Bug 1530364 - Ensure compartment always has a live global when creating a new global in it. r=bzbarsky

Differential Revision: https://phabricator.services.mozilla.com/D23287

--HG--
extra : moz-landing-system : lando

js/src/vm/GlobalObject.cpp

@@ -570,6 +570,17 @@ GlobalObject* GlobalObject::new_(JSContext* cx, const Class* clasp,
   MOZ_ASSERT(!cx->isExceptionPending());
   MOZ_ASSERT_IF(cx->zone(), !cx->zone()->isAtomsZone());
 
+  // If we are creating a new global in an existing compartment, make sure the
+  // compartment has a live global at all times (by rooting it here).
+  // See bug 1530364.
+  Rooted<GlobalObject*> existingGlobal(cx);
+  const JS::RealmCreationOptions& creationOptions = options.creationOptions();
+  if (creationOptions.compartmentSpecifier() ==
+      JS::CompartmentSpecifier::ExistingCompartment) {
+    Compartment* comp = creationOptions.compartment();
+    existingGlobal = &comp->firstGlobal();
+  }
+
   Realm* realm = NewRealm(cx, principals, options);
   if (!realm) {
     return nullptr;