Fix wrong write barrier on fields copy

Previously this write barrier was using the destination object as the
new parent, rather than the fields object.

Found by wbcheck
This commit is contained in:
John Hawthorn 2025-07-04 11:58:39 -07:00
parent 32453560de
commit 8cd5832694

View File

@ -2331,7 +2331,7 @@ rb_copy_generic_ivar(VALUE dest, VALUE obj)
new_fields_obj = rb_imemo_fields_new(rb_obj_class(dest), RSHAPE_CAPACITY(dest_shape_id));
VALUE *src_buf = rb_imemo_fields_ptr(fields_obj);
VALUE *dest_buf = rb_imemo_fields_ptr(new_fields_obj);
rb_shape_copy_fields(dest, dest_buf, dest_shape_id, obj, src_buf, src_shape_id);
rb_shape_copy_fields(new_fields_obj, dest_buf, dest_shape_id, obj, src_buf, src_shape_id);
RBASIC_SET_SHAPE_ID(new_fields_obj, dest_shape_id);
RB_VM_LOCKING() {