--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -5377,25 +5377,21 @@ EmitCallOrNew(JSContext *cx, BytecodeEmi
             ParseNode *funNode = pn2->pn_next;
             while (funNode->pn_next)
                 funNode = funNode->pn_next;
             if (!EmitTree(cx, bce, funNode))
                 return false;
             ParseNode *receiver = pn2->pn_next;
             if (!EmitTree(cx, bce, receiver))
                 return false;
-            if (Emit1(cx, bce, JSOP_NOTEARG) < 0)
-                return false;
             bool oldEmittingForInit = bce->emittingForInit;
             bce->emittingForInit = false;
             for (ParseNode *argpn = receiver->pn_next; argpn != funNode; argpn = argpn->pn_next) {
                 if (!EmitTree(cx, bce, argpn))
                     return false;
-                if (Emit1(cx, bce, JSOP_NOTEARG) < 0)
-                    return false;
             }
             bce->emittingForInit = oldEmittingForInit;
             argc -= 2;
             emitArgs = false;
             break;
         }
         if (!EmitNameOp(cx, bce, pn2, callop))
             return false;

--- a/js/src/ion/CodeGenerator.cpp
+++ b/js/src/ion/CodeGenerator.cpp
@@ -770,26 +770,16 @@ CodeGenerator::visitCallDOMNative(LCallD
     // Move the StackPointer back to its original location, unwinding the native exit frame.
     masm.adjustStack(IonDOMMethodExitFrameLayout::Size() - unusedStack);
     JS_ASSERT(masm.framePushed() == initialStack);
 
     dropArguments(call->numStackArgs() + 1);
     return true;
 }
 
-bool
-CodeGenerator::visitCallGetIntrinsicValue(LCallGetIntrinsicValue *lir)
-{
-    typedef bool (*pf)(JSContext *cx, HandlePropertyName, MutableHandleValue);
-    static const VMFunction Info = FunctionInfo<pf>(GetIntrinsicValue);
-
-    pushArg(ImmGCPtr(lir->mir()->name()));
-    return callVM(Info, lir);
-}
-
 typedef bool (*InvokeFunctionFn)(JSContext *, JSFunction *, uint32, Value *, Value *);
 static const VMFunction InvokeFunctionInfo =
     FunctionInfo<InvokeFunctionFn>(InvokeFunction);
 
 bool
 CodeGenerator::emitCallInvokeFunction(LInstruction *call, Register calleereg,
                                       uint32 argc, uint32 unusedStack)
 {

--- a/js/src/ion/CodeGenerator.h
+++ b/js/src/ion/CodeGenerator.h
@@ -170,17 +170,16 @@ class CodeGenerator : public CodeGenerat
     bool emitInstanceOf(LInstruction *ins, Register rhs);
     bool visitIn(LIn *ins);
     bool visitInstanceOfO(LInstanceOfO *ins);
     bool visitInstanceOfV(LInstanceOfV *ins);
     bool visitFunctionBoundary(LFunctionBoundary *lir);
     bool visitGetDOMProperty(LGetDOMProperty *lir);
     bool visitSetDOMProperty(LSetDOMProperty *lir);
     bool visitCallDOMNative(LCallDOMNative *lir);
-    bool visitCallGetIntrinsicValue(LCallGetIntrinsicValue *lir);
 
     bool visitCheckOverRecursed(LCheckOverRecursed *lir);
     bool visitCheckOverRecursedFailure(CheckOverRecursedFailure *ool);
 
     bool visitUnboxDouble(LUnboxDouble *lir);
     bool visitOutOfLineUnboxDouble(OutOfLineUnboxDouble *ool);
     bool visitOutOfLineStoreElementHole(OutOfLineStoreElementHole *ool);
 

--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -958,23 +958,16 @@ IonBuilder::inspectOpcode(JSOp op)
 
       case JSOP_NAME:
       case JSOP_CALLNAME:
       {
         RootedPropertyName name(cx, info().getAtom(pc)->asPropertyName());
         return jsop_getname(name);
       }
 
-      case JSOP_INTRINSICNAME:
-      case JSOP_CALLINTRINSIC:
-      {
-        RootedPropertyName name(cx, info().getAtom(pc)->asPropertyName());
-        return jsop_intrinsicname(name);
-      }
-
       case JSOP_BINDNAME:
         return jsop_bindname(info().getName(pc));
 
       case JSOP_DUP:
         current->pushSlot(current->stackDepth() - 1);
         return true;
 
       case JSOP_DUP2:
@@ -4747,52 +4740,16 @@ IonBuilder::jsop_getname(HandlePropertyN
     types::StackTypeSet *barrier = oracle->propertyReadBarrier(script_, pc);
     types::StackTypeSet *types = oracle->propertyRead(script_, pc);
 
     monitorResult(ins, barrier, types);
     return pushTypeBarrier(ins, types, barrier);
 }
 
 bool
-IonBuilder::jsop_intrinsicname(HandlePropertyName name)
-{
-    types::StackTypeSet *types = oracle->propertyRead(script_, pc);
-    JSValueType type = types->getKnownTypeTag();
-
-    // If we haven't executed this opcode yet, we need to get the intrinsic
-    // value and monitor the result.
-    if (type == JSVAL_TYPE_UNKNOWN) {
-        MCallGetIntrinsicValue *ins = MCallGetIntrinsicValue::New(name);
-
-        current->add(ins);
-        current->push(ins);
-
-        if (!resumeAfter(ins))
-            return false;
-
-        types::StackTypeSet *barrier = oracle->propertyReadBarrier(script_, pc);
-        monitorResult(ins, barrier, types);
-        return pushTypeBarrier(ins, types, barrier);
-    }
-
-    // Bake in the intrinsic. Make sure that TI agrees with us on the type.
-    RootedValue vp(cx, UndefinedValue());
-    if (!cx->global()->getIntrinsicValue(cx, name, &vp))
-        return false;
-
-    JS_ASSERT(types->hasType(types::GetValueType(cx, vp)));
-
-    MConstant *ins = MConstant::New(vp);
-    current->add(ins);
-    current->push(ins);
-
-    return true;
-}
-
-bool
 IonBuilder::jsop_bindname(PropertyName *name)
 {
     JS_ASSERT(script_->analysis()->usesScopeChain());
 
     MDefinition *scopeChain = current->scopeChain();
     MBindNameCache *ins = MBindNameCache::New(scopeChain, name, script_, pc);
 
     current->add(ins);

--- a/js/src/ion/IonBuilder.h
+++ b/js/src/ion/IonBuilder.h
@@ -319,17 +319,16 @@ class IonBuilder : public MIRGenerator
     bool jsop_ifeq(JSOp op);
     bool jsop_andor(JSOp op);
     bool jsop_dup2();
     bool jsop_loophead(jsbytecode *pc);
     bool jsop_compare(JSOp op);
     bool jsop_getgname(HandlePropertyName name);
     bool jsop_setgname(HandlePropertyName name);
     bool jsop_getname(HandlePropertyName name);
-    bool jsop_intrinsicname(HandlePropertyName name);
     bool jsop_bindname(PropertyName *name);
     bool jsop_getelem();
     bool jsop_getelem_dense();
     bool jsop_getelem_typed(int arrayType);
     bool jsop_getelem_string();
     bool jsop_setelem();
     bool jsop_setelem_dense();
     bool jsop_setelem_typed(int arrayType);

--- a/js/src/ion/LIR-Common.h
+++ b/js/src/ion/LIR-Common.h
@@ -2514,27 +2514,16 @@ class LGetNameCache : public LInstructio
     const LAllocation *scopeObj() {
         return getOperand(0);
     }
     const MGetNameCache *mir() const {
         return mir_->toGetNameCache();
     }
 };
 
-class LCallGetIntrinsicValue : public LCallInstructionHelper<BOX_PIECES, 0, 0>
-{
-  public:
-    LIR_HEADER(CallGetIntrinsicValue);
-    BOX_OUTPUT_ACCESSORS();
-
-    const MCallGetIntrinsicValue *mir() const {
-        return mir_->toCallGetIntrinsicValue();
-    }
-};
-
 // Patchable jump to stubs generated for a GetProperty cache, which loads a
 // boxed value.
 class LGetPropertyCacheV : public LInstructionHelper<BOX_PIECES, 1, 0>
 {
   public:
     LIR_HEADER(GetPropertyCacheV);
     BOX_OUTPUT_ACCESSORS();
 

--- a/js/src/ion/LOpcodes.h
+++ b/js/src/ion/LOpcodes.h
@@ -140,17 +140,16 @@
     _(StoreFixedSlotT)              \
     _(FunctionEnvironment)          \
     _(GetPropertyCacheV)            \
     _(GetPropertyCacheT)            \
     _(GetElementCacheV)             \
     _(BindNameCache)                \
     _(CallGetProperty)              \
     _(GetNameCache)                 \
-    _(CallGetIntrinsicValue)        \
     _(CallGetElement)               \
     _(CallSetElement)               \
     _(CallSetProperty)              \
     _(CallDeleteProperty)           \
     _(SetPropertyCacheV)            \
     _(SetPropertyCacheT)            \
     _(CallIteratorStart)            \
     _(IteratorStart)                \

--- a/js/src/ion/Lowering.cpp
+++ b/js/src/ion/Lowering.cpp
@@ -1664,25 +1664,16 @@ LIRGenerator::visitGetNameCache(MGetName
 
     LGetNameCache *lir = new LGetNameCache(useRegister(ins->scopeObj()));
     if (!defineBox(lir, ins))
         return false;
     return assignSafepoint(lir, ins);
 }
 
 bool
-LIRGenerator::visitCallGetIntrinsicValue(MCallGetIntrinsicValue *ins)
-{
-    LCallGetIntrinsicValue *lir = new LCallGetIntrinsicValue();
-    if (!defineVMReturn(lir, ins))
-        return false;
-    return assignSafepoint(lir, ins);
-}
-
-bool
 LIRGenerator::visitGetPropertyCache(MGetPropertyCache *ins)
 {
     JS_ASSERT(ins->object()->type() == MIRType_Object);
     if (ins->type() == MIRType_Value) {
         LGetPropertyCacheV *lir = new LGetPropertyCacheV(useRegister(ins->object()));
         if (!defineBox(lir, ins))
             return false;
         return assignSafepoint(lir, ins);

--- a/js/src/ion/Lowering.h
+++ b/js/src/ion/Lowering.h
@@ -164,17 +164,16 @@ class LIRGenerator : public LIRGenerator
     bool visitGetElementCache(MGetElementCache *ins);
     bool visitBindNameCache(MBindNameCache *ins);
     bool visitGuardClass(MGuardClass *ins);
     bool visitGuardObject(MGuardObject *ins);
     bool visitGuardString(MGuardString *ins);
     bool visitCallGetProperty(MCallGetProperty *ins);
     bool visitDeleteProperty(MDeleteProperty *ins);
     bool visitGetNameCache(MGetNameCache *ins);
-    bool visitCallGetIntrinsicValue(MCallGetIntrinsicValue *ins);
     bool visitCallGetElement(MCallGetElement *ins);
     bool visitCallSetElement(MCallSetElement *ins);
     bool visitSetPropertyCache(MSetPropertyCache *ins);
     bool visitCallSetProperty(MCallSetProperty *ins);
     bool visitIteratorStart(MIteratorStart *ins);
     bool visitIteratorNext(MIteratorNext *ins);
     bool visitIteratorMore(MIteratorMore *ins);
     bool visitIteratorEnd(MIteratorEnd *ins);

--- a/js/src/ion/MIR.h
+++ b/js/src/ion/MIR.h
@@ -4750,37 +4750,16 @@ class MGetNameCache
     PropertyName *name() const {
         return name_;
     }
     AccessKind accessKind() const {
         return kind_;
     }
 };
 
-class MCallGetIntrinsicValue : public MNullaryInstruction
-{
-    CompilerRootPropertyName name_;
-
-    MCallGetIntrinsicValue(HandlePropertyName name)
-      : name_(name)
-    {
-        setResultType(MIRType_Value);
-    }
-
-  public:
-    INSTRUCTION_HEADER(CallGetIntrinsicValue);
-
-    static MCallGetIntrinsicValue *New(HandlePropertyName name) {
-        return new MCallGetIntrinsicValue(name);
-    }
-    PropertyName *name() const {
-        return name_;
-    }
-};
-
 class MSetPropertyInstruction : public MBinaryInstruction
 {
     CompilerRootPropertyName name_;
     bool strict_;
     bool needsBarrier_;
 
   protected:
     MSetPropertyInstruction(MDefinition *obj, MDefinition *value, HandlePropertyName name,

--- a/js/src/ion/MOpcodes.h
+++ b/js/src/ion/MOpcodes.h
@@ -111,17 +111,16 @@ namespace ion {
     _(LoadTypedArrayElement)                                                \
     _(LoadTypedArrayElementHole)                                            \
     _(StoreTypedArrayElement)                                               \
     _(ClampToUint8)                                                         \
     _(LoadFixedSlot)                                                        \
     _(StoreFixedSlot)                                                       \
     _(CallGetProperty)                                                      \
     _(GetNameCache)                                                         \
-    _(CallGetIntrinsicValue)                                                \
     _(CallGetElement)                                                       \
     _(CallSetElement)                                                       \
     _(CallSetProperty)                                                      \
     _(DeleteProperty)                                                       \
     _(SetPropertyCache)                                                     \
     _(IteratorStart)                                                        \
     _(IteratorNext)                                                         \
     _(IteratorMore)                                                         \

--- a/js/src/ion/VMFunctions.cpp
+++ b/js/src/ion/VMFunctions.cpp
@@ -452,15 +452,10 @@ bool OperatorIn(JSContext *cx, HandleVal
     RootedShape prop(cx);
     if (!JSObject::lookupGeneric(cx, obj, id, &obj2, &prop))
         return false;
 
     *out = !!prop;
     return true;
 }
 
-bool GetIntrinsicValue(JSContext *cx, HandlePropertyName name, MutableHandleValue rval)
-{
-    return cx->global()->getIntrinsicValue(cx, name, rval);
-}
-
 } // namespace ion
 } // namespace js

--- a/js/src/ion/VMFunctions.h
+++ b/js/src/ion/VMFunctions.h
@@ -456,15 +456,13 @@ HeapSlot *NewSlots(JSRuntime *rt, unsign
 JSObject *NewCallObject(JSContext *cx, HandleShape shape, HandleTypeObject type, HeapSlot *slots);
 JSObject *NewStringObject(JSContext *cx, HandleString str);
 
 bool SPSEnter(JSContext *cx, HandleScript script);
 bool SPSExit(JSContext *cx, HandleScript script);
 
 bool OperatorIn(JSContext *cx, HandleValue key, HandleObject obj, JSBool *out);
 
-bool GetIntrinsicValue(JSContext *cx, HandlePropertyName name, MutableHandleValue rval);
-
 } // namespace ion
 } // namespace js
 
 #endif // jsion_vm_functions_h_
 

--- a/js/src/jsinterpinlines.h
+++ b/js/src/jsinterpinlines.h
@@ -400,18 +400,19 @@ FetchName(JSContext *cx, HandleObject ob
     }
     return true;
 }
 
 inline bool
 IntrinsicNameOperation(JSContext *cx, JSScript *script, jsbytecode *pc, MutableHandleValue vp)
 {
     JSOp op = JSOp(*pc);
-    RootedPropertyName name(cx, GetNameFromBytecode(cx, script, pc, op));
-    return cx->global()->getIntrinsicValue(cx, name, vp);
+    RootedPropertyName name(cx,  GetNameFromBytecode(cx, script, pc, op));
+    cx->global()->getIntrinsicValue(cx, name, vp);
+    return true;
 }
 
 inline bool
 NameOperation(JSContext *cx, jsbytecode *pc, MutableHandleValue vp)
 {
     RootedObject obj(cx, cx->stack.currentScriptedScopeChain());
     RootedPropertyName name(cx, cx->stack.currentScript()->getName(pc));