Bug 931489 - IonMonkey: Use range analysis to avoid testing for special cases in PowHalf. r=nbp
Bug 933104 - IonMonkey: Check for empty ranges after intersecting fractional ranges. r=nbp
Bug 936891 - IonMonkey: Fix safepoint handling to mind the differences between LSRA and Backtracking. r=bhackett
Bug 936993 - IonMonkey: Create the MCheckOverRecursed before unboxing arguments. r=bhackett
Bug 937121 - IonMonkey: Improved register allocation debug output. r=bhackett
Bug 937121 - IonMonkey: Assert some interesting invariants. r=bhackett
Bug 937124 - IonMonkey: Backtracking: expose the considerCopy flag to isRegisterUse to allow trySplitAfterLastRegisterUse to use it. r=bhackett
Bug 937128 - IonMonkey: Minor code simplifications. r=bhackett
Bug 914190 - Use std::getline instead of C getline to parse /proc/N/maps. r=BenWa

Android's C getline (present in JB and up) calls libc's malloc directly,
but its caller in Gecko is linked to jemalloc's free via mozglue; this
caused a crash on profiler startup.
Bug 932276 - Reserve space in JSScript for an optional block scope array. r=jorendorff
Bug 932276 - Bytecode emitter records static scope extents. r=jorendorff
Bug 932276 - Reimplement GetBlockChainAtPC using JSScript::blockScopes(). r=jorendorff
Bug 932500 - PathD2D::TransformedCopyToBuilder ignores even odd fill. r=Bas