`ObjectWrap` cleanup hooks break pre-built addons on Node.js 26.0.0-26.3.1 runtimes

### Version Node.js headers 26.4.0 or newer Node.js runtime 26.0.0 up to and including 26.3.1 ### Platform ```text Not platform specific, but used: Linux 7.0.0-28-generic #28~24.04.1-Ubuntu x86_64 x86_64 x86_64 GNU/Linux ``` ### Subsystem src, addons ### What steps will reproduce the bug? The crash depends on header and runtime version. So you will need headers from e.g. Node.js 26.4.0 and two runtimes (e.g. 26.2.0 and 26.4.0) 1. Sample that just uses `ObjectWrap` addon.cc: ```c++ #include <node.h> #include <node_object_wrap.h> using namespace v8; class Thing : public node::ObjectWrap { public: static void New(const FunctionCallbackInfo<Value>& args) { (new Thing())->Wrap(args.This()); } }; void Init(Local<Object> exports) { Isolate* isolate = Isolate::GetCurrent(); Local<Context> context = isolate->GetCurrentContext(); Local<FunctionTemplate> tpl = FunctionTemplate::New(isolate, Thing::New); tpl->InstanceTemplate()->SetInternalFieldCount(1); exports->Set(context, String::NewFromUtf8(isolate, "Thing").ToLocalChecked(), tpl->GetFunction(context).ToLocalChecked()).Check(); } NODE_MODULE(NODE_GYP_MODULE_NAME, Init) ``` index.js: ```javascript const { Thing } = require('./addon.node'); let junk = []; for (let i = 0; i < 300000; i++) { new Thing(); // wrapped object, immediately unreachable junk.push({ a: i }); // keep allocation rate high so V8 collects on its own if (junk.length > 1000) junk = []; } console.log('survived'); ``` 2. Compile against 26.4.0 (or newer if you want) ```sh g++ -std=c++20 -fPIC -shared \ -I</path/to/node-v26.4.0-linux-x64/include/node> \ -DNODE_GYP_MODULE_NAME=addon \ -o addon.node addon.cc ``` 3. Run same binary against two different Node.js versions ```sh # this one will run fine <path/to/node_26.4> index.js # this one will crash <path/to/node_26.2> index.js ``` ### How often does it reproduce? Is there a required condition? Determin…