Android jsi + QuickJS: worker close() from its message handler aborts in JS_FreeRuntime (gc_obj_list not empty) #94

Summary

With the jsi binding layer on QuickJS, the app aborts when a worker calls close() from inside its onmessage handler after it has used Java classes. QuickJS asserts in JS_FreeRuntime:

Assertion failed: list_empty(&rt->gc_obj_list)

That means GC objects are still alive when the worker's runtime is freed. Something still holds JSValues owned by that runtime, such as a native cache or object map that isn't released before the runtime is freed. Other combinations don't hit it:

Reproduce

1. Build platforms/android/test-app with QuickJS and the jsi layer:
   ./gradlew :app:assembleDebug -Pengine=QUICKJS -Pns_engine=QUICKJS -PbindingLayer=jsi -PonlyArm64 -PuseKotlin=true
2. Use a worker that touches a Java class, forces a collection, and then closes itself from the handler:

   onmessage = () => {
     new java.lang.Object();
     gc();
     close();
   };

3. From the main runtime, create the worker and postMessage to it.
4. The app aborts in JS_FreeRuntime on every run. A collection inside the handler is required; without gc(), it depends on the heap state.

This was found while testing #92. It reproduced in 3 of 3 runs with #92 applied and in 2 of 2 runs on the unmodified base branch, so #92 does not cause it.

Expected

A worker that closes itself is torn down cleanly. Every value NativeScript holds in the runtime is released before the runtime is freed, as it is when the parent calls terminate() and in the napi tree.

Environment

• Branch: android-react-native at 64c7fed
• Emulator: Android API 36, arm64
• Engine: QuickJS (quickjs-ng), with the jsi binding layer