Bug 861165: IonMonkey: Correct behaviour for JSOP_IN on dense native with negative index, r=bhackett
Bug 861116: IonBuilder: Add support for JSOP_INITELEM, r=jandem
Bug 841941 - Add a mochitest to check that the order in which @value/@min/@max/@step are specified in markup makes no difference to the value that <input type=range> will be given. r=mounir