Lua state allocation checks are compiled out in release builds.

[jpeach]

The Lua filter allocates Lua states like this:

ThreadLocalState::LuaThreadLocal::LuaThreadLocal(const std::string& code) : state_(lua_open()) {
  ASSERT(state_.get() != nullptr, "unable to create new lua state object");
  luaL_openlibs(state_.get());
  int rc = luaL_dostring(state_.get(), code.c_str());
  ASSERT(rc == 0);
}

lua_open() can return NULL, but in a release build -DNDEBUG is meant to be set by bazel, so the failure won't cause an immediate, controlled crash. Probably this (and maybe other cases in the Lua filter) should be RELEASE_ASSERT.