Bug 986678 - Fix type check in TryAddTypeBarrierForWrite. r=bhackett, a=1.2.x+
Bug 986843 - Replace AutoHoldZone with AutoCompartmentRooter. r=terrence, a=1.2.x+
Bug 919592 - Ionmonkey (ARM): Guard against branches being out of range and bail out of compilation if so. r=mjrosenb, a=1.2.x+
Bug 966006 - Prevent race when accessing mBlacklistedItems. r=mcmanus, a=1.2.x+
Bug 981239 - Use atomic ref-counting for |UnixSocketConsumer|. r=kyle, a=1.2.x+

|SocketSendTask| acquires a reference to |UnixSocketConsumer| on
the main thread and releases this reference on the I/O thread;
leading to race-conditions. This patch adds

  - atomicity for ref-counting of |UnixSocketConsumer|, and
  - stricter tests in the destructor of this class.
Bug 995041 - Properly disable the problematic portions of browser_aboutHome.js and enable the dependent tests. a=test-only
Bug 992270 - ignoreAllUncaughtExceptions in the about:home test of browser_google_behavior.js. r=gavin, a=test-only
No Bug - Fix browser_net_timing-division.js leak when run as the last test on a CLOSED TREE. rs=past, a=test-only
Bug 944353 - If we've encountered an error while decoding an image and the main thread has asked to do more decoding of that image before the main thread has acknowledged the error then refuse to decode more. r=seth, a=1.2.x+
Bug 944353 - If we've had a decoder error then the image is not usable. r=seth, a=1.2.x+

This matches what RasterImage will do.
Bug 969226 - Check if there is enough data to read u32 to avoid buffer overflow. r=bgirard, a=1.2.x+
Bug 991471 - Fix offset when setting host on URL. r=mcmanus, a=1.2.x+
Merge b2g26 to v1.2f. a=merge