- Backport of Mozilla Bug 1500759 - Root parameter dictionaries in AesTask::Init() r=keeler a=abillings (1cddfcec4)
- Better scoping for code in IDBObjectStore::GetAddInfo. (bcfce71cb)
- backport of Mozilla Bug 1507907 - null check result of CFDateFormatterCreate (a68b23bec)
- backport of Mozilla Bug 1505181 - Use canonical function in TypeNewScript::rollbackPartiallyInitializedObjects (ffc7b3714)
- Backport of Mozilla Bug 1506640 - Trace wrappers rooters during sweep phase (16af4fd05)
- Backport Mozilla Bug 1245024 (b399b918f)
- Backport mozilla Bug 1279303 - Implement change to O.getOwnPropertyDescriptors and update tests (314c7cc76)
- Backport of mozilla Bug 1416774 - Ensure that imgRequestProxy::CancelAndForgetObserver removes itself from the cache validator + Some necessary other dependent backports (a0faf6ec4)
- emable hasInstace among well known symbols (bfd9210d5)
- add InstaceOfOperator (3c391b52c)
- provide ReportValueError for newer code retaining for now js_ReportValueError (279617b0b)
- backport of Mozilla Bug 1054906 - Implement ES6 Symbol.hasInstance (b778ff1d0)
- add testfile for Bug 1278599 - Function[Symbol.hasInstance] should return false when called with a non-callable 'this' (782d21b60)
- Mozilla backport Bug 1252228 - Fix heuristic in PropertyReadNeedsTypeBarrier to avoid bogus type information (2415d5ecf)
- refactor js_ReportValueError to ReportValueError as FF code to better import patches, the actual function itself needs some updating (7029d375b)
- Backport of Mozilla Bug 1492823 - Ensure user input suppression works correctly even after document.open. (e915368c5)
- Backport of Mozilla bug 1496340 - make sure each nsISupports is an nsIX509Cert in nsNSSCertList::Read (45af216f3)
- Backport of Mozilla Bug 1492524 (b0b14f5d4)
- backport of mozilla Bug 1423278 - Correctly instantiate proxy authenticator with a lowercase schema (6acbed687)
- Backport of mozilla Bug 1487098 - Reorder boolean expression to take advantage of short-circuiting (92ac69111)
- Backport of Mozilla Bug 1493347: Drop DataChannelListener on Destroy() (2469aad46)
- first add _setCanonicalName and then apply Mozilla Bug Bug 1236638 - Add JSFunction::setAtom and use it in _SetCanonicalName intrinsic to fire the pre-barrier (3405e66a5)
- Backport of Mozilla Bug 1226762 - Add support for getting original builtin constructors and prototypes in self-hosted code. (a67be4304)