Bug 1254622 - Relookup group->newScript in CreateThisForFunctionWithGroup. r=bhackett

js/src/jsobj.cpp

@@ -932,8 +932,9 @@ CreateThisForFunctionWithGroup(JSContext* cx, HandleObjectGroup group,
         if (!res)
             return nullptr;
 
-        if (newKind != SingletonObject)
-            newScript->registerNewObject(res);
+        // Make sure group->newScript is still there.
+        if (newKind != SingletonObject && group->newScript())
+            group->newScript()->registerNewObject(res);
 
         return res;
     }