fix: Ensure Environment::get_verified_object actually called verify_object

Addresses a class of error that can be encountered when an object
belongs to a different Environment.

Author: Benjamin-Dobell

bridge/jsb_environment.cpp

@@ -889,7 +889,8 @@ namespace jsb
         {
             return nullptr;
         }
-        return p_obj->GetAlignedPointerFromInternalField(IF_Pointer);
+        void* pointer = p_obj->GetAlignedPointerFromInternalField(IF_Pointer);
+        return verify_object(pointer) ? pointer : nullptr;
     }
 
     bool Environment::reference_object(void* p_pointer, bool p_is_inc)
@@ -948,21 +949,21 @@ namespace jsb
 
         // avoid crash in the situation that `InstanceBindingCallbacks::free_callback` is called before JS object gc callback is called,
         // which makes the pointer already erased in `object_gc_callback`
-        if (jsb_unlikely(!object_handle))
-        {
-            return;
-        }
-
-#if JSB_DEBUG
-        jsb_check(object_handle->pointer == p_pointer);
-#endif
-        const NativeClassID class_id = object_handle->class_id;
-        // hold it in a local variable to avoid gc too early
-        v8::Global<v8::Object> obj_ref = std::move(object_handle->ref_);
+        if (jsb_unlikely(!object_handle))
+        {
+            return;
+        }
+
+#if JSB_DEBUG
+        jsb_check(object_handle->pointer == p_pointer);
+#endif
+        const NativeClassID class_id = object_handle->class_id;
+        // hold it in a local variable to avoid gc too early
+        v8::Global<v8::Object> obj_ref = std::move(object_handle->ref_);
 
         // erase from ObjectDB before clearing the ref to avoid exposing a transient state
         // with an empty `ref_` in the ObjectDB, which can race with reference callbacks.
-        object_db_.remove_object(object_handle, p_pointer);
+        object_db_.remove_object(object_handle, p_pointer);
 
         // TODO: Look into if we ought to be calling obj->free_instance_binding(this)