Comment by charcircuit

My first guess would be that this early return is always happening after entering the bugged state. The one cleanup task could get stuck or not cleanup after itself properly.

    // Only one cleanup task is posted at a time.
    if (!HasDirtyJSFinalizationRegistries() || is_finalization_registry_cleanup_task_posted_) {
      return;
    }

https://source.chromium.org/chromium/chromium/src/+/main:v8/...