Bug 858617: Add testcase, r=testcase
Bug 861165: IonMonkey: Correct behaviour for JSOP_IN on dense native with negative index, r=bhackett
Bug 862357: IonMonkey: Box undefined inputs in the compare policy, r=nbp
Bug 862100: IonMonkey: AddTypeBarrier shouldn't unbox, when type is already double, r=nbp
Bug 861116: IonBuilder: Add support for JSOP_INITELEM, r=jandem