Bug 804676 - Remove dependence of Ion compilation on ScriptAnalysis::analyzeTypes.
Bug 804676 - Fix various fuzz bugs.
Bug 861419 - Consider values in prototype when reading global names during Ion compilation.
Bug 861439 - Add type barriers when reading from undefined properties of singleton objects.
Merge m-i to ionmonkey
Bug 862103 - Various benchmark performance fixes.
Bug 862699, bug 862708 - Fix a couple of fuzz bugs.
Bug 804676 - Address review comments, r=dvander.
Bug 862103 - Address review comments, r=jandem.
Bug 862184 - Don't check for extra parallel array bailouts if --no-baseline or --baseline-eager are used.
Merge from mozilla-inbound.
Bug 863439 - Use BoxInputsPolicy for MUnbox.
Bug 861419 - Add comment, r=dvander.
Bug 863518 - Consider types added by loop body when unboxing OSR values, r=dvander.
Merge from mozilla-inbound
Bug 858459 - Ignore clicks that have no target content or frame to avoid dispatching it to the document that the pres shell otherwise does.  r=smaug
Bug 863120 - Make RootAccessibleWrap.mm #include header files for layout things it uses.  r=surkov
Bug 855898 - Limit ProcessChildren recursion depth to avoid exhausting stack space and crashing.  r=bzbarsky
Merge from mozilla-inbound