Fix missing write barrier in rb_vm_rewrite_cref

jhawthorn · jhawthorn · commit 1e436f22745c · 2025-06-24T20:02:30.000-07:00
Found by wbcheck
diff --git a/vm_insnhelper.c b/vm_insnhelper.c
@@ -975,7 +975,7 @@ rb_vm_rewrite_cref(rb_cref_t *cref, VALUE old_klass, VALUE new_klass)
 
     #define ADD_NEW_CREF(new_cref) \
         if (new_cref_tail) { \
-            new_cref_tail->next = new_cref; \
+            RB_OBJ_WRITE(new_cref_tail, &new_cref_tail->next, new_cref); \
         } else { \
             new_cref_head = new_cref; \
         } \
