Fix missing gc root in jl_cglobal

Static analysis complains that the jl_fieldref could allocate,
which then gets passed to jl_bitcast unrooted. I believe it's
right about that.

While we're here, also fix what I believe is a typo (`ty` vs `v`).

src/runtime_intrinsics.c

@@ -78,8 +78,9 @@ JL_DLLEXPORT jl_value_t *jl_pointerset(jl_value_t *p, jl_value_t *x, jl_value_t
 JL_DLLEXPORT jl_value_t *jl_cglobal(jl_value_t *v, jl_value_t *ty)
 {
     JL_TYPECHK(cglobal, type, ty);
+    JL_GC_PUSH1(&v);
     jl_value_t *rt =
-        v == (jl_value_t*)jl_void_type ? (jl_value_t*)jl_voidpointer_type : // a common case
+        ty == (jl_value_t*)jl_void_type ? (jl_value_t*)jl_voidpointer_type : // a common case
             (jl_value_t*)jl_apply_type1((jl_value_t*)jl_pointer_type, ty);
 
     if (!jl_is_concrete_type(rt))
@@ -88,8 +89,11 @@ JL_DLLEXPORT jl_value_t *jl_cglobal(jl_value_t *v, jl_value_t *ty)
     if (jl_is_tuple(v) && jl_nfields(v) == 1)
         v = jl_fieldref(v, 0);
 
-    if (jl_is_pointer(v))
-        return jl_bitcast(rt, v);
+    if (jl_is_pointer(v)) {
+        v = jl_bitcast(rt, v);
+        JL_GC_POP();
+        return v;
+    }
 
     char *f_lib = NULL;
     if (jl_is_tuple(v) && jl_nfields(v) > 1) {
@@ -120,6 +124,7 @@ JL_DLLEXPORT jl_value_t *jl_cglobal(jl_value_t *v, jl_value_t *ty)
     jl_value_t *jv = jl_gc_alloc_1w();
     jl_set_typeof(jv, rt);
     *(void**)jl_data_ptr(jv) = ptr;
+    JL_GC_POP();
     return jv;
 }