src: fix finalization crash

PR-URL: #38250
Backport-PR-URL: #42512
Fixes: #38040
Reviewed-By: Beth Griggs <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>

Author: jasnell

src/js_native_api_v8.cc

@@ -379,6 +379,9 @@ class Reference : public RefBase {
 
  protected:
   inline void Finalize(bool is_env_teardown = false) override {
+    if (is_env_teardown) env_teardown_finalize_started_ = true;
+    if (!is_env_teardown && env_teardown_finalize_started_) return;
+
     // During env teardown, `~napi_env()` alone is responsible for finalizing.
     // Thus, we don't want any stray gc passes to trigger a second call to
     // `RefBase::Finalize()`. ClearWeak will ensure that even if the
@@ -467,6 +470,7 @@ class Reference : public RefBase {
     reference->Finalize();
   }
 
+  bool env_teardown_finalize_started_ = false;
   v8impl::Persistent<v8::Value> _persistent;
   SecondPassCallParameterRef* _secondPassParameter;
 };