stream: fix Writable subclass instanceof checks

2a4b068 introduced a regression in where checking
`instanceof` would fail for `Writable` subclasses inside the
subclass constructor, i.e. before `Writable()` was called.

Also, calling `null instanceof Writable` or
`undefined instanceof Writable` would fail due to accessing the
`_writableState` property of the target object.

This fixes these problems.

Ref: nodejs#8834 (comment)

Author: addaleax

lib/_stream_writable.js

@@ -141,9 +141,12 @@ if (typeof Symbol === 'function' && Symbol.hasInstance) {
   realHasInstance = Function.prototype[Symbol.hasInstance];
   Object.defineProperty(Writable, Symbol.hasInstance, {
     value: function(object) {
+      if (realHasInstance.call(this, object))
+        return true;
+
       // Trying to move the `realHasInstance` from the Writable constructor
       // to here will break the Node.js LazyTransform implementation.
-      return object._writableState instanceof WritableState;
+      return object && object._writableState instanceof WritableState;
     }
   });
 } else {

test/parallel/test-stream-inheritance.js

@@ -27,3 +27,19 @@ assert.ok(!(readable instanceof Transform));
 assert.ok(!(writable instanceof Transform));
 assert.ok(!(duplex instanceof Transform));
 assert.ok(transform instanceof Transform);
+
+assert.ok(!(null instanceof Writable));
+assert.ok(!(undefined instanceof Writable));
+
+// Simple inheritance check for `Writable` works fine in a subclass constructor.
+function CustomWritable() {
+  assert.ok(this instanceof Writable, 'inhertis from Writable');
+  assert.ok(this instanceof CustomWritable, 'inherits from CustomWritable');
+}
+
+Object.setPrototypeOf(CustomWritable, Writable);
+Object.setPrototypeOf(CustomWritable.prototype, Writable.prototype);
+
+new CustomWritable();
+
+assert.throws(CustomWritable, /AssertionError: inhertis from Writable/);