[charcircuit]

My first guess would be that this early return is always happening after entering the bugged state. The one cleanup task could get stuck or not cleanup after itself properly.

    // Only one cleanup task is posted at a time.
    if (!HasDirtyJSFinalizationRegistries() || is_finalization_registry_cleanup_task_posted_) {
      return;
    }

https://source.chromium.org/chromium/chromium/src/+/main:v8/...

[bouk]

Ah this makes a lot of sense, perhaps the posted flag doesn't get reset e.g. if this branch gets followed: https://source.chromium.org/chromium/chromium/src/+/main:v8/...

[syg]

Yeah this is the bug. My bad, will fix.