fix: release ObjectManager's JS handles and JNI weak refs at teardown

ObjectManager had no destructor at all. `delete m_objectManager` ran the
implicit one, which destroyed the containers and abandoned everything they
pointed at.

The expensive part is the JNI weak global refs. m_cache holds one per entry, up
to its capacity of 1000, and LRUCache only ever ran its evict callback under
capacity pressure or explicit invalidation -- never at destruction, since it
had no destructor either. So a worker that touched Java objects abandoned its
whole cache when it died. ART's weak-global table is bounded, so this is not
merely a leak: enough worker cycles exhaust it and ART aborts.

The JS side leaked too. Every linked object owns a Persistent<Object>, a
JSInstanceInfo and an ObjectWeakCallbackState, freed only from the GC
finalizer -- and V8 does not run weak callbacks when an isolate is disposed. In
the default `none` marking mode the finalizer additionally re-arms SetWeak
while the Java counterpart is alive, so those wrappers are deliberately
retained and are therefore all still live at teardown.

Split across the two windows teardown actually has:

- ReleaseAllRegistered(), called from DestroyRuntime while the isolate is alive
  and locked: clears each wrapper's JsInfo internal field before freeing the
  JSInstanceInfo it points at, resets and deletes the Persistent, and releases
  m_poJsWrapperFunc.
- ~ObjectManager, reached from ~Runtime once the isolate is gone and while the
  thread is still attached to the JVM: clears the LRU cache, which now evicts
  through the callback. It touches no v8 handle.

That ordering is not incidental: Persistent::Reset() after Isolate::Dispose
writes into a freed handle table, and the JNI eviction has to happen before
~Runtime drops the com.tns.Runtime global ref, which ObjectManager calls
through.

m_idToObject now maps to ObjectWeakCallbackState* rather than the bare
Persistent*. The state was created and handed to SetWeak but stored nowhere, so
teardown had no way to reach it or the JSInstanceInfo. That also lets
ReleaseJSInstance free the state, which it never did.

Author: edusperoni

test-app/runtime/src/main/cpp/LRUCache.h

@@ -105,6 +105,23 @@ class LRUCache {
             insert(key, ref);
         }
 
+
+        /*
+         * Evicts every entry, running the evict callback for each. Needed at
+         * teardown: the callback owns the resource behind each value (JNI weak
+         * global refs, here), and nothing else releases them -- eviction
+         * otherwise only happens on capacity pressure or invalidation.
+         */
+        void clear() {
+            if (m_evictCallback != nullptr) {
+                for (auto& entry : m_key_to_value) {
+                    m_evictCallback(entry.second.first, m_state);
+                }
+            }
+            m_key_to_value.clear();
+            m_key_tracker.clear();
+        }
+
     private:
 
         void evictKey(const key_type& key) {

test-app/runtime/src/main/cpp/ObjectManager.cpp

@@ -220,7 +220,7 @@ Local<Object> ObjectManager::GetJsObjectByJavaObject(int javaObjectID) {
     return handleScope.Escape(Local<Object>());
   }
 
-  Persistent<Object>* jsObject = it->second;
+  Persistent<Object>* jsObject = it->second->target;
 
   auto localObject = Local<Object>::New(isolate, *jsObject);
   return handleScope.Escape(localObject);
@@ -296,7 +296,7 @@ void ObjectManager::Link(const Local<Object>& object, uint32_t javaObjectID,
   // link
   object->SetInternalField(jsInfoIdx, jsInfo);
 
-  m_idToObject.emplace(javaObjectID, objectHandle);
+  m_idToObject.emplace(javaObjectID, state);
 }
 
 bool ObjectManager::CloneLink(const Local<Object>& src,
@@ -460,6 +460,50 @@ int ObjectManager::GenerateNewObjectID() {
   return oldValue;
 }
 
+void ObjectManager::ReleaseAllRegistered() {
+  HandleScope handleScope(m_isolate);
+
+  auto jsInfoIdx = static_cast<int>(MetadataNodeKeys::JsInfo);
+
+  // Detached first: nothing below should observe a half-emptied map, and the
+  // finalizers these handles were armed with will never run now anyway.
+  auto survivors = std::move(m_idToObject);
+  m_idToObject.clear();
+
+  for (auto& entry : survivors) {
+    ObjectWeakCallbackState* state = entry.second;
+    Persistent<Object>* po = state->target;
+
+    if (!po->IsEmpty()) {
+      auto local = po->Get(m_isolate);
+      if (!local.IsEmpty()) {
+        // Drop the back-pointer before the JSInstanceInfo goes away.
+        local->SetInternalField(jsInfoIdx, Undefined(m_isolate));
+      }
+      po->Reset();
+    }
+
+    delete po;
+    delete state->jsInfo;
+    delete state;
+  }
+
+  if (m_poJsWrapperFunc != nullptr) {
+    m_poJsWrapperFunc->Reset();
+    delete m_poJsWrapperFunc;
+    m_poJsWrapperFunc = nullptr;
+  }
+}
+
+ObjectManager::~ObjectManager() {
+  // JNI only -- the isolate is already disposed by the time this runs. The LRU
+  // cache holds a JNI weak global ref per entry (up to its capacity) and only
+  // ever evicted them under capacity pressure, so a worker that touched Java
+  // objects abandoned the whole cache when it died. ART's weak-global table is
+  // bounded, so enough worker cycles turned that leak into an abort.
+  m_cache.clear();
+}
+
 void ObjectManager::ReleaseJSInstance(Persistent<Object>* po,
                                       JSInstanceInfo* jsInstanceInfo) {
   int javaObjectID = jsInstanceInfo->JavaObjectID;
@@ -473,9 +517,11 @@ void ObjectManager::ReleaseJSInstance(Persistent<Object>* po,
     throw NativeScriptException(ss.str());
   }
 
-  assert(po == it->second);
+  assert(po == it->second->target);
 
+  ObjectWeakCallbackState* callbackState = it->second;
   m_idToObject.erase(it);
+  delete callbackState;
   m_released.insert(po, javaObjectID);
   po->Reset();
 

test-app/runtime/src/main/cpp/ObjectManager.h

@@ -19,6 +19,21 @@ class ObjectManager {
  public:
   ObjectManager(jobject javaRuntimeObject);
 
+  /*
+   * Frees the JS side of every still-linked object. Must run on the runtime's
+   * own thread while the isolate is alive -- it resets v8::Persistents and
+   * clears internal fields. V8 does not run weak callbacks at isolate
+   * disposal, so without this every linked wrapper's handle, JSInstanceInfo
+   * and callback state is abandoned.
+   */
+  void ReleaseAllRegistered();
+
+  /*
+   * JNI-only teardown; runs from ~Runtime, after the isolate is disposed and
+   * while the thread is still attached. Must not touch any v8 handle.
+   */
+  ~ObjectManager();
+
   void Init(v8::Isolate* isolate);
 
   JniLocalRef GetJavaObjectByJsObject(const v8::Local<v8::Object>& object);
@@ -201,7 +216,7 @@ class ObjectManager {
 
   std::stack<GarbageCollectionInfo> m_markedForGC;
 
-  std::unordered_map<int, v8::Persistent<v8::Object>*> m_idToObject;
+  std::unordered_map<int, ObjectWeakCallbackState*> m_idToObject;
 
   PersistentObjectIdSet m_released;
 

test-app/runtime/src/main/cpp/Runtime.cpp

@@ -983,6 +983,14 @@ void Runtime::DestroyRuntime() {
   // is alive and its destructors can still touch v8::Global handles.
   IsolateTracked::SweepAll(m_isolate);
 
+  // Same reason: every still-linked Java<->JS wrapper holds a Persistent, a
+  // JSInstanceInfo and its weak-callback state, and those finalizers will
+  // never run now. The JNI half of ObjectManager is released later, in its
+  // destructor, once the isolate is gone.
+  if (m_objectManager != nullptr) {
+    m_objectManager->ReleaseAllRegistered();
+  }
+
   // Everything below still needs the isolate alive -- the caller disposes it
   // only after this returns -- but runs after the hooks above so nothing they
   // touch is pulled out from under them.