diff --git a/dom/bindings/BindingUtils.cpp b/dom/bindings/BindingUtils.cpp
index b5c8b6159..ad3c79985 100644
--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@@ -1211,14 +1211,6 @@ GetInterfaceImpl(JSContext* aCx, nsIInterfaceRequestor* aRequestor,
   }
 }
 
-bool
-UnforgeableValueOf(JSContext* cx, unsigned argc, JS::Value* vp)
-{
-  JS::CallArgs args = JS::CallArgsFromVp(argc, vp);
-  args.rval().set(args.thisv());
-  return true;
-}
-
 bool
 ThrowingConstructor(JSContext* cx, unsigned argc, JS::Value* vp)
 {
diff --git a/dom/bindings/BindingUtils.h b/dom/bindings/BindingUtils.h
index 73687833f..66b5036d1 100644
--- a/dom/bindings/BindingUtils.h
+++ b/dom/bindings/BindingUtils.h
@@ -2006,9 +2006,6 @@ GetInterface(JSContext* aCx, T* aThis, nsIJSID* aIID,
   GetInterfaceImpl(aCx, aThis, aThis, aIID, aRetval, aError);
 }
 
-bool
-UnforgeableValueOf(JSContext* cx, unsigned argc, JS::Value* vp);
-
 bool
 ThrowingConstructor(JSContext* cx, unsigned argc, JS::Value* vp);
 
diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index 080dd6605..a2767bea5 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -2499,11 +2499,10 @@ class MethodDefiner(PropertyDefiner):
                 # Synthesize our valueOf method
                 self.regular.append({
                     "name": 'valueOf',
-                    "nativeName": "UnforgeableValueOf",
+                    "selfHostedName": "Object_valueOf",
                     "methodInfo": False,
                     "length": 0,
-                    "flags": "JSPROP_ENUMERATE",  # readonly/permanent added
-                                                  # automatically.
+                    "flags": "0",  # readonly/permanent added automatically.
                     "condition": MemberCondition()
                 })
 
@@ -3548,19 +3547,15 @@ def InitUnforgeablePropertiesOnHolder(descriptor, properties, failureCode,
                             "nsContentUtils::ThreadsafeIsSystemCaller(aCx)"))
 
     if descriptor.interface.getExtendedAttribute("Unforgeable"):
-        # We do our undefined toJSON and toPrimitive here, not as a regular
-        # property because we don't have a concept of value props anywhere in
-        # IDL.
+        # We do our undefined toPrimitive here, not as a regular property
+        # because we don't have a concept of value props anywhere in IDL.
         unforgeables.append(CGGeneric(fill(
             """
             JS::RootedId toPrimitive(aCx,
               SYMBOL_TO_JSID(JS::GetWellKnownSymbol(aCx, JS::SymbolCode::toPrimitive)));
             if (!JS_DefinePropertyById(aCx, ${holderName}, toPrimitive,
                                        JS::UndefinedHandleValue,
-                                       JSPROP_READONLY | JSPROP_PERMANENT) ||
-                !JS_DefineProperty(aCx, ${holderName}, "toJSON",
-                                   JS::UndefinedHandleValue,
-                                   JSPROP_READONLY | JSPROP_ENUMERATE | JSPROP_PERMANENT)) {
+                                       JSPROP_READONLY | JSPROP_PERMANENT)) {
               $*{failureCode}
             }
             """,
diff --git a/js/xpconnect/tests/chrome/test_bug1041626.xul b/js/xpconnect/tests/chrome/test_bug1041626.xul
index c7c7b7024..11529fbe4 100644
--- a/js/xpconnect/tests/chrome/test_bug1041626.xul
+++ b/js/xpconnect/tests/chrome/test_bug1041626.xul
@@ -28,9 +28,6 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1041626
 
     ok(Cu.isXrayWrapper(window[0].location), "Location is Xrayed");
     let xrayOwnProperties = Object.getOwnPropertyNames(window[0].location);
-    todo(xrayOwnProperties.indexOf('toJSON') != -1,
-         "dummy toJSON on Location should show up in Xrayable properties");
-    xrayOwnProperties.push('toJSON');
 
     let realOwnProperties = Object.getOwnPropertyNames(window[0].wrappedJSObject.location);
     ok(realOwnProperties.length > 2);
diff --git a/testing/web-platform/tests/html/browsers/history/the-location-interface/location-stringifier.html b/testing/web-platform/tests/html/browsers/history/the-location-interface/location-stringifier.html
index d23323b37..bde54b266 100644
--- a/testing/web-platform/tests/html/browsers/history/the-location-interface/location-stringifier.html
+++ b/testing/web-platform/tests/html/browsers/history/the-location-interface/location-stringifier.html
@@ -8,4 +8,17 @@
 <div id=log></div>
 <script>
 test_stringifier_attribute(location, "href", true);
+
+test(function() {
+  const prop1 = Object.getOwnPropertyDescriptor(location, "toString"),
+        prop2 = Object.getOwnPropertyDescriptor(location, "href")
+
+  assert_true(prop1.enumerable)
+  assert_false(prop1.writable)
+  assert_false(prop1.configurable)
+
+  assert_true(prop2.enumerable)
+  assert_false(prop2.configurable)
+  assert_equals(typeof prop2.get, "function")
+})
 </script>
diff --git a/testing/web-platform/tests/html/browsers/history/the-location-interface/location-symbol-toprimitive.html b/testing/web-platform/tests/html/browsers/history/the-location-interface/location-symbol-toprimitive.html
new file mode 100644
index 000000000..e666a3e70
--- /dev/null
+++ b/testing/web-platform/tests/html/browsers/history/the-location-interface/location-symbol-toprimitive.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<title>Location Symbol.toPrimitive</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<div id=log></div>
+<script>
+test(() => {
+  assert_equals(location[Symbol.toPrimitive], undefined)
+  const prop = Object.getOwnPropertyDescriptor(location, Symbol.toPrimitive)
+  assert_false(prop.enumerable)
+  assert_false(prop.writable)
+  assert_false(prop.configurable)
+})
+</script>
diff --git a/testing/web-platform/tests/html/browsers/history/the-location-interface/location-tojson.html b/testing/web-platform/tests/html/browsers/history/the-location-interface/location-tojson.html
new file mode 100644
index 000000000..5f20a6e15
--- /dev/null
+++ b/testing/web-platform/tests/html/browsers/history/the-location-interface/location-tojson.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<title>Location has no toJSON</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<div id=log></div>
+<script>
+test(() => {
+  assert_equals(location.toJSON, undefined)
+  assert_equals(Object.getOwnPropertyDescriptor(location, "toJSON"), undefined)
+  assert_false(location.hasOwnProperty("toJSON"))
+})
+</script>
+<!-- See https://github.com/whatwg/html/pull/2294 for context. (And the HTML Standard of course.) -->
diff --git a/testing/web-platform/tests/html/browsers/history/the-location-interface/location-valueof.html b/testing/web-platform/tests/html/browsers/history/the-location-interface/location-valueof.html
new file mode 100644
index 000000000..978bbb63a
--- /dev/null
+++ b/testing/web-platform/tests/html/browsers/history/the-location-interface/location-valueof.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<title>Location valueOf</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<div id=log></div>
+<script>
+test(() => {
+  assert_equals(location.valueOf, Object.prototype.valueOf)
+  assert_equals(typeof location.valueOf.call(5), "object")
+  const prop = Object.getOwnPropertyDescriptor(location, "valueOf")
+  assert_false(prop.enumerable)
+  assert_false(prop.writable)
+  assert_false(prop.configurable)
+})
+</script>