VS Code extension 26.707: streaming warning loop repeatedly crashes renderer with SIGILL on Linux

Description

The Codex VS Code extension repeatedly crashes its webview renderer on Linux/Wayland while a response is streaming. Immediately before each crash, the extension log floods with unhandled thread-stream-state-changed broadcasts interleaved with ResizeObserver errors. The renderer then terminates with SIGILL at the same relative instruction offset on every occurrence.

The Codex app-server process remains alive after the crash, as do the VS Code main/workbench and GPU processes. There is no OOM event. This appears to be a Codex webview/frontend failure rather than a backend or whole-editor crash.

I reproduced this three times with the same native signature:

| Time (local) | Signal | Relative instruction offset |
| --- | --- | --- |
| 2026-07-12 17:50:18 | SIGILL / invalid opcode | 0x3ac5667 |
| 2026-07-14 13:42:08 | SIGILL / invalid opcode | 0x3ac5667 |
| 2026-07-14 16:36:46 | SIGILL / invalid opcode | 0x3ac5667 |

Steps to reproduce

This is intermittent, but the observed pattern is:

1. Open the Codex panel in VS Code and resume an existing conversation.
2. Start a stream-heavy turn that produces multiple incremental reasoning/tool events.
3. Leave the Codex panel active while the response streams.
4. The extension log begins emitting repeated thread-stream-state-changed and ResizeObserver errors.
5. The Codex UI disappears/crashes while the app-server process continues running.

Two VS Code windows were open during the latest occurrence, and both extension logs received the stream-state broadcasts. I have not yet established whether multiple windows are required.

Expected behavior

Streaming updates should be handled without a log loop or renderer crash.

Actual behavior

The following sequence repeats immediately before the native crash:

Received broadcast but no handler is configured method=thread-stream-state-changed
[desktop-notifications][global-error] ResizeObserver loop completed with undelivered notifications.
Received broadcast but no handler is configured method=thread-stream-state-changed
[desktop-notifications][global-error] ResizeObserver loop completed with undelivered notifications.
Received broadcast but no handler is configured method=thread-stream-state-changed
[desktop-notifications][global-error] ResizeObserver loop completed with undelivered notifications.

The same log also contains a feature/config version mismatch:

codex_features: unknown feature key in config: thread_tools

The kernel records an invalid-opcode trap in a code --type=renderer process using Wayland:

traps: code[...] trap invalid opcode ... in code[...]

Core analysis shows the faulting instruction is an explicit ud2, preceded by int3. After rebasing the ASLR addresses, all three cores land at the same ELF virtual offset, 0x3ac5667:

int3
ud2    # faulting instruction

The binary is stripped, but nearby embedded trace strings identify this code region as Blink style/layout code, including:

Style.InvalidationTime
UpdateLayoutTree

The Codex app-server stays alive after the renderer dies. No OOM kill is recorded, and neither the VS Code main process nor GPU process crashes.

Environment

• OS: NixOS 26.05.20260712.569d578 (Yarara)
• Kernel: Linux 7.1.3, x86_64
• Desktop: Wayland
• CPU: AMD Ryzen 7 5800H
• VS Code: 1.128.0
• VS Code commit: fc3def6774c76082adf699d366f31a557ce5573f
• Codex extension: openai.chatgpt 26.707.41301
• Extension-bundled Codex CLI: 0.144.0-alpha.4
• Standalone Codex CLI installed on the host: 0.144.1
• Codex setting: chatgpt.followUpQueueMode = steer (included for completeness; not established as causal)

Working hypothesis

The repeated stream-state broadcasts appear to drive or amplify frontend DOM/layout updates while a ResizeObserver delivery is already in progress. Blink then reaches an internal style/layout invariant and intentionally aborts with ud2. The unsupported thread_tools feature and missing thread-stream-state-changed handler also suggest the extension frontend and bundled app-server may have incompatible feature/event expectations.

This is an inference from the timing and native-core evidence, not yet a minimal source-level reproduction.

Related reports

I did not find an existing issue with this exact ResizeObserver -> Blink UpdateLayoutTree -> SIGILL signature. These appear related:

• https://github.com/openai/codex/issues/18515 — extension error/log loop precedes renderer crashes
• https://github.com/openai/codex/issues/15397 — thread-stream-state-changed warning storm and renderer/GPU CPU usage
• https://github.com/openai/codex/issues/28427 — unsupported thread_tools plus missing stream-state handler
• https://github.com/openai/codex/issues/31633 — newer extension versions show CPU churn and the same feature/handler warnings
• https://github.com/openai/codex/issues/13343 — stream-state warnings with streaming UI stalls
• https://github.com/openai/codex/issues/32475 — recent Codex renderer crash through a different apparent mechanism

I can provide sanitized full extension logs and additional core/disassembly details if useful.