--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -3082,16 +3082,34 @@ JS_DefineConstDoubles(JSContext* cx, Han
     return DefineConstScalar(cx, obj, cds);
 }
 JS_PUBLIC_API(bool)
 JS_DefineConstIntegers(JSContext* cx, HandleObject obj, const JSConstIntegerSpec* cis)
 {
     return DefineConstScalar(cx, obj, cis);
 }
 
+bool
+JSPropertySpec::getValue(JSContext* cx, MutableHandleValue vp) const
+{
+    MOZ_ASSERT(!isAccessor());
+
+    if (value.type == JSVAL_TYPE_STRING) {
+        RootedAtom atom(cx, Atomize(cx, value.string, strlen(value.string)));
+        if (!atom)
+            return false;
+        vp.setString(atom);
+    } else {
+        MOZ_ASSERT(value.type == JSVAL_TYPE_INT32);
+        vp.setInt32(value.int32);
+    }
+
+    return true;
+}
+
 static JS::SymbolCode
 PropertySpecNameToSymbolCode(const char* name)
 {
     MOZ_ASSERT(JS::PropertySpecNameIsSymbol(name));
     uintptr_t u = reinterpret_cast<uintptr_t>(name);
     return JS::SymbolCode(u - 1);
 }
 
@@ -3144,21 +3162,20 @@ JS_DefineProperties(JSContext* cx, Handl
                 if (!DefinePropertyById(cx, obj, id, JS::UndefinedHandleValue,
                                         ps->accessors.getter.native, ps->accessors.setter.native,
                                         ps->flags, 0))
                 {
                     return false;
                 }
             }
         } else {
-            RootedAtom atom(cx, Atomize(cx, ps->string.value, strlen(ps->string.value)));
-            if (!atom)
+            RootedValue v(cx);
+            if (!ps->getValue(cx, &v))
                 return false;
 
-            RootedValue v(cx, StringValue(atom));
             if (!DefinePropertyById(cx, obj, id, v, NativeOpWrapper(nullptr),
                                     NativeOpWrapper(nullptr), ps->flags & ~JSPROP_INTERNAL_USE_BIT, 0))
             {
                 return false;
             }
         }
     }
     return true;

--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@@ -1889,40 +1889,44 @@ typedef struct JSNativeWrapper {
  * are helper macros for defining such arrays.
  */
 struct JSPropertySpec {
     struct SelfHostedWrapper {
         void*       unused;
         const char* funname;
     };
 
-    struct StringValueWrapper {
-        void*       unused;
-        const char* value;
+    struct ValueWrapper {
+        uintptr_t   type;
+        union {
+            const char* string;
+            int32_t     int32;
+        };
     };
 
     const char*                 name;
     uint8_t                     flags;
     union {
         struct {
             union {
                 JSNativeWrapper    native;
                 SelfHostedWrapper  selfHosted;
             } getter;
             union {
                 JSNativeWrapper    native;
                 SelfHostedWrapper  selfHosted;
             } setter;
         } accessors;
-        StringValueWrapper         string;
+        ValueWrapper            value;
     };
 
     bool isAccessor() const {
         return !(flags & JSPROP_INTERNAL_USE_BIT);
     }
+    bool getValue(JSContext* cx, JS::MutableHandleValue value) const;
 
     bool isSelfHosted() const {
         MOZ_ASSERT(isAccessor());
 
 #ifdef DEBUG
         // Verify that our accessors match our JSPROP_GETTER flag.
         if (flags & JSPROP_GETTER)
             checkAccessorsAreSelfHosted();
@@ -1960,34 +1964,40 @@ namespace detail {
 /* NEVER DEFINED, DON'T USE.  For use by JS_CAST_NATIVE_TO only. */
 inline int CheckIsNative(JSNative native);
 
 /* NEVER DEFINED, DON'T USE.  For use by JS_CAST_STRING_TO only. */
 template<size_t N>
 inline int
 CheckIsCharacterLiteral(const char (&arr)[N]);
 
+/* NEVER DEFINED, DON'T USE.  For use by JS_CAST_INT32_TO only. */
+inline int CheckIsInt32(int32_t value);
+
 /* NEVER DEFINED, DON'T USE.  For use by JS_PROPERTYOP_GETTER only. */
 inline int CheckIsGetterOp(JSGetterOp op);
 
 /* NEVER DEFINED, DON'T USE.  For use by JS_PROPERTYOP_SETTER only. */
 inline int CheckIsSetterOp(JSSetterOp op);
 
-
 } // namespace detail
 } // namespace JS
 
 #define JS_CAST_NATIVE_TO(v, To) \
   (static_cast<void>(sizeof(JS::detail::CheckIsNative(v))), \
    reinterpret_cast<To>(v))
 
 #define JS_CAST_STRING_TO(s, To) \
   (static_cast<void>(sizeof(JS::detail::CheckIsCharacterLiteral(s))), \
    reinterpret_cast<To>(s))
 
+#define JS_CAST_INT32_TO(s, To) \
+  (static_cast<void>(sizeof(JS::detail::CheckIsInt32(s))), \
+   reinterpret_cast<To>(s))
+
 #define JS_CHECK_ACCESSOR_FLAGS(flags) \
   (static_cast<mozilla::EnableIf<((flags) & ~(JSPROP_ENUMERATE | JSPROP_PERMANENT)) == 0>::Type>(0), \
    (flags))
 
 #define JS_PROPERTYOP_GETTER(v) \
   (static_cast<void>(sizeof(JS::detail::CheckIsGetterOp(v))), \
    reinterpret_cast<JSNative>(v))
 
@@ -1997,24 +2007,26 @@ inline int CheckIsSetterOp(JSSetterOp op
 
 #define JS_STUBGETTER JS_PROPERTYOP_GETTER(JS_PropertyStub)
 
 #define JS_STUBSETTER JS_PROPERTYOP_SETTER(JS_StrictPropertyStub)
 
 #define JS_PS_ACCESSOR_SPEC(name, getter, setter, flags, extraFlags) \
     { name, uint8_t(JS_CHECK_ACCESSOR_FLAGS(flags) | extraFlags), \
       { {  getter, setter  } } }
-#define JS_PS_STRINGVALUE_SPEC(name, value, flags) \
+#define JS_PS_VALUE_SPEC(name, value, flags) \
     { name, uint8_t(flags | JSPROP_INTERNAL_USE_BIT), \
-      { { STRINGVALUE_WRAPPER(value), JSNATIVE_WRAPPER(nullptr) } } }
+      { { value, JSNATIVE_WRAPPER(nullptr) } } }
 
 #define SELFHOSTED_WRAPPER(name) \
     { { nullptr, JS_CAST_STRING_TO(name, const JSJitInfo*) } }
 #define STRINGVALUE_WRAPPER(value) \
-    { { nullptr, JS_CAST_STRING_TO(value, const JSJitInfo*) } }
+    { { reinterpret_cast<JSNative>(JSVAL_TYPE_STRING), JS_CAST_STRING_TO(value, const JSJitInfo*) } }
+#define INT32VALUE_WRAPPER(value) \
+    { { reinterpret_cast<JSNative>(JSVAL_TYPE_INT32), JS_CAST_INT32_TO(value, const JSJitInfo*) } }
 
 /*
  * JSPropertySpec uses JSNativeWrapper.  These macros encapsulate the definition
  * of JSNative-backed JSPropertySpecs, by defining the JSNativeWrappers for
  * them.
  */
 #define JS_PSG(name, getter, flags) \
     JS_PS_ACCESSOR_SPEC(name, JSNATIVE_WRAPPER(getter), JSNATIVE_WRAPPER(nullptr), flags, \
@@ -2028,20 +2040,22 @@ inline int CheckIsSetterOp(JSSetterOp op
 #define JS_SELF_HOSTED_GETSET(name, getterName, setterName, flags) \
     JS_PS_ACCESSOR_SPEC(name, SELFHOSTED_WRAPPER(getterName), SELFHOSTED_WRAPPER(setterName), \
                          flags, JSPROP_SHARED | JSPROP_GETTER | JSPROP_SETTER)
 #define JS_SELF_HOSTED_SYM_GET(symbol, getterName, flags) \
     JS_PS_ACCESSOR_SPEC(reinterpret_cast<const char*>(uint32_t(::JS::SymbolCode::symbol) + 1), \
                          SELFHOSTED_WRAPPER(getterName), JSNATIVE_WRAPPER(nullptr), flags, \
                          JSPROP_SHARED | JSPROP_GETTER)
 #define JS_STRING_PS(name, string, flags) \
-    JS_PS_STRINGVALUE_SPEC(name, string, flags)
+    JS_PS_VALUE_SPEC(name, STRINGVALUE_WRAPPER(string), flags)
 #define JS_STRING_SYM_PS(symbol, string, flags) \
-    JS_PS_STRINGVALUE_SPEC(reinterpret_cast<const char*>(uint32_t(::JS::SymbolCode::symbol) + 1), \
-                           string, flags)
+    JS_PS_VALUE_SPEC(reinterpret_cast<const char*>(uint32_t(::JS::SymbolCode::symbol) + 1), \
+                     STRINGVALUE_WRAPPER(string), flags)
+#define JS_INT32_PS(name, value, flags) \
+    JS_PS_VALUE_SPEC(name, INT32VALUE_WRAPPER(value), flags)
 #define JS_PS_END \
     JS_PS_ACCESSOR_SPEC(nullptr, JSNATIVE_WRAPPER(nullptr), JSNATIVE_WRAPPER(nullptr), 0, 0)
 
 /**
  * To define a native function, set call to a JSNativeWrapper. To define a
  * self-hosted function, set selfHostedName to the name of a function
  * compiled during JSRuntime::initSelfHosting.
  */

--- a/js/xpconnect/wrappers/XrayWrapper.cpp
+++ b/js/xpconnect/wrappers/XrayWrapper.cpp
@@ -426,20 +426,20 @@ TryResolvePropertyFromSpecs(JSContext* c
             } else {
                 desc.setGetter(JS_CAST_NATIVE_TO(psMatch->accessors.getter.native.op,
                                                  JSGetterOp));
                 desc.setSetter(JS_CAST_NATIVE_TO(psMatch->accessors.setter.native.op,
                                                  JSSetterOp));
             }
             desc.setAttributes(flags);
         } else {
-            RootedString atom(cx, JS_AtomizeString(cx, psMatch->string.value));
-            if (!atom)
+            RootedValue v(cx);
+            if (!psMatch->getValue(cx, &v))
                 return false;
-            desc.value().setString(atom);
+            desc.value().set(v);
             desc.setAttributes(flags & ~JSPROP_INTERNAL_USE_BIT);
         }
 
         // The generic Xray machinery only defines non-own properties on the holder.
         // This is broken, and will be fixed at some point, but for now we need to
         // cache the value explicitly. See the corresponding call to
         // JS_GetPropertyById at the top of JSXrayTraits::resolveOwnProperty.
         //