missing gc-root store in subtype (#56472)

Fixes #56141
Introduced by #52228 (a624d44)

(cherry picked from commit 671cd5e)

Author: vtjnash

src/subtype.c

@@ -4641,12 +4641,12 @@ static jl_value_t *insert_nondiagonal(jl_value_t *type, jl_varbinding_t *troot,
         jl_value_t *n = jl_unwrap_vararg_num(type);
         if (widen2ub == 0)
             widen2ub = !(n && jl_is_long(n)) || jl_unbox_long(n) > 1;
-        jl_value_t *newt;
-        JL_GC_PUSH2(&newt, &n);
-        newt = insert_nondiagonal(t, troot, widen2ub);
-        if (t != newt)
+        jl_value_t *newt = insert_nondiagonal(t, troot, widen2ub);
+        if (t != newt) {
+            JL_GC_PUSH1(&newt);
             type = (jl_value_t *)jl_wrap_vararg(newt, n, 0, 0);
-        JL_GC_POP();
+            JL_GC_POP();
+        }
     }
     else if (jl_is_datatype(type)) {
         if (jl_is_tuple_type(type)) {
@@ -4683,7 +4683,7 @@ static jl_value_t *_widen_diagonal(jl_value_t *t, jl_varbinding_t *troot) {
 static jl_value_t *widen_diagonal(jl_value_t *t, jl_unionall_t *u, jl_varbinding_t *troot)
 {
     jl_varbinding_t vb = { u->var, NULL, NULL, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, NULL, troot };
-    jl_value_t *nt;
+    jl_value_t *nt = NULL;
     JL_GC_PUSH2(&vb.innervars, &nt);
     if (jl_is_unionall(u->body))
         nt = widen_diagonal(t, (jl_unionall_t *)u->body, &vb);