Bugzilla

Roughly what is going on:
- make a WeakRef to a target `TransplantableDOMObject` in another Zone
- enter it into that Zone's `FinalizationObservers`' `weakRefMap`, specifically a mapping from the target object to a list of WeakRef  cross-compartment wrappers
- while `deref`'ing the WeakRef, call the read barrier
- in the read barrier, because the target `isDOMClass()`, it is considered "released" and so the DOM object wrapper is considered to be cycle collected, and the WeakRef target is cleared. I don't really know what this is all about, but I reviewed it [when it was added](https://bugzilla.mozilla.org/show_bug.cgi?id=1642974) so I'll pretend like I do.
- nuke all cross-compartment wrappers. Because the WeakRef no longer has a target, it doesn't get cleared out of the `weakRefMap`
- a validity check notices that `weakRefMap` contains a dead wrapper

I'm kind of out of my depth here, but I'll attach a preliminary patch that at least fixes the test case.

Roughly what is going on:
- make a WeakRef to a target `TransplantableDOMObject` in another Zone
- enter it into that Zone's `FinalizationObservers`' `weakRefMap`: target -> list of WeakRef CCWs
- while `deref`'ing the WeakRef, call the read barrier
- in the read barrier, the target `isDOMClass()` and the DOM wrapper is considered to be "released", and the WeakRef target is cleared. I don't really know what this is all about, but I reviewed it [when it was added](https://bugzilla.mozilla.org/show_bug.cgi?id=1642974) so I'll pretend like I do.
- nuke all cross-compartment wrappers. Because the WeakRef no longer has a target, it doesn't get cleared out of the `weakRefMap`
- crash when a validity check notices that `weakRefMap` contains a dead wrapper

I'm kind of out of my depth here, but I'll attach a preliminary patch that at least fixes the test case.