Bug 1077041 - NativeObject::copy, Only copy the minimum between the number of fixed slot and the span of the shape. r=jandem
Bug 1077427 - Add range analysis assertions after recovered-on-bailout instructions. r=sunfish