Claude browser-extension native host (Bun 1.3.14) crashes during RegExp compilation on Windows (bmalloc allocation failure)

[LivewaterTrading]

Summary

On Windows, the Claude browser-extension native host (chrome-native-host.exe, shipped with the Claude Desktop app) crashes inside its bundled Bun 1.3.14 runtime. The decoded bun.report trace shows the panic happens while compiling a regular expression — an allocation failure in JSC's Yarr engine trips bmalloc's crash-on-error handler (reported as "Illegal instruction").

This appears distinct from the previously reported socket-listener / assertion-failure crashes of the same component (#31470, #21381, #9261, #23034), which were about listener/socket setup. This one is a RegExp construction → allocation failure.

Crash report

bun.report URL: https://bun.report/1.3.14/e_12a41ca9mggggEugggCg53vG6+q22C6rr42Cqvm22Cwmk22C84mk6C0xmk6Cqrsj7Ckgrm7Cu1/i7C0t8i7Cuhmj6Ck6jj6C48sj6Ckw/0+Bgwi1+Bq0o+oC4is/oCy6o/oC0o7+oCA3u//Bhnowu9D

• Bun version: 1.3.14 (commit 2a41ca9)
• Build: Windows x86_64_baseline, StandaloneExecutable
• Panic: "Illegal instruction" — i.e. pas_allocation_result_crash_on_error (bmalloc allocation failure)

Decoded stack trace (top frames)

pas_allocation_result_crash_on_error            (pas_allocation_result.h:121)
pas_local_allocator_try_allocate_small_segregated_slow
bmalloc_heap_config_specialized_..._slow
pas_local_allocator_try_allocate
bmalloc_allocate_casual                         (bmalloc_heap.c:49)
WTF::FastMalloc::malloc                          (FastMalloc.h:235)
WTF::VectorBufferBase<>::allocateBuffer          (Vector.h:235)
WTF::Vector<>::reserveCapacity / expandCapacity / appendSlowCase
JSC::Yarr::YarrPattern::eitherUnicode()          (YarrPattern.cpp)
JSC::Yarr::YarrPatternConstructor::atomPatternCharacter
JSC::Yarr::Parser<>::parseEscape / parseAtomEscape / parseTokens / parse
JSC::Yarr::YarrPattern::compile                  (YarrPattern.cpp:2628)
JSC::RegExp::finishCreation / createWithoutCaching
JSC::RegExpCache::lookupOrCreate
JSC::regExpCreate / constructRegExp
JSC::constructWithRegExpConstructor              (RegExpConstructor.cpp:402)

The crash is a Vector buffer growth (expandCapacity) during Unicode regex term construction that fails to allocate and triggers the fatal handler. This is at native-host startup, before the MCP browser bridge is usable.

Environment

• OS: Windows 11 Pro 10.0.26200
• CPU: Intel Core i7-8650U (Kaby Lake R; supports AVX2, yet the baseline Bun build is what's bundled/used)
• Claude Desktop app: 1.12603.1.0 (x64, MSIX/Store — Claude_pzs8sxrjxfjjc)
• Claude Code CLI: 2.1.177 (npm/Node build — unaffected; Node, not Bun)
• Native host: ...\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\ChromeNativeHost\chrome-native-host.exe
• Registered host: com.anthropic.claude_browser_extension (HKCU Chrome NativeMessagingHosts)

winget upgrade reports no newer Claude version available, so this reproduces on the current shipping build.

Repro

1. Have the Claude Desktop app + the "Claude for Chrome" browser extension installed (native host registered under com.anthropic.claude_browser_extension).
2. Chrome launches the native host → the bundled Bun 1.3.14 process crashes during startup (RegExp compilation), emitting the bun.report URL above.
3. The browser bridge never connects.

Workaround in use

Removing the HKCU native-messaging-host registration (HKCU\Software\Google\Chrome\NativeMessagingHosts\com.anthropic.claude_browser_extension) prevents Chrome from launching the crashing host. The Claude Desktop app and the Claude Code CLI continue to work. (The Desktop app may re-register the key on next launch.)

Likely area to investigate

• A regex being compiled at native-host startup whose Unicode-pattern term vector growth fails under bmalloc — either a genuinely large/pathological pattern or an allocation issue specific to the x86_64_baseline Bun build on Windows.
• Worth checking whether bundling the non-baseline (AVX2) Bun build, or upgrading past Bun 1.3.14, resolves it.

[github-actions]

Found 3 possible duplicate issues:

1. [Bug] Claude in Chrome Native Host crashes on Windows 11 - Bun internal assertion failure #16691
2. [Bug] Chrome native host crashes with ERR_INVALID_ARG_TYPE on Windows named pipe creation #57846
3. [BUG] Latest version of Claude Code on Windows desktop errors on every prompt submit - aka does not work (on my version of windows) - Bun 1.3.14 "Internal assertion failure" (ntdll) crashes BOTH desktop-bundled 2.1.170 and client CLI #67255

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[LivewaterTrading]

Thanks, but I don't believe this is a duplicate of #16691 / #57846 / #67255. They share the broad "Bun crash on Windows native host" theme, but the actual fault signatures differ:

• [Bug] Claude in Chrome Native Host crashes on Windows 11 - Bun internal assertion failure #16691 — "Internal assertion failure" during socket listener creation (Bun 1.3.5). That's the listener-setup crash this report explicitly excludes.
• [Bug] Chrome native host crashes with ERR_INVALID_ARG_TYPE on Windows named pipe creation #57846 — ERR_INVALID_ARG_TYPE on named-pipe creation (a path / !-prefix issue), not an allocation panic.
• [BUG] Latest version of Claude Code on Windows desktop errors on every prompt submit - aka does not work (on my version of windows) - Bun 1.3.14 "Internal assertion failure" (ntdll) crashes BOTH desktop-bundled 2.1.170 and client CLI #67255 — "Internal assertion failure" (ntdll frame) in the main claude.exe Code-session binary, not the browser native host.

This report is a different signature: "Illegal instruction" = pas_allocation_result_crash_on_error, a bmalloc allocation failure inside JSC::Yarr::YarrPattern::compile (RegExp construction) at native-host startup (decoded bun.report trace in the issue body). It's the only one of the four in the Yarr/RegExp allocation path.

Requesting this stay open as a distinct crash. 👍 happy to add anything else useful.

[github-actions]

Closing for now — inactive for too long. Please open a new issue if this is still relevant.