Bug 1516958 - Weaken failing assertion that fails to account for nuked wrappers. r=jimb

In theory, nuking a debugger or debuggee compartment should sever all Debugger
connections, but it doesn't (bug 1084626). Therefore we must tolerate dead
objects in the allocation log.

Differential Revision: https://phabricator.services.mozilla.com/D19064

--HG--
extra : moz-landing-system : lando

js/src/jit-test/tests/debug/bug1516958.js

@@ -0,0 +1,3 @@
+(new (newGlobal({newCompartment:true}).Debugger)(this)).memory.trackingAllocationSites = true;
+nukeAllCCWs();
+new Date();

js/src/vm/Debugger.h

@@ -23,6 +23,7 @@
 #include "js/HashTable.h"
 #include "js/Utility.h"
 #include "js/Wrapper.h"
+#include "proxy/DeadObjectProxy.h"
 #include "vm/GeneratorObject.h"
 #include "vm/GlobalObject.h"
 #include "vm/JSContext.h"
@@ -418,8 +419,9 @@ class Debugger : private mozilla::LinkedListElement<Debugger> {
           ctorName(ctorName),
           size(size),
           inNursery(inNursery) {
-      MOZ_ASSERT_IF(frame, UncheckedUnwrap(frame)->is<SavedFrame>());
-    };
+      MOZ_ASSERT_IF(frame, UncheckedUnwrap(frame)->is<SavedFrame>() ||
+                               IsDeadProxyObject(frame));
+    }
 
     HeapPtr<JSObject*> frame;
     mozilla::TimeStamp when;