Bug 1577311 - Ensure the js object is dropped while the holder is unlinked and destructored; r=baku

Differential Revision: https://phabricator.services.mozilla.com/D47218

--HG--
extra : moz-landing-system : lando

dom/file/Blob.cpp

@@ -317,8 +317,8 @@ class BlobBodyStreamHolder final : public BodyStreamHolder {
   // Public to make trace happy.
   JS::Heap<JSObject*> mStream;
 
- private:
-  ~BlobBodyStreamHolder() = default;
+ protected:
+  virtual ~BlobBodyStreamHolder() { NullifyStream(); }
 };
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(BlobBodyStreamHolder)
@@ -334,7 +334,7 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(BlobBodyStreamHolder,
                                                 BodyStreamHolder)
-  tmp->mStream = nullptr;
+  tmp->NullifyStream();
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_ADDREF_INHERITED(BlobBodyStreamHolder, BodyStreamHolder)