Evaluate in a text pane:
[ ^self halt ] ensure: 
Enter the debugger and just press hop. The image crashes when hopping through the return.
The crash again happens in Debugger>>convert:to:offset:, this time the offset is not only slightly wrong as in case2 , but it is a seemingly random, but always very large number (in the millions).
This happens to be a complex interaction between debugger expanding some frames on demand and the way the VM tracks execution paths in the context of protected frames. The VM has a return address into a newly compiled (‘jitted’) debuggable version of the #ensure: method, but considers it to belong to the original, non-debuggable, version of the method, which was put into code cache long before, so has a totally different starting address, and this results in the huge offset.