fix(patch): allow JS execution in finalizer callbacks

V8 14.9 holds a DisallowJavascriptExecution across the whole collection,
the epilogue included, and turns entering JS from a GC callback into a
GRACEFUL_FATAL. 10.3 ran the second-pass callbacks under an explicit
AllowJavascriptExecution, which the iOS runtime relies on: disposing an
ObjC wrapper runs -dealloc, and any JS-backed override that teardown
reaches re-enters JS through ArgConverter::MethodCallback.

The scope is lifted around the finalizer drain alone, so the second-pass
callbacks below it still satisfy their own assertion that JS is
disallowed. Verified by compiling global-handles.o for arm64-simulator.

Author: edusperoni

README.md

@@ -127,7 +127,7 @@ platform), dispatch the workflow with `platforms: android` or `platforms: ios`.
 
 | Patch | Why |
 |---|---|
-| `v8_resurrecting_finalizers.patch` | Restores `WeakCallbackType::kFinalizer`, removed upstream immediately after 10.3.22. Both runtimes' object managers depend on resurrecting finalizers. |
+| `v8_resurrecting_finalizers.patch` | Restores `WeakCallbackType::kFinalizer`, removed upstream immediately after 10.3.22. Both runtimes' object managers depend on resurrecting finalizers. It also lifts, for the finalizer drain only, the `DisallowJavascriptExecution` scope that `Heap::CollectGarbage` now holds across the whole collection: 14.9 turns entering JS from a GC callback into a `GRACEFUL_FATAL`, and the iOS runtime reaches JS whenever a released ObjC object's `-dealloc` hits a JS-backed override. |
 | `android_build.patch` | Lowers chromium's minimum SDK to 21 (that floor is for Java/dex tooling; this builds only the native target), makes `android_ndk_root` a gn arg, and widens the hard Linux-host assert so macOS can build the 64-bit ABIs. |
 
 ## The gn args are load-bearing

patches/v8_resurrecting_finalizers.patch

@@ -21,7 +21,7 @@ index ad2ae1f4517..c2c76af2830 100644
 
  template <class T>
 diff --git a/src/handles/global-handles.cc b/src/handles/global-handles.cc
-index e03603371cd..481e317df87 100644
+index e03603371cd..ad2172fdd5e 100644
 --- a/src/handles/global-handles.cc
 +++ b/src/handles/global-handles.cc
 @@ -55,6 +55,11 @@ enum class WeaknessType {
@@ -242,16 +242,25 @@ index e03603371cd..481e317df87 100644
  void GlobalHandles::PostGarbageCollectionProcessing(
      v8::GCCallbackFlags gc_callback_flags) {
    // Process weak global handle callbacks. This must be done after the
-@@ -874,6 +986,8 @@ void GlobalHandles::PostGarbageCollectionProcessing(
+@@ -874,6 +986,17 @@ void GlobalHandles::PostGarbageCollectionProcessing(
    // API functions.
    DCHECK_EQ(Heap::NOT_IN_GC, isolate_->heap()->gc_state());
 
-+  InvokeFinalizerCallbacks();
++  {
++    // `Heap::CollectGarbage` holds a `DisallowJavascriptExecution` across the
++    // whole collection, including the epilogue this runs from, and
++    // `InvokeExternalCallbacks()` re-enables allocation but deliberately not
++    // JS. Finalizer callbacks are documented to permit both (see
++    // `v8::WeakCallbackType::kFinalizer`), so lift it for them alone -- the
++    // second-pass callbacks below assert that JS is still disallowed.
++    AllowJavascriptExecution allow_js(isolate_);
++    InvokeFinalizerCallbacks();
++  }
 +
    if (second_pass_callbacks_.empty()) return;
 
    const bool synchronous_second_pass =
-@@ -902,7 +1016,10 @@ void GlobalHandles::PostGarbageCollectionProcessing(
+@@ -902,7 +1025,10 @@ void GlobalHandles::PostGarbageCollectionProcessing(
 
  void GlobalHandles::IterateStrongRoots(RootVisitor* v) {
    for (Node* node : *regular_nodes_) {