buffer,n-api: release external buffers from BackingStore callback

Release `Buffer` and `ArrayBuffer` instances that were created through
our addon APIs and have finalizers attached to them only after V8 has
called the deleter callback passed to the `BackingStore`, instead of
relying on our own GC callback(s).

This fixes the following race condition:

1. Addon code allocates pointer P via `malloc`.
2. P is passed into `napi_create_external_buffer` with a finalization
   callback which calls `free(P)`. P is inserted into V8’s global array
   buffer table for tracking.
3. The finalization callback is executed on GC. P is freed and returned
   to the allocator. P is not yet removed from V8’s global array
   buffer table. (!)
4. Addon code attempts to allocate memory once again. The allocator
   returns P, as it is now available.
5. P is passed into `napi_create_external_buffer`. P still has not been
   removed from the v8 global array buffer table.
6. The world ends with `Check failed: result.second`.

Since our API contract is to call the finalizer on the JS thread on
which the `ArrayBuffer` was created, but V8 may call the `BackingStore`
deleter callback on another thread, fixing this requires posting
a task back to the JS thread.

Refs: https://github.com/nodejs/node/issues/32463#issuecomment-625877175
Fixes: https://github.com/nodejs/node/issues/32463

PR-URL: https://github.com/nodejs/node/pull/33321
Reviewed-By: James M Snell <jasnell@gmail.com>

test/addons/null-buffer-neuter/binding.cc

@@ -11,6 +11,10 @@ static void FreeCallback(char* data, void* hint) {
   alive--;
 }
 
+void IsAlive(const v8::FunctionCallbackInfo<v8::Value>& args) {
+  args.GetReturnValue().Set(alive);
+}
+
 void Run(const v8::FunctionCallbackInfo<v8::Value>& args) {
   v8::Isolate* isolate = args.GetIsolate();
   alive++;
@@ -27,15 +31,11 @@ void Run(const v8::FunctionCallbackInfo<v8::Value>& args) {
     char* data = node::Buffer::Data(buf);
     assert(data == nullptr);
   }
-
-  isolate->RequestGarbageCollectionForTesting(
-      v8::Isolate::kFullGarbageCollection);
-
-  assert(alive == 0);
 }
 
 void init(v8::Local<v8::Object> exports) {
   NODE_SET_METHOD(exports, "run", Run);
+  NODE_SET_METHOD(exports, "isAlive", IsAlive);
 }
 
 NODE_MODULE(NODE_GYP_MODULE_NAME, init)

test/addons/null-buffer-neuter/test.js

@@ -1,7 +1,11 @@
 'use strict';
 // Flags: --expose-gc
-
 const common = require('../../common');
+const assert = require('assert');
 const binding = require(`./build/${common.buildType}/binding`);
 
 binding.run();
+global.gc();
+setImmediate(() => {
+  assert.strictEqual(binding.isAlive(), 0);
+});