--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -10816,17 +10816,17 @@ DebuggerEnvironment_checkThis(JSContext*
     }
 
     /*
      * Forbid access to Debugger.Environment objects that are not debuggee
      * environments.
      */
     if (requireDebuggee) {
         Rooted<Env*> env(cx, static_cast<Env*>(nthisobj->getPrivate()));
-        if (!Debugger::fromChildJSObject(nthisobj)->observesGlobal(&env->global())) {
+        if (!Debugger::fromChildJSObject(nthisobj)->observesGlobal(&env->nonCCWGlobal())) {
             JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_DEBUG_NOT_DEBUGGEE,
                                       "Debugger.Environment", "environment");
             return nullptr;
         }
     }
 
     return nthisobj;
 }
@@ -11166,17 +11166,17 @@ DebuggerEnvironment::getCallee(JSContext
 }
 
 bool
 DebuggerEnvironment::isDebuggee() const
 {
     MOZ_ASSERT(referent());
     MOZ_ASSERT(!referent()->is<EnvironmentObject>());
 
-    return owner()->observesGlobal(&referent()->global());
+    return owner()->observesGlobal(&referent()->nonCCWGlobal());
 }
 
 bool
 DebuggerEnvironment::isOptimized() const
 {
     return referent()->is<DebugEnvironmentProxy>() &&
            referent()->as<DebugEnvironmentProxy>().isOptimizedOut();
 }

--- a/js/src/vm/EnvironmentObject-inl.h
+++ b/js/src/vm/EnvironmentObject-inl.h
@@ -73,12 +73,12 @@ JSObject::enclosingEnvironment() const
 
     if (is<js::DebugEnvironmentProxy>())
         return &as<js::DebugEnvironmentProxy>().enclosingEnvironment();
 
     if (is<js::GlobalObject>())
         return nullptr;
 
     MOZ_ASSERT_IF(is<JSFunction>(), as<JSFunction>().isInterpreted());
-    return &global();
+    return &nonCCWGlobal();
 }
 
 #endif /* vm_EnvironmentObject_inl_h */

--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@@ -228,17 +228,17 @@ GetNameOperation(JSContext* cx, Interpre
      * used for GNAME opcodes where the bytecode emitter has determined a
      * name access must be on the global. It also insulates us from bugs
      * in the emitter: type inference will assume that GNAME opcodes are
      * accessing the global object, and the inferred behavior should match
      * the actual behavior even if the id could be found on the env chain
      * before the global object.
      */
     if (IsGlobalOp(JSOp(*pc)) && !fp->script()->hasNonSyntacticScope())
-        envChain = &envChain->global().lexicalEnvironment();
+        envChain = &cx->global()->lexicalEnvironment();
 
     /* Kludge to allow (typeof foo == "undefined") tests. */
     JSOp op2 = JSOp(pc[JSOP_GETNAME_LENGTH]);
     if (op2 == JSOP_TYPEOF)
         return GetEnvironmentName<GetNameMode::TypeOf>(cx, envChain, name, vp);
     return GetEnvironmentName<GetNameMode::Normal>(cx, envChain, name, vp);
 }