Fix wrong write barrier on fields copy

Previously this write barrier was using the destination object as the
new parent, rather than the fields object.

Found by wbcheck

Author: jhawthorn

variable.c

@@ -2331,7 +2331,7 @@ rb_copy_generic_ivar(VALUE dest, VALUE obj)
         new_fields_obj = rb_imemo_fields_new(rb_obj_class(dest), RSHAPE_CAPACITY(dest_shape_id));
         VALUE *src_buf = rb_imemo_fields_ptr(fields_obj);
         VALUE *dest_buf = rb_imemo_fields_ptr(new_fields_obj);
-        rb_shape_copy_fields(dest, dest_buf, dest_shape_id, obj, src_buf, src_shape_id);
+        rb_shape_copy_fields(new_fields_obj, dest_buf, dest_shape_id, obj, src_buf, src_shape_id);
         RBASIC_SET_SHAPE_ID(new_fields_obj, dest_shape_id);
 
         RB_VM_LOCKING() {