Backed out changeset 97163e4941f2 (bug 869507) for checktest assertions and crashes.
CLOSED TREE
Bug 224315 - Poor grammar in 'is a:' message on unknown content type window. r=jaws
Bug 863808 - Implement a store buffer for marking whole objects. r=billm
Bug 868610 - Do not use the arena header when cloning object literals. r=billm
Bug 869222 - Allow GC things embedded in IonScript to move. r=dvander

IonScripts normally live as long as their owner JSScript; however, they can
occasionally get destroyed outside the context of a GC by FinishInvalidationOf.
Because of this case, we cannot use the normal store buffer to guard them.
Instead we use the generic buffer to mark the owner script, which will mark the
IonScript's fields, if it is still alive.
Bug 869234 - No need for barriers on the LIR constant pool. r=bhackett
Bug 867863.  Be a little more careful in GlobalObject initialization.  r=peterv
Bug 869040.  Fix ion IC for non-overridebuiltins named gets on ListBase proxies to not cache lack of a property when it's just missing on the prototype.  r=djvj
Bug 868342 - (Part 1) Fix NPE in BrowserToolbar.setTitle. r=wesj
Bug 868342 - (Part 2) Get rid of displayTitle variable. r=wesj