Bug 1479651 - Use correct pointer for registering deferred finalization thing for SandboxPrivate, r=smaug.

--HG--
extra : rebase_source : 88e76371da6ba2c75c1bc88c380d1498a603183d

js/xpconnect/src/SandboxPrivate.h

@@ -34,8 +34,10 @@ public:
 
         // Pass on ownership of sbp to |global|.
         // The type used to cast to void needs to match the one in GetPrivate.
-        mozilla::RecordReplayRegisterDeferredFinalizeThing(nullptr, nullptr, sbp);
-        JS_SetPrivate(global, static_cast<nsIScriptObjectPrincipal*>(sbp.forget().take()));
+        nsIScriptObjectPrincipal* sop =
+            static_cast<nsIScriptObjectPrincipal*>(sbp.forget().take());
+        mozilla::RecordReplayRegisterDeferredFinalizeThing(nullptr, nullptr, sop);
+        JS_SetPrivate(global, sop);
     }
 
     static SandboxPrivate* GetPrivate(JSObject* obj)