diff -urN js-1.8.5.orig/js/src/jsval.h js-1.8.5/js/src/jsval.h
--- js-1.8.5.orig/js/src/jsval.h	2016-04-08 08:44:39.417713832 +0000
+++ js-1.8.5/js/src/jsval.h	2016-04-11 06:26:40.807919594 +0000
@@ -66,7 +66,7 @@
 #endif
 
 #if JS_BITS_PER_WORD == 64
-# define JSVAL_TAG_SHIFT 47
+# define JSVAL_TAG_SHIFT 48
 #endif
 
 /*
@@ -135,7 +135,8 @@
 /* Remember to propagate changes to the C defines below. */
 JS_ENUM_HEADER(JSValueTag, uint32)
 {
-    JSVAL_TAG_MAX_DOUBLE           = 0x1FFF0,
+    JSVAL_TAG_DUMMY                = 0xFFFFFFFF,  /* Make sure the enums cannot fit 16-bits. */
+    JSVAL_TAG_MAX_DOUBLE           = 0xFFF8,
     JSVAL_TAG_INT32                = JSVAL_TAG_MAX_DOUBLE | JSVAL_TYPE_INT32,
     JSVAL_TAG_UNDEFINED            = JSVAL_TAG_MAX_DOUBLE | JSVAL_TYPE_UNDEFINED,
     JSVAL_TAG_STRING               = JSVAL_TAG_MAX_DOUBLE | JSVAL_TYPE_STRING,
@@ -196,7 +197,7 @@
 #elif JS_BITS_PER_WORD == 64
 
 typedef uint32 JSValueTag;
-#define JSVAL_TAG_MAX_DOUBLE         ((uint32)(0x1FFF0))
+#define JSVAL_TAG_MAX_DOUBLE         ((uint32)(0xFFF8))
 #define JSVAL_TAG_INT32              (uint32)(JSVAL_TAG_MAX_DOUBLE | JSVAL_TYPE_INT32)
 #define JSVAL_TAG_UNDEFINED          (uint32)(JSVAL_TAG_MAX_DOUBLE | JSVAL_TYPE_UNDEFINED)
 #define JSVAL_TAG_STRING             (uint32)(JSVAL_TAG_MAX_DOUBLE | JSVAL_TYPE_STRING)
@@ -236,8 +237,8 @@
 
 #elif JS_BITS_PER_WORD == 64
 
-#define JSVAL_PAYLOAD_MASK           0x00007FFFFFFFFFFFLL
-#define JSVAL_TAG_MASK               0xFFFF800000000000LL
+#define JSVAL_PAYLOAD_MASK           0x0000FFFFFFFFFFFFLL
+#define JSVAL_TAG_MASK               0xFFFF000000000000LL
 #define JSVAL_TYPE_TO_TAG(type)      ((JSValueTag)(JSVAL_TAG_MAX_DOUBLE | (type)))
 #define JSVAL_TYPE_TO_SHIFTED_TAG(type) (((uint64)JSVAL_TYPE_TO_TAG(type)) << JSVAL_TAG_SHIFT)
 
@@ -297,8 +298,8 @@
 #if (!defined(_WIN64) && defined(__cplusplus))
     /* MSVC does not pack these correctly :-( */
     struct {
-        uint64             payload47 : 47;
-        JSValueTag         tag : 17;
+        uint64             payload48 : 48;
+        JSValueTag         tag : 16;
     } debugView;
 #endif
     struct {
@@ -339,8 +340,8 @@
 {
     uint64 asBits;
     struct {
-        JSValueTag         tag : 17;
-        uint64             payload47 : 47;
+        JSValueTag         tag : 16;
+        uint64             payload48 : 48;
     } debugView;
     struct {
         union {
diff -urN js-1.8.5.orig/js/src/jsvalue.h js-1.8.5/js/src/jsvalue.h
--- js-1.8.5.orig/js/src/jsvalue.h	2016-04-08 08:44:39.417713832 +0000
+++ js-1.8.5/js/src/jsvalue.h	2016-04-11 06:10:21.219479884 +0000
@@ -255,7 +255,7 @@
 {
     uint64 lbits = lhs.asBits, rbits = rhs.asBits;
     return (lbits <= JSVAL_TAG_MAX_DOUBLE && rbits <= JSVAL_TAG_MAX_DOUBLE) ||
-           (((lbits ^ rbits) & 0xFFFF800000000000LL) == 0);
+           (((lbits ^ rbits) & 0xFFFF000000000000LL) == 0);
 }
 
 static JS_ALWAYS_INLINE jsval_layout
@@ -277,7 +277,7 @@
 static JS_ALWAYS_INLINE JSValueType
 JSVAL_EXTRACT_NON_DOUBLE_TYPE_IMPL(jsval_layout l)
 {
-   uint64 type = (l.asBits >> JSVAL_TAG_SHIFT) & 0xF;
+   uint64 type = (l.asBits >> JSVAL_TAG_SHIFT) & 0x7;
    JS_ASSERT(type > JSVAL_TYPE_DOUBLE);
    return (JSValueType)type;
 }