Fixes the production V8_Fatal crashes on worker isolates (CHECK: "Finalizer callback must either reset its handle or re-arm it" at global-handles.cc:985, and its sibling CHECK(node->IsInUse()) at :284) — nondeterministic global-handle-table corruption surfacing at whichever consistency CHECK trips first.

Root cause

The custom WeakCallbackType::kFinalizer (v8-buildscripts patch) requires a finalizer callback to either reset its handle or re-arm it. Several runtime paths could mutate a registered handle's state out from under an in-flight finalizer, breaking that contract:

• JSBlock dispose helper (the production trigger): since 8080bc06 balanced block ownership, blocks actually die — running a dispose helper that did V8 global-handle work inline on whatever thread the last native release happened, including inside ObjectManager's finalizer drain via -dealloc cascades, and from foreign threads (the cross-isolate Locker hazard of Deadlock: TS-extended class +initialize (v8::Locker) vs cross-isolate ObjC→JS callbacks wedges the app (root cause of the 600s CI test timeouts) #420).
• Adapter dealloc self-reset: ArrayAdapter/NSDataAdapter/DictionaryAdapter deallocs reset the very persistent whose finalizer is running (reached through DisposeValue's [target release]), freeing the drained node under its own callback — the resurrect branch then called ClearWeak() on an empty handle, which V8 executes with no emptiness guard.
• __releaseNativeCounterpart: retired a registration with ClearWeak + delete state but no Reset — leaking the node as a permanent strong root with parameter() dangling at freed state, and JS-callable so it could free the state under an in-flight callback.

The fix: one ownership rule

ObjectWeakCallbackState is deleted by exactly two sites (FinalizerCallback's disposed branch, DisposeAllRegistered); every other retirement resets the persistent first — freeing the node, clearing the pending bit, guaranteeing no further callback — enforced by a disposing_ flag that makes reentrant retirement defer to the owning frame. FinalizerCallback re-checks handle emptiness after DisposeValue and retires (never re-arms) a handle whose node died underneath it. The JSBlock dispose helper stays inline — with the facts checked, that's sound: callback_ is a strong, unregistered persistent (resetting it can't touch the drain's bookkeeping), and a foreign-thread Locker into the block's own isolate is legitimate now that extended class names are worker-scoped. The helper keeps one real fix: the previously-conditional callback_->Reset() no longer leaks the node when the callback was already detached. FinalizerCallback also honors the disposing_ claim on entry, so a nested collection during teardown can't free a state the DisposeAllRegistered walk still holds. DisposerPHV (dead code, same hazardous shape) is deleted; an unlocked, guardless Reset in NSDataAdapter's dealloc is removed.

The reentrancy analysis (all six orderings) is in the commit; the correctness argument is the invariant, not the tests — none of these orderings can be fired deterministically from JS.

Tests

Five new specs in GCFinalizerTests.js, including a discriminating one (a WeakRef to a __releaseNativeCounterpart-retired object must be collectible — impossible pre-fix) and the production shape (JS closure → ObjC block held natively → released by a GC finalizer → deferred teardown makes the closure collectible). Control run: reverting only the one-line Reset crashes the runtime outright.

Not fixed here (documented follow-ups)

• DictionaryAdapter never resets object_ → strong-node leak pinning its JS object (needs its own analysis: the keys enumerator shares the handle).
• Adapter deallocs still take a foreign-thread Locker for their strong (non-finalizer) handles — outside the kFinalizer contract, deliberately left; rationale in the review thread.
• A latent worker-teardown/NSNotificationCenter race surfaced once in a control run (null context in ArgConverter::MethodCallback) — separate investigation.
• Constraint honored: no strong-handle lifetime migrations; resurrection remains the mechanism.

Summary by CodeRabbit

• Bug Fixes

  • Improved reliability when disposing native objects, blocks, and collection adapters.
  • Prevented re-entrant cleanup from causing stale references or incomplete finalization.
  • Improved handling when marshaling functions whose native blocks have already been released.
  • Ensured native resources are cleaned up synchronously and safely during teardown.

• Tests

  • Added and strengthened garbage-collection and finalization coverage, including retry handling for delayed collection.

• Documentation

  • Updated V8 migration notes to reflect the completed cleanup changes.