This is actually the patch at bug 1817385 comment 1 and comment 4.

Wasm{Array,Struct}Objects may be freely nursery-allocated, hence enjoying the
benefits of generational GC. However, those with out-of-line storage in the
C++ heap (called "trailer blocks" in the patch) have those blocks managed by
js_malloc/js_free. This is expensive, and especially for objects which don't
get tenured, undercuts the benefit gained from generational GC.

This patch adds to js::Nursery, two new mechanisms:

• a cache of blocks, js::gc::MallocedBlockCache, which are suitable for use as
  trailers. Allocation and freeing of trailers is done mostly from this
  cache. A supporting type, js::PointerAndUint7, has also been added, as
  extra data (a freelist ID) is needed when returning blocks to the cache.

• a more limited version of the existing Nursery::mallocedBuffers mechanism.
  The goal is the same -- to enumerate the subtraction of sets of allocated vs
  tenured trailer blocks, at the end of minor GC. The new version differs in
  that (1) it tracks PointerAndUint7, not void*s, (2) block resizing is not
  supported, and (3) the difference is computed via vector comparison rather
  than a hash set, for performance reasons.

An SMDOC explaining the mechanisms in detail has been added to WasmGcObject.cpp.

https://hg.mozilla.org/mozilla-central/rev/596e62e6b969