same signature (+0x8fa45c), with full V8 tiering traces captured from the extension host.

In both crashes, the last named function to start concurrent Maglev compilation — with no matching [completed compiling …] before the process died — was onDidReceiveMessage:

• Crash 1: [compiling method 0x06ef0b299069 <JSFunction onDidReceiveMessage (sfi = 0x6ef056d1e9d)> (target MAGLEV), mode: ConcurrencyMode::kConcurrent] at 13:40:20.762; Crashpad wrote the dump ~211 ms later. No completion line.
• Crash 2: [compiling method 0x2ae30b39fb65 <JSFunction onDidReceiveMessage (sfi = 0x2ae30586cf89)> (target MAGLEV), mode: ConcurrencyMode::kConcurrent], immediately followed by a marking/compiling of an anonymous function (sfi = 0x2ae30311f709), then the crash. Neither completed.

onDidReceiveMessage is part of the VS Code webview messaging path (extensionHostProcess.js), which is extremely hot under our workload (sustained extension↔webview message traffic). Given concurrent compilation, this is a strong hint rather than proof, but the same function being in flight at both crash points — across independent extension-host processes — fits a deterministic trigger in how that function's context chain is walked by GetContextAtDepth.

One note on the suggested minimal-repro flags: given the crash reproduces with OSR disabled, the OSR-forcing flags (--always-osr, --invocation-count-for-osr=1, --invocation-count-for-maglev-osr=1) are probably not the right forcing function here; --stress-maglev alone (aggressive non-OSR Maglev tiering) seems like the better bet. We can also share the full trace logs if useful.

Minimal-repro attempts (unsuccessful so far)

We tried to distill a standalone repro using VS Code's own Electron binary (ELECTRON_RUN_AS_NODE=1, same V8 build that crashes), running scripts that mimic the onDidReceiveMessage pattern — deeply nested closures accessing variables at multiple context depths, hammered under sustained message churn. Variants tried (~30 runs total, no crash):

1. Plain nested-closure churn under --stress-maglev --concurrent-recompilation
2. + alternating message shapes to force deopt/re-opt cycles, plus explicit minor GC pressure (--expose-gc)
3. + bytecode flushing / relazification (--stress-flush-code --flush-bytecode --gc-interval=2000)
4. Handlers compiled inside vm.compileFunction wrappers (like Node's CJS module wrapper the extension host uses), fresh wrapper per generation

None triggered the CHECK, so the trigger appears to depend on something more specific in the real extension-host workload (exact scope shapes of the bundled extensionHostProcess.js, worker/message-port structure, or timing that stress flags don't recreate). Happy to run further candidate repros or a debug/DCHECK-enabled build against our reliable Playwright-based reproducer if that helps.

[deepak1556]

Can you capture and share the output from running with --no-concurrent-recompilation --no-maglev-build-code-on-background --no-maglev-destroy-on-background --print-bytecode --print-bytecode-filter=onDidReceiveMessage --trace-maglev-graph-building --maglev-print-filter=onDidReceiveMessage --trace-opt --trace-deopt

[johnny2211]

@deepak1556
I've been working with @miles-augment on reducing and validating this.

Filed this upstream with V8/Chromium here:

https://issues.chromium.org/issues/532595501
I also ran the diagnostic flags you requested on a stock VS Code 1.128.0 / Electron 42.x build:

--no-concurrent-recompilation --no-maglev-build-code-on-background --no-maglev-destroy-on-background --print-bytecode --print-bytecode-filter=onDidReceiveMessage --trace-maglev-graph-building --maglev-print-filter=onDidReceiveMessage --trace-opt --trace-deopt

Result: the extension host still crashed.
High-level run details:

• Stock VS Code 1.128.0 binary, not the locally patched Electron Framework.
• Chat became interactive.
• Turns 1–11 were sent.
• At 2026-07-09T11:10:43.459Z, VS Code logged:
  • [UtilityProcess id: 4, type: extensionHost, pid: 49160]: crashed with code 5 and reason 'crashed'
• After that, the Playwright harness could no longer interact with the page/context.
• The trace produced onDidReceiveMessage bytecode / Maglev graph-building output.

This is useful because the crash still reproduces even with concurrent recompilation and background Maglev build/destroy disabled. The trace shows Maglev compilation happening synchronously under these flags, so this does not appear to require background Maglev codegen/destruction.

I have the raw trace log locally, but I am not attaching/pasting it directly because it may contain runtime/session details. I can provide a sanitized excerpt around the onDidReceiveMessage bytecode/Maglev trace if useful.

I filed the V8 issue as related/sibling to Chromium 510716370 rather than as a duplicate. 510716370 is clearly the same broad class of problem — Maglev scope-info/context-depth mismatch leading to a release-build CHECK — but the path here appears different:

• 510716370: OSR/catch-handler scope-info issue, crashing via CheckContextExtensions() / VisitLdaLookupGlobalSlot().
• This VS Code crash: still reproduces with --no-maglev-osr, and the symbolicated stack is VisitLdaContextSlotNoCell() → GetContextAtDepth() → CHECK(scope_info->HasOuterScopeInfo()).

The V8 issue includes the VS Code stack, the --no-maglev / --no-maglev-osr results, and the local candidate patch we tested. The candidate patch changes GetContextAtDepth to bail out of Maglev compilation if the static ScopeInfo chain is shorter than the requested context depth, and propagates that bailout through the context-slot visitors with GET_VALUE_OR_ABORT.

[miles-augment]

@deepak1556 We now have a standalone ~40-line minimal repro — no VS Code session, no extension, just the shipped Electron binary run as Node — so we can share the full trace you asked for with nothing sensitive in it.

Minimal repro

Reduced (via bisect + delta-debugging of our real bundle) from our extension's onDidReceiveMessage handler. The hot function in the reduced script is named handle, so the filters below use handle in place of onDidReceiveMessage.

// V8 Maglev fatal CHECK repro:
//   MaglevGraphBuilder::GetContextAtDepth — CHECK(scope_info->HasOuterScopeInfo())
//   (maglev-graph-builder.cc:7724 in V8 14.8)
//
// Observed on (macOS arm64): VS Code 1.127.0 (Electron 42 / V8 14.8.178.14),
//   1.128.x stable and 1.129.0-insider (both Electron 42.5.0 / V8 14.8.178.33).
// Does NOT reproduce on VS Code 1.122.1 (Electron 39.8.8 / V8 14.2.231.22)
//   or Node 25.8.1 (V8 14.1.146.11).
// Regression window: V8 14.2 → 14.8, i.e. the Electron 39 → 42 bump that
//   first shipped in VS Code 1.123.0.
//
// Run (crashes with SIGTRAP after ~600 calls, when Maglev tiers up `handle`):
//   ELECTRON_RUN_AS_NODE=1 "<app>/Contents/MacOS/Electron" maglev-crash-repro.js
// Control (completes normally):
//   ELECTRON_RUN_AS_NODE=1 "<app>/Contents/MacOS/Electron" --no-maglev maglev-crash-repro.js
//
// Notes:
// - The crashing `case` arm is NEVER executed (message.type never matches);
//   the CHECK fires during background Maglev graph building of `handle`.
// - Every remaining element is required; removing any of the following makes
//   the crash disappear:
//     * the script-level `const cfg` (context-allocated script const; an
//       undeclared global instead compiles to a global load and doesn't crash)
//     * the `class` (an object-literal method or plain function doesn't crash)
//     * the `switch`/case block with the block-scoped `const u`
//     * the closure capturing `u` + the `break` inside the first `try`
//     * the second `try` with the two `await`s
//     * sloppy mode — adding "use strict" to THIS minimal form hides the
//       crash (the original, larger handler it was reduced from crashed
//       under strict mode as well)

const cfg = {};

class A {
  async handle(message) {
    switch (message.type) {
      case "never-sent": {
        const u = cfg.x;
        try {
          const f = () => {
            void cfg.b(u);
          };
          f();
          break;
        } catch {}
        try {
          const d = await cfg.c(u);
          await cfg.b(d);
        } catch (e) {}
      }
    }
  }
}

const a = new A();

async function main() {
  for (let i = 0; i < 600; i++) {
    await a.handle({ type: 0 });
  }
  console.log("completed without crash (bug not reproduced)");
}
main();

Each remaining element is required — removing any of these hides the crash:

• the script-level const (context-allocated script const) referenced from the method
• the class (an object-literal method or plain function doesn't crash)
• the switch case with a block-scoped const, a closure capturing it, and a break inside the first try
• the second try containing the two awaits
• sloppy mode, for this minimal form (the original larger handler crashed under strict mode as well)

Note the crashing case arm is never executed — the CHECK fires while Maglev builds the graph for handle after ~600 invocations.

Trace run with your exact flags

Command (stock VS Code 1.127.0 stable binary, macOS arm64 — same build as the dumps you symbolicated):

ELECTRON_RUN_AS_NODE=1 ".../Visual Studio Code.app/Contents/MacOS/Electron" \
  --no-concurrent-recompilation --no-maglev-build-code-on-background \
  --no-maglev-destroy-on-background --print-bytecode --print-bytecode-filter=handle \
  --trace-maglev-graph-building --maglev-print-filter=handle \
  --trace-opt --trace-deopt maglev-crash-repro.js

Result: exit 133 (SIGTRAP). Crash report: EXC_BREAKPOINT, faulting frame Electron Framework + 0x8fa45c — identical offset to the production extension-host crashes on this binary (MaglevGraphBuilder::GetContextAtDepth, CHECK(scope_info->HasOuterScopeInfo())).

The trace ends mid-graph-build of handle: the last bytecode visited is 127 : 16 ff 02 02 LdaImmutableContextSlot <context>, [2], [2] — i.e. VisitLdaContextSlotNoCell walking the context chain when the CHECK fires. This is the resume path after the first await (Mov r6, r1 at 124, then the context-slot load of cfg at depth 2), where the merge-point frame state carries no context-slot info.

Full output, ANSI codes stripped:

Full trace output (468 lines: tiering, bytecode for handle, Maglev graph building up to the crash)

[marking 0x23ee0104a021 <JSFunction getNewKey (sfi = 0x23ee01087c41)> for optimization to MAGLEV, ConcurrencyMode::kConcurrent, reason: hot and stable]
[compiling method 0x23ee0104a021 <JSFunction getNewKey (sfi = 0x23ee01087c41)> (target MAGLEV), mode: ConcurrencyMode::kSynchronous]
[completed compiling 0x23ee0104a021 <JSFunction getNewKey (sfi = 0x23ee01087c41)> (target MAGLEV) - took 0.523, 47.512, 0.037 ms]
[marking 0x23ee0126b3c1 <JSFunction next (sfi = 0x23ee01089739)> for optimization to MAGLEV, ConcurrencyMode::kConcurrent, reason: hot and stable]
[compiling method 0x23ee0126b3c1 <JSFunction next (sfi = 0x23ee01089739)> (target MAGLEV), mode: ConcurrencyMode::kSynchronous]
[completed compiling 0x23ee0126b3c1 <JSFunction next (sfi = 0x23ee01089739)> (target MAGLEV) - took 0.002, 0.702, 0.022 ms]
[bailout (kind: deopt-eager, reason: wrong map): begin. deoptimizing 0x23ee0126b159 <JSFunction next (sfi = 0x23ee01089739)>, 0x011301029521 <Code MAGLEV>, opt id 1, bytecode offset 3, deopt exit 0, FP to SP delta 32, caller SP 0x00016f5a9e78, pc 0x00015000230c]
[marking 0x23ee010d4bd5 <JSFunction isPosixPathSeparator (sfi = 0x23ee011cebf9)> for optimization to MAGLEV, ConcurrencyMode::kConcurrent, reason: hot and stable]
[compiling method 0x23ee010d4bd5 <JSFunction isPosixPathSeparator (sfi = 0x23ee011cebf9)> (target MAGLEV), mode: ConcurrencyMode::kSynchronous]
[completed compiling 0x23ee010d4bd5 <JSFunction isPosixPathSeparator (sfi = 0x23ee011cebf9)> (target MAGLEV) - took 0.001, 0.114, 0.003 ms]
[generated bytecode for function: handle (0x23ee0142bc2d <SharedFunctionInfo handle>)]
Bytecode length: 213
Parameter count 2
Register count 9
Frame size 72
         0x1130105b2d4 @    0 : be f9 00 02       SwitchOnGeneratorState r0, [0:106], [2] { 0: @106, 1: @155 }
         0x1130105b2d8 @    4 : 1b fe f6          Mov <closure>, r3
         0x1130105b2db @    7 : 1b 02 f5          Mov <this>, r4
 1706 E> 0x1130105b2de @   10 : 73 01 f6 02       InvokeIntrinsic [_AsyncFunctionEnter], r3-r4
         0x1130105b2e2 @   14 : d4                Star0
         0x1130105b2e3 @   15 : 1b ff f6          Mov <context>, r3
 1738 S> 0x1130105b2e6 @   18 : 33 03 02 00       GetNamedProperty a0, [2:"type"], FBV[0]
         0x1130105b2ea @   22 : d0                Star4
         0x1130105b2eb @   23 : 13 03             LdaConstant [3:"never-sent"]
         0x1130105b2ed @   25 : 78 f5 00 00       TestEqualStrict r4, EmbeddedFeedback[0x0]
         0x1130105b2f1 @   29 : a7 04             JumpIfTrue [4] (0x1130105b2f5 @ 33)
         0x1130105b2f3 @   31 : 98 a1             Jump [161] (0x1130105b394 @ 192)
         0x1130105b2f5 @   33 : 8e 04             CreateBlockContext [4:0x23ee0142c3dd <ScopeInfo BLOCK_SCOPE>]
         0x1130105b2f7 @   35 : 1c f5             PushContext r4
         0x1130105b2f9 @   37 : 10                LdaTheHole
         0x1130105b2fa @   38 : 27 02             StaCurrentContextSlotNoCell [2]
 1791 S> 0x1130105b2fc @   40 : 16 ff 02 02       LdaImmutableContextSlot <context>, [2], [2]
         0x1130105b300 @   44 : ba 05             ThrowReferenceErrorIfHole [5:"cfg"]
         0x1130105b302 @   46 : cf                Star5
 1795 E> 0x1130105b303 @   47 : 33 f4 06 02       GetNamedProperty r5, [6:"x"], FBV[2]
 1791 E> 0x1130105b307 @   51 : 27 02             StaCurrentContextSlotNoCell [2]
         0x1130105b309 @   53 : 1b ff f4          Mov <context>, r5
 1832 S> 0x1130105b30c @   56 : 8d 07 00 02       CreateClosure [7:0x23ee0142c425 <SharedFunctionInfo f>], FBV[0], #2
         0x1130105b310 @   60 : d2                Star2
 1890 S> 0x1130105b311 @   61 : 6c f7 04          CallUndefinedReceiver0 r2, FBV[4]
 1905 S> 0x1130105b314 @   64 : 1d f5             PopContext r4
         0x1130105b316 @   66 : 98 7e             Jump [126] (0x1130105b394 @ 192)
         0x1130105b318 @   68 : 10                LdaTheHole
         0x1130105b319 @   69 : b6                SetPendingMessage
         0x1130105b31a @   70 : 0b f4             Ldar r5
         0x1130105b31c @   72 : 1b ff f4          Mov <context>, r5
 1965 S> 0x1130105b31f @   75 : 16 ff 02 02       LdaImmutableContextSlot <context>, [2], [2]
         0x1130105b323 @   79 : cd                Star7
 1975 E> 0x1130105b324 @   80 : 33 f2 08 06       GetNamedProperty r7, [8:"c"], FBV[6]
         0x1130105b328 @   84 : ce                Star6
         0x1130105b329 @   85 : 19 02             LdaImmutableCurrentContextSlot [2]
         0x1130105b32b @   87 : cc                Star8
 1975 E> 0x1130105b32c @   88 : 69 f3 f2 f1 08    CallProperty1 r6, r7, r8, FBV[8]
         0x1130105b331 @   93 : cd                Star7
         0x1130105b332 @   94 : 1b f9 f3          Mov r0, r6
         0x1130105b335 @   97 : 73 00 f3 02       InvokeIntrinsic [_AsyncFunctionAwait], r6-r7
 1965 E> 0x1130105b339 @  101 : bf f9 f9 06 00    SuspendGenerator r0, r0-r5, [0]
         0x1130105b33e @  106 : c0 f9 f9 06       ResumeGenerator r0, r0-r5
         0x1130105b342 @  110 : ce                Star6
         0x1130105b343 @  111 : 73 09 f9 01       InvokeIntrinsic [_GeneratorGetResumeMode], r0-r0
         0x1130105b347 @  115 : cd                Star7
         0x1130105b348 @  116 : 0c                LdaZero
         0x1130105b349 @  117 : 1e f2             TestReferenceEqual r7
         0x1130105b34b @  119 : a7 05             JumpIfTrue [5] (0x1130105b350 @ 124)
         0x1130105b34d @  121 : 0b f3             Ldar r6
         0x1130105b34f @  123 : b8                ReThrow
         0x1130105b350 @  124 : 1b f3 f8          Mov r6, r1
 1991 S> 0x1130105b353 @  127 : 16 ff 02 02       LdaImmutableContextSlot <context>, [2], [2]
         0x1130105b357 @  131 : cd                Star7
 2001 E> 0x1130105b358 @  132 : 33 f2 09 0a       GetNamedProperty r7, [9:"b"], FBV[10]
         0x1130105b35c @  136 : ce                Star6
 2001 E> 0x1130105b35d @  137 : 69 f3 f2 f8 0c    CallProperty1 r6, r7, r1, FBV[12]
         0x1130105b362 @  142 : cd                Star7
         0x1130105b363 @  143 : 1b f9 f3          Mov r0, r6
         0x1130105b366 @  146 : 73 00 f3 02       InvokeIntrinsic [_AsyncFunctionAwait], r6-r7
 1991 E> 0x1130105b36a @  150 : bf f9 f9 06 01    SuspendGenerator r0, r0-r5, [1]
         0x1130105b36f @  155 : c0 f9 f9 06       ResumeGenerator r0, r0-r5
         0x1130105b373 @  159 : ce                Star6
         0x1130105b374 @  160 : 73 09 f9 01       InvokeIntrinsic [_GeneratorGetResumeMode], r0-r0
         0x1130105b378 @  164 : cd                Star7
         0x1130105b379 @  165 : 0c                LdaZero
         0x1130105b37a @  166 : 1e f2             TestReferenceEqual r7
         0x1130105b37c @  168 : a7 05             JumpIfTrue [5] (0x1130105b381 @ 173)
         0x1130105b37e @  170 : 0b f3             Ldar r6
         0x1130105b380 @  172 : b8                ReThrow
         0x1130105b381 @  173 : 0b f3             Ldar r6
         0x1130105b383 @  175 : 98 0f             Jump [15] (0x1130105b392 @ 190)
         0x1130105b385 @  177 : ce                Star6
         0x1130105b386 @  178 : 8f f3 0a          CreateCatchContext r6, [10:0x23ee0142c401 <ScopeInfo CATCH_SCOPE>]
         0x1130105b389 @  181 : cf                Star5
         0x1130105b38a @  182 : 10                LdaTheHole
         0x1130105b38b @  183 : b6                SetPendingMessage
         0x1130105b38c @  184 : 0b f4             Ldar r5
         0x1130105b38e @  186 : 1c f3             PushContext r6
         0x1130105b390 @  188 : 1d f3             PopContext r6
         0x1130105b392 @  190 : 1d f5             PopContext r4
         0x1130105b394 @  192 : 0e                LdaUndefined
         0x1130105b395 @  193 : cf                Star5
         0x1130105b396 @  194 : 1b f9 f5          Mov r0, r4
         0x1130105b399 @  197 : 73 03 f5 02       InvokeIntrinsic [_AsyncFunctionResolve], r4-r5
 2046 S> 0x1130105b39d @  201 : b9                Return
         0x1130105b39e @  202 : cf                Star5
         0x1130105b39f @  203 : 10                LdaTheHole
         0x1130105b3a0 @  204 : b6                SetPendingMessage
         0x1130105b3a1 @  205 : 1b f9 f5          Mov r0, r4
         0x1130105b3a4 @  208 : 73 02 f5 02       InvokeIntrinsic [_AsyncFunctionReject], r4-r5
         0x1130105b3a8 @  212 : b9                Return
Constant pool (size = 11)
Handler Table (size = 48)
Source Position Table (size = 44)
[marking 0x23ee01183df9 <JSFunction handle (sfi = 0x23ee0142bc2d)> for optimization to MAGLEV, ConcurrencyMode::kConcurrent, reason: hot and stable]
[compiling method 0x23ee01183df9 <JSFunction handle (sfi = 0x23ee0142bc2d)> (target MAGLEV), mode: ConcurrencyMode::kSynchronous]
Compiling 0x23ee01183df9 <JSFunction handle (sfi = 0x23ee0142bc2d)> with Maglev
----- Bytecode array -----
Parameter count 2
Register count 9
Frame size 72
         0x1130105b2d4 @    0 : be f9 00 02       SwitchOnGeneratorState r0, [0:106], [2] { 0: @106, 1: @155 }
         0x1130105b2d8 @    4 : 1b fe f6          Mov <closure>, r3
         0x1130105b2db @    7 : 1b 02 f5          Mov <this>, r4
 1706 E> 0x1130105b2de @   10 : 73 01 f6 02       InvokeIntrinsic [_AsyncFunctionEnter], r3-r4
         0x1130105b2e2 @   14 : d4                Star0
         0x1130105b2e3 @   15 : 1b ff f6          Mov <context>, r3
 1738 S> 0x1130105b2e6 @   18 : 33 03 02 00       GetNamedProperty a0, [2:"type"], FBV[0]
         0x1130105b2ea @   22 : d0                Star4
         0x1130105b2eb @   23 : 13 03             LdaConstant [3:"never-sent"]
         0x1130105b2ed @   25 : 78 f5 ff 03       TestEqualStrict r4, EmbeddedFeedback[0x3ff]
         0x1130105b2f1 @   29 : a7 04             JumpIfTrue [4] (0x1130105b2f5 @ 33)
         0x1130105b2f3 @   31 : 98 a1             Jump [161] (0x1130105b394 @ 192)
         0x1130105b2f5 @   33 : 8e 04             CreateBlockContext [4:0x23ee0142c3dd <ScopeInfo BLOCK_SCOPE>]
         0x1130105b2f7 @   35 : 1c f5             PushContext r4
         0x1130105b2f9 @   37 : 10                LdaTheHole
         0x1130105b2fa @   38 : 27 02             StaCurrentContextSlotNoCell [2]
 1791 S> 0x1130105b2fc @   40 : 16 ff 02 02       LdaImmutableContextSlot <context>, [2], [2]
         0x1130105b300 @   44 : ba 05             ThrowReferenceErrorIfHole [5:"cfg"]
         0x1130105b302 @   46 : cf                Star5
 1795 E> 0x1130105b303 @   47 : 33 f4 06 02       GetNamedProperty r5, [6:"x"], FBV[2]
 1791 E> 0x1130105b307 @   51 : 27 02             StaCurrentContextSlotNoCell [2]
         0x1130105b309 @   53 : 1b ff f4          Mov <context>, r5
 1832 S> 0x1130105b30c @   56 : 8d 07 00 02       CreateClosure [7:0x23ee0142c425 <SharedFunctionInfo f>], FBV[0], #2
         0x1130105b310 @   60 : d2                Star2
 1890 S> 0x1130105b311 @   61 : 6c f7 04          CallUndefinedReceiver0 r2, FBV[4]
 1905 S> 0x1130105b314 @   64 : 1d f5             PopContext r4
         0x1130105b316 @   66 : 98 7e             Jump [126] (0x1130105b394 @ 192)
         0x1130105b318 @   68 : 10                LdaTheHole
         0x1130105b319 @   69 : b6                SetPendingMessage
         0x1130105b31a @   70 : 0b f4             Ldar r5
         0x1130105b31c @   72 : 1b ff f4          Mov <context>, r5
 1965 S> 0x1130105b31f @   75 : 16 ff 02 02       LdaImmutableContextSlot <context>, [2], [2]
         0x1130105b323 @   79 : cd                Star7
 1975 E> 0x1130105b324 @   80 : 33 f2 08 06       GetNamedProperty r7, [8:"c"], FBV[6]
         0x1130105b328 @   84 : ce                Star6
         0x1130105b329 @   85 : 19 02             LdaImmutableCurrentContextSlot [2]
         0x1130105b32b @   87 : cc                Star8
 1975 E> 0x1130105b32c @   88 : 69 f3 f2 f1 08    CallProperty1 r6, r7, r8, FBV[8]
         0x1130105b331 @   93 : cd                Star7
         0x1130105b332 @   94 : 1b f9 f3          Mov r0, r6
         0x1130105b335 @   97 : 73 00 f3 02       InvokeIntrinsic [_AsyncFunctionAwait], r6-r7
 1965 E> 0x1130105b339 @  101 : bf f9 f9 06 00    SuspendGenerator r0, r0-r5, [0]
         0x1130105b33e @  106 : c0 f9 f9 06       ResumeGenerator r0, r0-r5
         0x1130105b342 @  110 : ce                Star6
         0x1130105b343 @  111 : 73 09 f9 01       InvokeIntrinsic [_GeneratorGetResumeMode], r0-r0
         0x1130105b347 @  115 : cd                Star7
         0x1130105b348 @  116 : 0c                LdaZero
         0x1130105b349 @  117 : 1e f2             TestReferenceEqual r7
         0x1130105b34b @  119 : a7 05             JumpIfTrue [5] (0x1130105b350 @ 124)
         0x1130105b34d @  121 : 0b f3             Ldar r6
         0x1130105b34f @  123 : b8                ReThrow
         0x1130105b350 @  124 : 1b f3 f8          Mov r6, r1
 1991 S> 0x1130105b353 @  127 : 16 ff 02 02       LdaImmutableContextSlot <context>, [2], [2]
         0x1130105b357 @  131 : cd                Star7
 2001 E> 0x1130105b358 @  132 : 33 f2 09 0a       GetNamedProperty r7, [9:"b"], FBV[10]
         0x1130105b35c @  136 : ce                Star6
 2001 E> 0x1130105b35d @  137 : 69 f3 f2 f8 0c    CallProperty1 r6, r7, r1, FBV[12]
         0x1130105b362 @  142 : cd                Star7
         0x1130105b363 @  143 : 1b f9 f3          Mov r0, r6
         0x1130105b366 @  146 : 73 00 f3 02       InvokeIntrinsic [_AsyncFunctionAwait], r6-r7
 1991 E> 0x1130105b36a @  150 : bf f9 f9 06 01    SuspendGenerator r0, r0-r5, [1]
         0x1130105b36f @  155 : c0 f9 f9 06       ResumeGenerator r0, r0-r5
         0x1130105b373 @  159 : ce                Star6
         0x1130105b374 @  160 : 73 09 f9 01       InvokeIntrinsic [_GeneratorGetResumeMode], r0-r0
         0x1130105b378 @  164 : cd                Star7
         0x1130105b379 @  165 : 0c                LdaZero
         0x1130105b37a @  166 : 1e f2             TestReferenceEqual r7
         0x1130105b37c @  168 : a7 05             JumpIfTrue [5] (0x1130105b381 @ 173)
         0x1130105b37e @  170 : 0b f3             Ldar r6
         0x1130105b380 @  172 : b8                ReThrow
         0x1130105b381 @  173 : 0b f3             Ldar r6
         0x1130105b383 @  175 : 98 0f             Jump [15] (0x1130105b392 @ 190)
         0x1130105b385 @  177 : ce                Star6
         0x1130105b386 @  178 : 8f f3 0a          CreateCatchContext r6, [10:0x23ee0142c401 <ScopeInfo CATCH_SCOPE>]
         0x1130105b389 @  181 : cf                Star5
         0x1130105b38a @  182 : 10                LdaTheHole
         0x1130105b38b @  183 : b6                SetPendingMessage
         0x1130105b38c @  184 : 0b f4             Ldar r5
         0x1130105b38e @  186 : 1c f3             PushContext r6
         0x1130105b390 @  188 : 1d f3             PopContext r6
         0x1130105b392 @  190 : 1d f5             PopContext r4
         0x1130105b394 @  192 : 0e                LdaUndefined
         0x1130105b395 @  193 : cf                Star5
         0x1130105b396 @  194 : 1b f9 f5          Mov r0, r4
         0x1130105b399 @  197 : 73 03 f5 02       InvokeIntrinsic [_AsyncFunctionResolve], r4-r5
 2046 S> 0x1130105b39d @  201 : b9                Return
         0x1130105b39e @  202 : cf                Star5
         0x1130105b39f @  203 : 10                LdaTheHole
         0x1130105b3a0 @  204 : b6                SetPendingMessage
         0x1130105b3a1 @  205 : 1b f9 f5          Mov r0, r4
         0x1130105b3a4 @  208 : 73 02 f5 02       InvokeIntrinsic [_AsyncFunctionReject], r4-r5
         0x1130105b3a8 @  212 : b9                Return
Constant pool (size = 11)
Handler Table (size = 48)
Source Position Table (size = 44)
0x23ee0142c559 <FeedbackVector[14]>[ML:34178] + 0x1380048d418  : 
[ML:34178] + 0x1380048d478  : 
[ML:34178] + 0x1380048d6a8  : 
[ML:34178] + 0x1380048d6f8  : 
[ML:34178] + 0x1380048dab0  : 
[ML:34178] + 0x1380048daf8  : 
[ML:34178] + 0x1380048db68  : 
[ML:34178] - Creating exception merge state at @202 (never used), context register r3
[ML:34178] - Creating exception merge state at @68 (never used), context register r5
[ML:34178] - Creating exception merge state at @177 (never used), context register r5
[ML:34178] + 0x1380048e458  : 
[ML:34178]    0 : be f9 00 02       SwitchOnGeneratorState r0, [0:106], [2]
[ML:34178] New block (merge @0x1380048e4b8) at 0x23ee0142bc2d <SharedFunctionInfo handle>
[ML:34178]   VOs (IFS): 
[ML:34178]   Constant properties:
[ML:34178]   Non-constant properties:
[ML:34178]   Constant context slots:
[ML:34178]   Non-constant context slots:
[ML:34178] 
[ML:34178] Copying frame state from merge @0x1380048e4b8
[ML:34178]   - VOs (IFS): 
[ML:34178]   - VOs (merge): 
[ML:34178] + 0x1380048e920  : 
[ML:34178] + 0x1380048ed90  : 
[ML:34178] + 0x1380048ede8  : 
[ML:34178] + 0x1380048ee60  : 
[ML:34178] + 0x1380048ee98  : 
[ML:34178] + 0x1380048eef0  : 
[ML:34178]    4 : 1b fe f6          Mov <closure>, r3
[ML:34178] New block (merge @0x1380048e958) at 0x23ee0142bc2d <SharedFunctionInfo handle>
[ML:34178]   VOs (IFS): 
[ML:34178]   Constant properties:
[ML:34178]   Non-constant properties:
[ML:34178]   Constant context slots:
[ML:34178]   Non-constant context slots:
[ML:34178] 
[ML:34178] Copying frame state from merge @0x1380048e958
[ML:34178]   - VOs (IFS): 
[ML:34178]   - VOs (merge): 
[ML:34178]    7 : 1b 02 f5          Mov <this>, r4
[ML:34178]   10 : 73 01 f6 02       InvokeIntrinsic [_AsyncFunctionEnter], r3-r4
[ML:34178] + 0x138008c9578  : 
[ML:34178] + 0x138008c95c8  : 
[ML:34178] + 0x138008c9610  : 
[ML:34178] + 0x138008c9720  : 
[ML:34178] + 0x138008c9768  : 
[ML:34178] + 0x138008c98a0  : 
[ML:34178] + 0x138008c98f0  : 
[ML:34178] + 0x138008c9938  : 
[ML:34178] + 0x138008c9b20  : 
[ML:34178] + 0x138008c9d08  : 
[ML:34178] + 0x138008c9d40  : 
[ML:34178] + 0x138008c9df0  : 
[ML:34178] + 0x138008c9e98  : 
[ML:34178] + 0x138008c9ee0  : 
[ML:34178] + 0x138008c9f28  : 
[ML:34178] + 0x138008c9f70  : 
[ML:34178] + 0x138008c9fb8  : 
[ML:34178] + 0x138008ca000  : 
[ML:34178] + 0x138008ca048  : 
[ML:34178] + 0x138008ca090  : 
[ML:34178] + 0x138008ca0d8  : 
[ML:34178] + 0x138008ca120  : 
[ML:34178] + 0x138008ca168  : 
[ML:34178] + 0x138008ca1f8  : 
[ML:34178] + 0x138008ca2a8  : 
[ML:34178] + 0x138008ca3a8  : 
[ML:34178] + 0x138008ca3f0  : 
[ML:34178] + 0x138008ca438  : 
[ML:34178] + 0x138008ca480  : 
[ML:34178] + 0x138008ca4c8  : 
[ML:34178] + 0x138008ca510  : 
[ML:34178] + 0x138008ca538  : 
[ML:34178] + 0x138008ca5e8  : 
[ML:34178] + 0x138008ca6c0  : 
[ML:34178] + 0x138008ca708  : 
[ML:34178] + 0x138008ca750  : 
[ML:34178] + 0x138008ca798  : 
[ML:34178] + 0x138008ca7e0  : 
[ML:34178] + 0x138008ca828  : 
[ML:34178] + 0x138008ca870  : 
[ML:34178] + 0x138008ca8b8  : 
[ML:34178] + 0x138008ca958  : 
[ML:34178] + 0x138008cabf8  : 
[ML:34178] + 0x138008cac40  : 
[ML:34178] + 0x138008cac88  : 
[ML:34178]   14 : d4                Star0
[ML:34178]   15 : 1b ff f6          Mov <context>, r3
[ML:34178]   18 : 33 03 02 00       GetNamedProperty a0, [2:"type"], FBV[0]
[ML:34178] + 0x138008cc698  : 
[ML:34178] + 0x138008cc760  : 
[ML:34178]   * Recording constant known property :  [0x23ee00002e4d <String[4]: #type>] = : 
[ML:34178]   22 : d0                Star4
[ML:34178]   23 : 13 03             LdaConstant [3:"never-sent"]
[ML:34178] + 0x138008cc8a8  : 
[ML:34178]   25 : 78 f5 ff 03       TestEqualStrict r4, EmbeddedFeedback[0x3ff]
[ML:34178] + 0x138008cc978  : 
[ML:34178]   29 : a7 04             JumpIfTrue [4]
[ML:34178] + 0x138008cca48  : 
[ML:34178] + 0x138008ccbb0  : 
[ML:34178] + 0x138008cd358  : 
[ML:34178] New block (single fallthrough) at 0x23ee0142bc2d <SharedFunctionInfo handle>
[ML:34178]   VOs (IFS): VO{0}:n38; VO{1}:n25; VO{2}:n46; 
[ML:34178]   Constant properties:
[ML:34178]     - 0x23ee00002e4d <String[4]: #type>: { => }
[ML:34178]   Non-constant properties:
[ML:34178]   Constant context slots:
[ML:34178]   Non-constant context slots:
[ML:34178] 
[ML:34178]   31 : 98 a1             Jump [161]
[ML:34178] + 0x138008cd428  : 
[ML:34178]   33 : 8e 04             CreateBlockContext [4:0x23ee0142c3dd <ScopeInfo BLOCK_SCOPE>]
[ML:34178] New block (merge @0x138008ccc00) at 0x23ee0142bc2d <SharedFunctionInfo handle>
[ML:34178]   VOs (IFS): VO{0}:n38; VO{1}:n25; VO{2}:n46; 
[ML:34178]   Constant properties:
[ML:34178]     - 0x23ee00002e4d <String[4]: #type>: { => }
[ML:34178]   Non-constant properties:
[ML:34178]   Constant context slots:
[ML:34178]   Non-constant context slots:
[ML:34178] 
[ML:34178] Copying frame state from merge @0x138008ccc00
[ML:34178]   - VOs (IFS): VO{0}:n38; VO{1}:n25; VO{2}:n46; 
[ML:34178]   - VOs (merge): VO{0}:n38; VO{1}:n25; VO{2}:n46; 
[ML:34178] + 0x138008cdd10  : 
[ML:34178] + 0x138008cdd60  : 
[ML:34178] + 0x138008cdda8  : 
[ML:34178] + 0x138008cde60  : 
[ML:34178] + 0x138008cded8  : 
[ML:34178] + 0x138008cdf10  : 
[ML:34178] + 0x138008cdfc0  : 
[ML:34178] + 0x138008ce068  : 
[ML:34178] + 0x138008ce0b0  : 
[ML:34178] + 0x138008ce0f8  : 
[ML:34178] + 0x138008ce140  : 
[ML:34178]   35 : 1c f5             PushContext r4
[ML:34178]   37 : 10                LdaTheHole
[ML:34178] + 0x138008ce160  : 
[ML:34178]   38 : 27 02             StaCurrentContextSlotNoCell [2]
[ML:34178] + 0x138008ce1d0  : 
[ML:34178]   * Recording context slot store [16]: 
[ML:34178]   40 : 16 ff 02 02       LdaImmutableContextSlot <context>, [2], [2]
[ML:34178] + 0x138008ce270  : 
[ML:34178] + 0x138008ce720  : 
[ML:34178]   44 : ba 05             ThrowReferenceErrorIfHole [5:"cfg"]
[ML:34178]   46 : cf                Star5
[ML:34178]   47 : 33 f4 06 02       GetNamedProperty r5, [6:"x"], FBV[2]
[ML:34178] + 0x138008ce7f8  : 
[ML:34178] DEAD  : 33 f4 06 02       GetNamedProperty r5, [6:"x"], FBV[2]
[ML:34178]   51 : 27 02             StaCurrentContextSlotNoCell [2]
[ML:34178] DEAD  : 27 02             StaCurrentContextSlotNoCell [2]
[ML:34178]   53 : 1b ff f4          Mov <context>, r5
[ML:34178] DEAD  : 1b ff f4          Mov <context>, r5
[ML:34178]   56 : 8d 07 00 02       CreateClosure [7:0x23ee0142c425 <SharedFunctionInfo f>], FBV[0], #2
[ML:34178] DEAD  : 8d 07 00 02       CreateClosure [7:0x23ee0142c425 <SharedFunctionInfo f>], FBV[0], #2
[ML:34178]   60 : d2                Star2
[ML:34178] DEAD  : d2                Star2
[ML:34178]   61 : 6c f7 04          CallUndefinedReceiver0 r2, FBV[4]
[ML:34178] DEAD  : 6c f7 04          CallUndefinedReceiver0 r2, FBV[4]
[ML:34178]   64 : 1d f5             PopContext r4
[ML:34178] DEAD  : 1d f5             PopContext r4
[ML:34178]   66 : 98 7e             Jump [126]
[ML:34178] DEAD  : 98 7e             Jump [126]
[ML:34178]   68 : 10                LdaTheHole
[ML:34178] New block (exception handler @0x1380048dea0) at 0x23ee0142bc2d <SharedFunctionInfo handle>
[ML:34178]   VOs (IFS): VO{3}:n73; VO{0}:n38; VO{1}:n25; VO{2}:n46; 
[ML:34178]   Constant properties:
[ML:34178]     - 0x23ee00002e4d <String[4]: #type>: { => }
[ML:34178]   Non-constant properties:
[ML:34178]   Constant context slots:
[ML:34178]     - @16: 
[ML:34178]   Non-constant context slots:
[ML:34178] 
[ML:34178] DEAD  : 10                LdaTheHole
[ML:34178]   69 : b6                SetPendingMessage
[ML:34178] DEAD  : b6                SetPendingMessage
[ML:34178]   70 : 0b f4             Ldar r5
[ML:34178] DEAD  : 0b f4             Ldar r5
[ML:34178]   72 : 1b ff f4          Mov <context>, r5
[ML:34178] DEAD  : 1b ff f4          Mov <context>, r5
[ML:34178]   75 : 16 ff 02 02       LdaImmutableContextSlot <context>, [2], [2]
[ML:34178] DEAD  : 16 ff 02 02       LdaImmutableContextSlot <context>, [2], [2]
[ML:34178]   79 : cd                Star7
[ML:34178] DEAD  : cd                Star7
[ML:34178]   80 : 33 f2 08 06       GetNamedProperty r7, [8:"c"], FBV[6]
[ML:34178] DEAD  : 33 f2 08 06       GetNamedProperty r7, [8:"c"], FBV[6]
[ML:34178]   84 : ce                Star6
[ML:34178] DEAD  : ce                Star6
[ML:34178]   85 : 19 02             LdaImmutableCurrentContextSlot [2]
[ML:34178] DEAD  : 19 02             LdaImmutableCurrentContextSlot [2]
[ML:34178]   87 : cc                Star8
[ML:34178] DEAD  : cc                Star8
[ML:34178]   88 : 69 f3 f2 f1 08    CallProperty1 r6, r7, r8, FBV[8]
[ML:34178] DEAD  : 69 f3 f2 f1 08    CallProperty1 r6, r7, r8, FBV[8]
[ML:34178]   93 : cd                Star7
[ML:34178] DEAD  : cd                Star7
[ML:34178]   94 : 1b f9 f3          Mov r0, r6
[ML:34178] DEAD  : 1b f9 f3          Mov r0, r6
[ML:34178]   97 : 73 00 f3 02       InvokeIntrinsic [_AsyncFunctionAwait], r6-r7
[ML:34178] DEAD  : 73 00 f3 02       InvokeIntrinsic [_AsyncFunctionAwait], r6-r7
[ML:34178]  101 : bf f9 f9 06 00    SuspendGenerator r0, r0-r5, [0]
[ML:34178] DEAD  : bf f9 f9 06 00    SuspendGenerator r0, r0-r5, [0]
[ML:34178]  106 : c0 f9 f9 06       ResumeGenerator r0, r0-r5
[ML:34178] New block (merge @0x138008c8018) at 0x23ee0142bc2d <SharedFunctionInfo handle>
[ML:34178]   VOs (IFS): VO{3}:n73; VO{0}:n38; VO{1}:n25; VO{2}:n46; 
[ML:34178]   Constant properties:
[ML:34178]     - 0x23ee00002e4d <String[4]: #type>: { => }
[ML:34178]   Non-constant properties:
[ML:34178]   Constant context slots:
[ML:34178]     - @16: 
[ML:34178]   Non-constant context slots:
[ML:34178] 
[ML:34178] Copying frame state from merge @0x138008c8018
[ML:34178]   - VOs (IFS): VO{3}:n73; VO{0}:n38; VO{1}:n25; VO{2}:n46; 
[ML:34178]   - VOs (merge): 
[ML:34178] + 0x138008ce9c8  : 
[ML:34178] + 0x138008cea28  : 
[ML:34178] + 0x138008cea80  : 
[ML:34178] + 0x138008cead8  : 
[ML:34178] + 0x138008ceb00  : 
[ML:34178] + 0x138008ceb28  : 
[ML:34178] + 0x138008ceb50  : 
[ML:34178] + 0x138008ceb70  : 
[ML:34178]  110 : ce                Star6
[ML:34178]  111 : 73 09 f9 01       InvokeIntrinsic [_GeneratorGetResumeMode], r0-r0
[ML:34178] + 0x138008cebd0  : 
[ML:34178]  115 : cd                Star7
[ML:34178]  116 : 0c                LdaZero
[ML:34178]  117 : 1e f2             TestReferenceEqual r7
[ML:34178] + 0x138008cec38  : 
[ML:34178]  119 : a7 05             JumpIfTrue [5]
[ML:34178] + 0x138008cec98  : 
[ML:34178] New block (single fallthrough) at 0x23ee0142bc2d <SharedFunctionInfo handle>
[ML:34178]   VOs (IFS): 
[ML:34178]   Constant properties:
[ML:34178]   Non-constant properties:
[ML:34178]   Constant context slots:
[ML:34178]   Non-constant context slots:
[ML:34178] 
[ML:34178]  121 : 0b f3             Ldar r6
[ML:34178]  123 : b8                ReThrow
[ML:34178] + 0x138008cf420  : 
[ML:34178] DEAD  : b8                ReThrow
[ML:34178]  124 : 1b f3 f8          Mov r6, r1
[ML:34178] New block (merge @0x138008ced10) at 0x23ee0142bc2d <SharedFunctionInfo handle>
[ML:34178]   VOs (IFS): 
[ML:34178]   Constant properties:
[ML:34178]   Non-constant properties:
[ML:34178]   Constant context slots:
[ML:34178]   Non-constant context slots:
[ML:34178] 
[ML:34178] Copying frame state from merge @0x138008ced10
[ML:34178]   - VOs (IFS): 
[ML:34178]   - VOs (merge): 
[ML:34178]  127 : 16 ff 02 02       LdaImmutableContextSlot <context>, [2], [2]
[ML:34178] + 0x138008cf5c8  : 
[ML:34178] + 0x138008cf6c0  :

Version matrix (same script, same machine)

Build	Electron	V8	Result
VS Code 1.122.1	39.8.8	14.2.231.22	no crash (3 runs)
VS Code 1.127.0	42.x	14.8.178.14	exit 133, deterministic
VS Code 1.128.x stable	42.5.0	14.8.178.33	exit 133, deterministic
Insiders 1.129.0	42.5.0	14.8.178.33	exit 133, deterministic
any affected build + --no-maglev			clean

So the regression window narrows to V8 14.2.231.22 → 14.8.178.x (the Electron 39 → 42 bump, which first shipped in VS Code 1.123.0 — consistent with when our production crash reports began).

The repro crashes in about a second, so happy to run any additional flags or candidate fixes against it. It also lines up with the upstream V8 issue we filed (https://issues.chromium.org/issues/532595501): Maglev non-OSR GetContextAtDepth CHECK after a ScopeInfo chain mismatch — related to crbug 510716370, and not fixed by disabling OSR.

[deepak1556]

Thank you for the minimal repro, thats super helpful.

[deepak1556]

Based on the minimal repro, bisect confirms the issue is addressed with https://chromium-review.googlesource.com/c/v8/v8/+/7780217

V8 at 76c23c7c / Chromium 149.0.7798.0: crashes.
V8 at b5cae3b / Chromium 149.0.7811.0: does not crash.

[deepak1556]

@miles-augment @johnny2211 did you run your test case against newer v8 versions that the ones shipped with VSCode to confirm the crash persists ? Based on what I can confirm this doesn't repro in versions with the above linked change.