[wasm] Fix background global handle destruction

Destroy the weak script handle from a custom finalizer, to ensure that
this is done from the main thread.

R=clemensb@chromium.org

Bug: v8:10417
Change-Id: I76a27c4a6db5ef4d189febcf9d0f81f9fd6c220d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2151347Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67267}

src/wasm/wasm-engine.cc

@@ -140,13 +140,15 @@ class WeakScriptHandle {
     GlobalHandles::MakeWeak(location_.get());
   }
 
-  WeakScriptHandle(WeakScriptHandle&&) V8_NOEXCEPT = default;
+  // Usually the destructor of this class should always be called after the weak
+  // callback because the Script keeps the NativeModule alive. So we expect the
+  // handle to be destroyed and the location to be reset already.
+  // We cannot check this because of one exception. When the native module is
+  // freed during isolate shutdown, the destructor will be called
+  // first, and the callback will never be called.
+  ~WeakScriptHandle() = default;
 
-  ~WeakScriptHandle() {
-    if (location_) {
-      GlobalHandles::Destroy(*location_);
-    }
-  }
+  WeakScriptHandle(WeakScriptHandle&&) V8_NOEXCEPT = default;
 
   Handle<Script> handle() { return Handle<Script>(*location_); }