Bug 1503399 - Weaken assertion to allow for stream.[[reader]] being a dead object. r=jwalden

Differential Revision: https://phabricator.services.mozilla.com/D11930

--HG--
extra : moz-landing-system : lando

js/src/builtin/Stream.cpp

@@ -2131,7 +2131,11 @@ ReadableStreamReaderGenericRelease(JSContext* cx, Handle<ReadableStreamReader*>
     }
 
     // Step 2: Assert: reader.[[ownerReadableStream]].[[reader]] is reader.
-    MOZ_ASSERT(UnwrapReaderFromStreamNoThrow(unwrappedStream) == unwrappedReader);
+#ifdef DEBUG
+    // The assertion is weakened a bit to allow for nuked wrappers.
+    ReadableStreamReader* unwrappedReader2 = UnwrapReaderFromStreamNoThrow(unwrappedStream);
+    MOZ_ASSERT_IF(unwrappedReader2, unwrappedReader2 == unwrappedReader);
+#endif
 
     // Create an exception to reject promises with below. We don't have a
     // clean way to do this, unfortunately.

js/src/jit-test/tests/stream/bug-1503399-1.js

@@ -0,0 +1,16 @@
+// Don't assert if the wrapper that's the value of stream.[[reader]] gets nuked.
+
+load(libdir + "asserts.js");
+
+let g = newGlobal();
+let stream = new ReadableStream({
+    start(controller) {
+        controller.enqueue("ponies");
+        controller.close();
+    }
+});
+g.stream = stream;
+g.eval("var reader = ReadableStream.prototype.getReader.call(stream);");
+nukeCCW(g.reader);
+assertErrorMessage(() => g.eval("reader.read()"), g.TypeError, "can't access dead object");
+g.eval("reader.releaseLock();");

js/src/jit-test/tests/stream/bug-1503399-2.js

@@ -0,0 +1,11 @@
+// Don't assert if the wrapper that's the value of reader.[[stream]] gets nuked.
+
+load(libdir + "asserts.js");
+
+let g = newGlobal();
+let stream = new g.ReadableStream({});
+let reader = ReadableStream.prototype.getReader.call(stream);
+nukeCCW(stream);
+
+assertErrorMessage(() => reader.read(), TypeError, "can't access dead object");
+assertErrorMessage(() => reader.releaseLock(), TypeError, "can't access dead object");