Backout 04695ce03bb6 (bug 836968) for topcrashing on a CLOSED TREE
Merge inbound and m-c
Bug 829456 - Update browser-fullZoom.js to use nsIContentPrefService2. r=mak
Bug 851090 - Make <input type=range> fire change/input events as appropriate. r=mounir.
Bug 836968 - Cache shapes for JSON objects and assign types to constructed JSON objects and arrays, r=waldo,jandem.