LibJS: Protect execution context variable environments from GC

At the moment these environments are always the same as the lexical
ones, so this didn't cause any trouble. Once we start separating them
we have to make sure both environments are protected.

Userland/Libraries/LibJS/Runtime/VM.cpp

@@ -106,6 +106,7 @@ void VM::gather_roots(HashTable<Cell*>& roots)
                 roots.set(&argument.as_cell());
         }
         roots.set(execution_context->lexical_environment);
+        roots.set(execution_context->variable_environment);
     }
 
 #define __JS_ENUMERATE(SymbolName, snake_name) \