diff --git a/js/xpconnect/src/qsgen.py b/js/xpconnect/src/qsgen.py
index 21cf53089651..69784ae939c9 100644
--- a/js/xpconnect/src/qsgen.py
+++ b/js/xpconnect/src/qsgen.py
@@ -594,7 +594,8 @@ def writeResultDecl(f, type, varname):
             f.write("    nsString %s;\n" % varname)
             return
         elif name == '[jsval]':
-            return  # nothing to declare; see special case in outParamForm
+            f.write("    jsval %s;\n" % varname)
+            return
     elif t.kind in ('interface', 'forward'):
         f.write("    nsCOMPtr<%s> %s;\n" % (type.name, varname))
         return
@@ -604,15 +605,11 @@ def writeResultDecl(f, type, varname):
 
 def outParamForm(name, type):
     type = unaliasType(type)
-    # If we start allowing [jsval] return types here, we need to tack
-    # the return value onto the arguments list in the callers,
-    # possibly, and handle properly returning it too.  See bug 604198.
-    assert getBuiltinOrNativeTypeName(type) is not '[jsval]'
     if type.kind == 'builtin':
         return '&' + name
     elif type.kind == 'native':
         if getBuiltinOrNativeTypeName(type) == '[jsval]':
-            return 'vp'
+            return '&' + name
         elif type.modifier == 'ref':
             return name
         else:
@@ -671,9 +668,8 @@ resultConvTemplates = {
         "    return xpc::StringToJsval(cx, result, ${jsvalPtr});\n",
 
     '[jsval]':
-        # Here there's nothing to convert, because the result has already been
-        # written directly to *rv. See the special case in outParamForm.
-        "    return JS_TRUE;\n"
+        "    ${jsvalRef} = result;\n"
+        "    return JS_WrapValue(cx, ${jsvalPtr});\n"
     }
 
 def isVariantType(t):