Bug 873718 - Add a second argument to MakeConstructible, a value to be set as .prototype on the function.  This ensures that .prototype is always an object, and that |new|ing the function will never invoke user-defined code trying to access the .prototype (and possibly hitting such a property along the prototype chain).  r=till

--HG--
extra : rebase_source : 039448500590360f99e24350fdaa8da4c17f9487
Bug 816033 - Convert a jstest for hash table init with a really huge number to a jsapi-test, to avoid mega-tests taking forever and a day to run.  Also add operation callbacks to the JSON.stringify replacer-is-array loop, and cap the initial size of the HashSet used to store property names extracted from the replacer array.  (It'll grow naturally if extra elements are added.)  r=luke

--HG--
extra : rebase_source : ec150c815c0c7003508a103edd45ec5f570603f3