fix: destruction order of js env fields (#39521)

isolate_ depends on isolate_holder_ and so must be destroyed first.

shell/browser/javascript_environment.cc

@@ -104,9 +104,10 @@ gin::IsolateHolder CreateIsolateHolder(v8::Isolate* isolate) {
 
 JavascriptEnvironment::JavascriptEnvironment(uv_loop_t* event_loop,
                                              bool setup_wasm_streaming)
-    : isolate_(Initialize(event_loop, setup_wasm_streaming)),
-      isolate_holder_(CreateIsolateHolder(isolate_)),
-      locker_(isolate_) {
+    : isolate_holder_{CreateIsolateHolder(
+          Initialize(event_loop, setup_wasm_streaming))},
+      isolate_{isolate_holder_.isolate()},
+      locker_{isolate_} {
   isolate_->Enter();
 
   v8::HandleScope scope(isolate_);

shell/browser/javascript_environment.h

@@ -43,8 +43,12 @@ class JavascriptEnvironment {
   v8::Isolate* Initialize(uv_loop_t* event_loop, bool setup_wasm_streaming);
   std::unique_ptr<node::MultiIsolatePlatform> platform_;
 
-  raw_ptr<v8::Isolate> isolate_;
   gin::IsolateHolder isolate_holder_;
+
+  // owned-by: isolate_holder_
+  const raw_ptr<v8::Isolate> isolate_;
+
+  // depends-on: isolate_
   v8::Locker locker_;
 
   std::unique_ptr<MicrotasksRunner> microtasks_runner_;