Bug 1857730 - Relax nursery poisioning assertion r=sfink

The refactored assertions were actually slightly more strict that the original
ones and it turns out that we can pass start == end here.

Differential Revision: https://phabricator.services.mozilla.com/D190447

js/src/gc/Nursery.cpp

@@ -119,7 +119,7 @@ inline void js::NurseryChunk::poisonRange(size_t start, size_t end,
                                           MemCheckKind checkKind) {
   MOZ_ASSERT((start % gc::CellAlignBytes) == 0);
   MOZ_ASSERT((end % gc::CellAlignBytes) == 0);
-  MOZ_ASSERT(end > start);
+  MOZ_ASSERT(end >= start);
   MOZ_ASSERT(end <= ChunkSize);
 
   auto* ptr = reinterpret_cast<uint8_t*>(this) + start;