Window crashed on large tool output #325814

Type

Performance / crash

VS Code version

1.129.0-insider
Commit: 323fd70
Electron: 42.6.0
Node: 24.18.0
V8: 14.8.178.38-electron.0
Platform: macOS arm64

Problem

A chat tool returned a schema-valid structured result containing approximately
211 MB of strings. The strings were distributed across dozens of properties,
with many individual values between 7 MB and 12 MB.

This caused two native crashes:

1. The extension host crashed about 8 seconds after receiving the result.
2. The renderer crashed about 14 seconds later while persisting the chat
   session.

No sensitive tool-result content is included in this report.

Extension-host crash

The extension host reached approximately 635 MB of V8 old-space usage and
performed repeated last-resort collections before terminating.

Relevant symbolicated frames:

node::OOMErrorHandler
v8::internal::V8::FatalProcessOutOfMemory
v8::internal::HeapAllocator::AllocateRawSlowPath
v8::internal::ElementsAccessorBase::GrowCapacity
v8::internal::Runtime_GrowArrayElements
node::worker::MessagePort::OnMessage

Renderer crash

Crash reason:

EXC_BREAKPOINT
V8 process OOM (Zone)

Relevant native frames:

partition_alloc::internal::OnNoMemoryInternal
blink::ReportV8OOMError
v8::internal::V8::FatalProcessOutOfMemory
v8::internal::Zone::Expand
v8::internal::FastJsonStringifier::SerializeObject
v8::internal::JsonStringify
v8::internal::Builtin_JsonStringify

The V8 crash annotation identifies the JavaScript path as:

JSON.stringify
ChatSessionOperationLog.write
ChatSessionStore.writeSession

The value being serialized was a chat request response.

Analysis

stringifyEntryWithFallback() first invokes JSON.stringify() without a
replacer. It retries with a truncating replacer if V8 throws RangeError.

In this case V8 exhausted memory inside the JSON stringifier and terminated the
renderer. No catchable exception was produced, so the fallback was never
reached.

Relevant source:

• src/vs/workbench/contrib/chat/common/model/objectMutationLog.ts
• src/vs/workbench/contrib/chat/common/model/chatSessionStore.ts

The extension host also materialized or transported the structured result before
the renderer attempted persistence, so guarding only the persistence path may
not prevent the first crash.

Suggested synthetic reproduction

Construct a structured tool result containing 20–30 string properties of roughly
8–12 MB each, then add it as a chat tool response and allow the session operation
log to persist it.

The generated strings can contain repeated placeholder characters; no real tool
or repository data is required.

Expected behavior

Large tool results should be rejected, externalized, summarized, or truncated
before they can exhaust either process. Session persistence should apply its
size budget before the initial unbounded JSON.stringify().

Actual behavior

The extension host and renderer both terminate through V8's fatal OOM path.