Bug 1352532 - Part 1: Allow wrapper cache to handle changing a nursery wrapper to another nursery wrapper r=smaug

Previously this situation didn't arise and the existing code calls
NurseryWrapperAdded multiple times with the same wrapper in this case. This
causes assertion failures when the nursery wrapper list is processed later on.

Differential Revision: https://phabricator.services.mozilla.com/D146804

dom/base/nsWrapperCache.cpp

@@ -33,11 +33,16 @@ void nsWrapperCache::HoldJSObjects(void* aScriptObjectHolder,
   }
 }
 
-void nsWrapperCache::SetWrapperJSObject(JSObject* aWrapper) {
-  mWrapper = aWrapper;
+static inline bool IsNurseryWrapper(JSObject* aWrapper) {
+  return aWrapper && !JS::ObjectIsTenured(aWrapper);
+}
+
+void nsWrapperCache::SetWrapperJSObject(JSObject* aNewWrapper) {
+  JSObject* oldWrapper = mWrapper;
+  mWrapper = aNewWrapper;
   UnsetWrapperFlags(kWrapperFlagsMask);
 
-  if (aWrapper && !JS::ObjectIsTenured(aWrapper)) {
+  if (IsNurseryWrapper(aNewWrapper) && !IsNurseryWrapper(oldWrapper)) {
     CycleCollectedJSRuntime::Get()->NurseryWrapperAdded(this);
   }
 }