check that setTimeout/setInterval handler is an object before casting to an object (62476f5)
ensure retrieving the property definitions of ObjectStoreEntry.prototype.body and ObjectStoreEntry.bodyUsed do not cause panics by ensuring we have a valid entry in their Slots (311b84c)
error message is latin1, we need to use JS_ReportErrorLatin1 to convert the message from latin1 to UTF8CharsZ, otherwise a panic occurs (f1a22a4)
when appending headers, if the set-cookie header is set then make sure that each cookie value is sent as a separate set-cookie header to the host (f6cf559)