Bug 858084 - upload a new talos.zip to to fix the mozcrash issue. r=armenzg
Bug 857576 - Make sure isOwnProperty() method of the input typeset's single typeobject's property typeset is run before main body of IonBuilder::jsop_getprop method. r=bhackett