diff --git a/js/src/jsapi.h b/js/src/jsapi.h
index 3c5c678abc2..21d333f1b36 100644
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -2869,7 +2869,7 @@ struct JSClass {
  * with the following flags. Failure to use JSCLASS_GLOBAL_FLAGS was
  * prevously allowed, but is now an ES5 violation and thus unsupported.
  */
-#define JSCLASS_GLOBAL_SLOT_COUNT      (JSProto_LIMIT * 3 + 26)
+#define JSCLASS_GLOBAL_SLOT_COUNT      (JSProto_LIMIT * 3 + 25)
 #define JSCLASS_GLOBAL_FLAGS_WITH_SLOTS(n)                                    \
     (JSCLASS_IS_GLOBAL | JSCLASS_HAS_RESERVED_SLOTS(JSCLASS_GLOBAL_SLOT_COUNT + (n)))
 #define JSCLASS_GLOBAL_FLAGS                                                  \
diff --git a/js/src/jsbool.cpp b/js/src/jsbool.cpp
index 7569cc1794b..8b78a91dca3 100644
--- a/js/src/jsbool.cpp
+++ b/js/src/jsbool.cpp
@@ -172,8 +172,6 @@ js_InitBooleanClass(JSContext *cx, HandleObject obj)
         return NULL;
     }
 
-    global->setBooleanValueOf(valueOf);
-
     if (!DefineConstructorAndPrototype(cx, global, JSProto_Boolean, ctor, booleanProto))
         return NULL;
 
@@ -196,16 +194,16 @@ js::ToBooleanSlow(const Value &v)
     return !EmulatesUndefined(&v.toObject());
 }
 
+/*
+ * This slow path is only ever taken for Boolean objects from other
+ * compartments. The only caller of the fast path, JSON's PreprocessValue,
+ * makes sure of that.
+ */
 bool
-js::BooleanGetPrimitiveValueSlow(JSContext *cx, HandleObject obj, Value *vp)
+js::BooleanGetPrimitiveValueSlow(HandleObject wrappedBool, JSContext *cx)
 {
-    InvokeArgsGuard ag;
-    if (!cx->stack.pushInvokeArgs(cx, 0, &ag))
-        return false;
-    ag.setCallee(cx->compartment()->maybeGlobal()->booleanValueOf());
-    ag.setThis(ObjectValue(*obj));
-    if (!Invoke(cx, ag))
-        return false;
-    *vp = ag.rval();
-    return true;
+    JS_ASSERT(wrappedBool->isCrossCompartmentWrapper());
+    JSObject *obj = Wrapper::wrappedObject(wrappedBool);
+    JS_ASSERT(obj);
+    return obj->asBoolean().unbox();
 }
diff --git a/js/src/jsbool.h b/js/src/jsbool.h
index 0d847ec3051..7d5cc65efcb 100644
--- a/js/src/jsbool.h
+++ b/js/src/jsbool.h
@@ -21,7 +21,7 @@ js_BooleanToString(JSContext *cx, JSBool b);
 
 namespace js {
 
-inline bool
+inline void
 BooleanGetPrimitiveValue(JSContext *cx, HandleObject obj, Value *vp);
 
 } /* namespace js */
diff --git a/js/src/jsboolinlines.h b/js/src/jsboolinlines.h
index 52d3d3f6aca..289a0413baa 100644
--- a/js/src/jsboolinlines.h
+++ b/js/src/jsboolinlines.h
@@ -16,17 +16,15 @@
 
 namespace js {
 
-bool BooleanGetPrimitiveValueSlow(JSContext *, HandleObject, Value *);
+bool BooleanGetPrimitiveValueSlow(HandleObject, JSContext *);
 
-inline bool
+inline void
 BooleanGetPrimitiveValue(JSContext *cx, HandleObject obj, Value *vp)
 {
-    if (obj->isBoolean()) {
+    if (obj->isBoolean())
         *vp = BooleanValue(obj->asBoolean().unbox());
-        return true;
-    }
 
-    return BooleanGetPrimitiveValueSlow(cx, obj, vp);
+    vp->setBoolean(BooleanGetPrimitiveValueSlow(obj, cx));
 }
 
 inline bool
diff --git a/js/src/json.cpp b/js/src/json.cpp
index 2f60a17827b..e19384912e2 100644
--- a/js/src/json.cpp
+++ b/js/src/json.cpp
@@ -278,8 +278,7 @@ PreprocessValue(JSContext *cx, HandleObject holder, KeyType key, MutableHandleVa
                 return false;
             vp.set(StringValue(str));
         } else if (ObjectClassIs(obj, ESClass_Boolean, cx)) {
-            if (!BooleanGetPrimitiveValue(cx, obj, vp.address()))
-                return false;
+            BooleanGetPrimitiveValue(cx, obj, vp.address());
             JS_ASSERT(vp.get().isBoolean());
         }
     }
diff --git a/js/src/vm/GlobalObject-inl.h b/js/src/vm/GlobalObject-inl.h
index 9eca6e12958..845daad5d76 100644
--- a/js/src/vm/GlobalObject-inl.h
+++ b/js/src/vm/GlobalObject-inl.h
@@ -58,13 +58,6 @@ GlobalObject::setCreateArrayFromBufferHelper(uint32_t slot, Handle<JSFunction*>
     setSlot(slot, ObjectValue(*fun));
 }
 
-void
-GlobalObject::setBooleanValueOf(Handle<JSFunction*> valueOfFun)
-{
-    JS_ASSERT(getSlotRef(BOOLEAN_VALUEOF).isUndefined());
-    setSlot(BOOLEAN_VALUEOF, ObjectValue(*valueOfFun));
-}
-
 void
 GlobalObject::setCreateDataViewForThis(Handle<JSFunction*> fun)
 {
diff --git a/js/src/vm/GlobalObject.h b/js/src/vm/GlobalObject.h
index 4e490aa0a27..8c46ae8db67 100644
--- a/js/src/vm/GlobalObject.h
+++ b/js/src/vm/GlobalObject.h
@@ -66,8 +66,7 @@ class GlobalObject : public JSObject
     static const unsigned STANDARD_CLASS_SLOTS  = JSProto_LIMIT * 3;
 
     /* Various function values needed by the engine. */
-    static const unsigned BOOLEAN_VALUEOF         = STANDARD_CLASS_SLOTS;
-    static const unsigned EVAL                    = BOOLEAN_VALUEOF + 1;
+    static const unsigned EVAL                    = STANDARD_CLASS_SLOTS;
     static const unsigned CREATE_DATAVIEW_FOR_THIS = EVAL + 1;
     static const unsigned THROWTYPEERROR          = CREATE_DATAVIEW_FOR_THIS + 1;
     static const unsigned PROTO_GETTER            = THROWTYPEERROR + 1;
@@ -194,7 +193,6 @@ class GlobalObject : public JSObject
 
   public:
     /* XXX Privatize me! */
-    inline void setBooleanValueOf(Handle<JSFunction*> valueOfFun);
     inline void setCreateDataViewForThis(Handle<JSFunction*> fun);
 
     template<typename T>
@@ -398,11 +396,6 @@ class GlobalObject : public JSObject
         return &getSlot(THROWTYPEERROR).toObject();
     }
 
-    Value booleanValueOf() const {
-        JS_ASSERT(booleanClassInitialized());
-        return getSlot(BOOLEAN_VALUEOF);
-    }
-
     Value createDataViewForThis() const {
         JS_ASSERT(dataViewClassInitialized());
         return getSlot(CREATE_DATAVIEW_FOR_THIS);