Bug 1894442 - Allow shared atoms zone when checking weakmap keys r=sfink

This was an over-strict assertion getting the weakmap key's zone, which can
legitimately be the shared atoms zone.

Differential Revision: https://phabricator.services.mozilla.com/D209204

UltraBlame original commit: 62df6f06d6c6b340080abc282824ff30ce05743d

js/src/gc/WeakMap-inl.h

@@ -2470,27 +2470,28 @@ allowKeysInOtherZones
 )
 )
 {
-MOZ_RELEASE_ASSERT
-(
+Zone
+*
+keyZone
+=
 key
 -
 >
-zone
+zoneFromAnyThread
 (
 )
+;
+MOZ_RELEASE_ASSERT
+(
+keyZone
 =
 =
 zone
 (
 )
 |
 |
-key
--
->
-zone
-(
-)
+keyZone
 -
 >
 isAtomsZone

js/src/jit-test/tests/gc/bug-1894442.js

@@ -0,0 +1,24 @@
+evalInWorker
+(
+a
+=
+new
+WeakSet
+a
+.
+add
+(
+Symbol
+.
+hasInstance
+)
+gczeal
+(
+14
+)
+(
+0
+.
+b
+)
+)