diff --git a/test/annexB/built-ins/String/prototype/anchor/B.2.3.2.js b/test/annexB/built-ins/String/prototype/anchor/B.2.3.2.js
index f39c60510f9a1e796c8a5652083eae962e7ad1a2..4b7a55236c57ac61c71d419b0b96043b58db6bd2 100644
--- a/test/annexB/built-ins/String/prototype/anchor/B.2.3.2.js
+++ b/test/annexB/built-ins/String/prototype/anchor/B.2.3.2.js
@@ -24,4 +24,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.anchor.call(null);
 });
-assert.sameValue(String.prototype.anchor.length, 1);
diff --git a/test/annexB/built-ins/String/prototype/anchor/attr-tostring-err.js b/test/annexB/built-ins/String/prototype/anchor/attr-tostring-err.js
new file mode 100644
index 0000000000000000000000000000000000000000..fa8497cbc80b994a9ff73bbf2dfda6e53ae40d7a
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/anchor/attr-tostring-err.js
@@ -0,0 +1,23 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.anchor
+es6id: B.2.3.2
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    [...]
+    4. If attribute is not the empty String, then
+       a. Let V be ? ToString(value).
+---*/
+
+var attr = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  ''.anchor(attr);
+});
diff --git a/test/annexB/built-ins/String/prototype/anchor/prop-desc.js b/test/annexB/built-ins/String/prototype/anchor/prop-desc.js
new file mode 100644
index 0000000000000000000000000000000000000000..ae78dc60e008d9fcf51b94b23ea112db3fe9f0bf
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/anchor/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.anchor
+es6id: B.2.3.2
+description: Property descriptor for String.prototype.anchor
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'anchor');
+verifyWritable(String.prototype, 'anchor');
+verifyConfigurable(String.prototype, 'anchor');
diff --git a/test/annexB/built-ins/String/prototype/anchor/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/anchor/this-val-tostring-err.js
new file mode 100644
index 0000000000000000000000000000000000000000..a93e97f4af7860feb47900168842c015974dfc5c
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/anchor/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.anchor
+es6id: B.2.3.2
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.anchor.call(thisVal);
+});
diff --git a/test/annexB/built-ins/String/prototype/big/B.2.3.3.js b/test/annexB/built-ins/String/prototype/big/B.2.3.3.js
index 380919d74120e06f292d4e3cca5e30c685b21f83..4b33362a0e0202b138a44e8c9e6606492e9cce6b 100644
--- a/test/annexB/built-ins/String/prototype/big/B.2.3.3.js
+++ b/test/annexB/built-ins/String/prototype/big/B.2.3.3.js
@@ -21,4 +21,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.big.call(null);
 });
-assert.sameValue(String.prototype.big.length, 0);
diff --git a/test/annexB/built-ins/String/prototype/big/prop-desc.js b/test/annexB/built-ins/String/prototype/big/prop-desc.js
new file mode 100644
index 0000000000000000000000000000000000000000..8e7f73ae3a95b3210cfc69a4d1beb0d2348d09f9
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/big/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.big
+es6id: B.2.3.3
+description: Property descriptor for String.prototype.big
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'big');
+verifyWritable(String.prototype, 'big');
+verifyConfigurable(String.prototype, 'big');
diff --git a/test/annexB/built-ins/String/prototype/big/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/big/this-val-tostring-err.js
new file mode 100644
index 0000000000000000000000000000000000000000..16c074e0ff1e5e1bea1f7649dd672cee200120ff
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/big/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.big
+es6id: B.2.3.3
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.big.call(thisVal);
+});
diff --git a/test/annexB/built-ins/String/prototype/blink/B.2.3.4.js b/test/annexB/built-ins/String/prototype/blink/B.2.3.4.js
index 619e591d29a01339dd4679fd236ed94ee167d7da..c4dda6bfb17077e6f4ad2c2b89547850f8017e22 100644
--- a/test/annexB/built-ins/String/prototype/blink/B.2.3.4.js
+++ b/test/annexB/built-ins/String/prototype/blink/B.2.3.4.js
@@ -21,4 +21,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.blink.call(null);
 });
-assert.sameValue(String.prototype.blink.length, 0);
diff --git a/test/annexB/built-ins/String/prototype/blink/prop-desc.js b/test/annexB/built-ins/String/prototype/blink/prop-desc.js
new file mode 100644
index 0000000000000000000000000000000000000000..05f4d1dbfbe55bc99cbb5d37454e56f9fd064cd2
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/blink/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.blink
+es6id: B.2.3.4
+description: Property descriptor for String.prototype.blink
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'blink');
+verifyWritable(String.prototype, 'blink');
+verifyConfigurable(String.prototype, 'blink');
diff --git a/test/annexB/built-ins/String/prototype/blink/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/blink/this-val-tostring-err.js
new file mode 100644
index 0000000000000000000000000000000000000000..35a710a6abdbbb66bff9c14ec98cd3acec87c84c
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/blink/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.blink
+es6id: B.2.3.4
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.blink.call(thisVal);
+});
diff --git a/test/annexB/built-ins/String/prototype/bold/B.2.3.5.js b/test/annexB/built-ins/String/prototype/bold/B.2.3.5.js
index 54e9d5bbdfe8c47068fd834de2d10ba6483917fd..30cff12810f1347610992e5dd21d8b66407a5af1 100644
--- a/test/annexB/built-ins/String/prototype/bold/B.2.3.5.js
+++ b/test/annexB/built-ins/String/prototype/bold/B.2.3.5.js
@@ -21,4 +21,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.bold.call(null);
 });
-assert.sameValue(String.prototype.bold.length, 0);
diff --git a/test/annexB/built-ins/String/prototype/bold/prop-desc.js b/test/annexB/built-ins/String/prototype/bold/prop-desc.js
new file mode 100644
index 0000000000000000000000000000000000000000..2f853dbf3fe3870d02023dbc0f38fba57d50257e
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/bold/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.bold
+es6id: B.2.3.5
+description: Property descriptor for String.prototype.bold
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'bold');
+verifyWritable(String.prototype, 'bold');
+verifyConfigurable(String.prototype, 'bold');
diff --git a/test/annexB/built-ins/String/prototype/bold/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/bold/this-val-tostring-err.js
new file mode 100644
index 0000000000000000000000000000000000000000..3c38825f282aa6e8e68c15569433f0fdc49f471f
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/bold/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.bold
+es6id: B.2.3.5
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.bold.call(thisVal);
+});
diff --git a/test/annexB/built-ins/String/prototype/fixed/B.2.3.6.js b/test/annexB/built-ins/String/prototype/fixed/B.2.3.6.js
index 1d5a18543c6aa2a870101898f912946427781f65..d5a8c671d00138249126bf54ff5e00876e168d36 100644
--- a/test/annexB/built-ins/String/prototype/fixed/B.2.3.6.js
+++ b/test/annexB/built-ins/String/prototype/fixed/B.2.3.6.js
@@ -21,4 +21,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.fixed.call(null);
 });
-assert.sameValue(String.prototype.fixed.length, 0);
diff --git a/test/annexB/built-ins/String/prototype/fixed/prop-desc.js b/test/annexB/built-ins/String/prototype/fixed/prop-desc.js
new file mode 100644
index 0000000000000000000000000000000000000000..6460969ea334d15c24f039f382788d94b2a1ecab
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/fixed/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.fixed
+es6id: B.2.3.6
+description: Property descriptor for String.prototype.fixed
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'fixed');
+verifyWritable(String.prototype, 'fixed');
+verifyConfigurable(String.prototype, 'fixed');
diff --git a/test/annexB/built-ins/String/prototype/fixed/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/fixed/this-val-tostring-err.js
new file mode 100644
index 0000000000000000000000000000000000000000..885fcedc6b6065cf79cf5d66bb7bb0f258bd4e76
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/fixed/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.fixed
+es6id: B.2.3.6
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.fixed.call(thisVal);
+});
diff --git a/test/annexB/built-ins/String/prototype/fontcolor/B.2.3.7.js b/test/annexB/built-ins/String/prototype/fontcolor/B.2.3.7.js
index 4bc59d21ad498d592535174ce2a011dd603d4884..10d1fce9bf50d7bc410fc5fd914660f7e8e80f7a 100644
--- a/test/annexB/built-ins/String/prototype/fontcolor/B.2.3.7.js
+++ b/test/annexB/built-ins/String/prototype/fontcolor/B.2.3.7.js
@@ -26,4 +26,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.fontcolor.call(null);
 });
-assert.sameValue(String.prototype.fontcolor.length, 1);
diff --git a/test/annexB/built-ins/String/prototype/fontcolor/attr-tostring-err.js b/test/annexB/built-ins/String/prototype/fontcolor/attr-tostring-err.js
new file mode 100644
index 0000000000000000000000000000000000000000..3aaaac7d857f3eeb2ca2f583bc5cd6ffe84fa8f5
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/fontcolor/attr-tostring-err.js
@@ -0,0 +1,23 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.fontcolor
+es6id: B.2.3.7
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    [...]
+    4. If attribute is not the empty String, then
+       a. Let V be ? ToString(value).
+---*/
+
+var attr = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  ''.fontcolor(attr);
+});
diff --git a/test/annexB/built-ins/String/prototype/fontcolor/prop-desc.js b/test/annexB/built-ins/String/prototype/fontcolor/prop-desc.js
new file mode 100644
index 0000000000000000000000000000000000000000..9bc83e2f1076ae62a02ad63673752cd8b0deac42
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/fontcolor/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.fontcolor
+es6id: B.2.3.7
+description: Property descriptor for String.prototype.fontcolor
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'fontcolor');
+verifyWritable(String.prototype, 'fontcolor');
+verifyConfigurable(String.prototype, 'fontcolor');
diff --git a/test/annexB/built-ins/String/prototype/fontcolor/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/fontcolor/this-val-tostring-err.js
new file mode 100644
index 0000000000000000000000000000000000000000..adb03bc2f3b54978f6cf26dc9e760596dba47feb
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/fontcolor/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.fontcolor
+es6id: B.2.3.7
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.fontcolor.call(thisVal);
+});
diff --git a/test/annexB/built-ins/String/prototype/fontsize/B.2.3.8.js b/test/annexB/built-ins/String/prototype/fontsize/B.2.3.8.js
index f966275b8708aa2e47cb729ff36b87be3065ba64..d70c72b6ddcee0140cf42bdbaa14f1eaaf3caf9a 100644
--- a/test/annexB/built-ins/String/prototype/fontsize/B.2.3.8.js
+++ b/test/annexB/built-ins/String/prototype/fontsize/B.2.3.8.js
@@ -26,4 +26,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.fontsize.call(null);
 });
-assert.sameValue(String.prototype.fontsize.length, 1);
diff --git a/test/annexB/built-ins/String/prototype/fontsize/attr-tostring-err.js b/test/annexB/built-ins/String/prototype/fontsize/attr-tostring-err.js
new file mode 100644
index 0000000000000000000000000000000000000000..5e8fc6c9756934afa210487712d9c701f2b14329
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/fontsize/attr-tostring-err.js
@@ -0,0 +1,23 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.fontsize
+es6id: B.2.3.8
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    [...]
+    4. If attribute is not the empty String, then
+       a. Let V be ? ToString(value).
+---*/
+
+var attr = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  ''.fontsize(attr);
+});
diff --git a/test/annexB/built-ins/String/prototype/fontsize/prop-desc.js b/test/annexB/built-ins/String/prototype/fontsize/prop-desc.js
new file mode 100644
index 0000000000000000000000000000000000000000..c6c3c4bedaea596c3ff9ae08986c76dd3e96dce3
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/fontsize/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.fontsize
+es6id: B.2.3.8
+description: Property descriptor for String.prototype.fontsize
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'fontsize');
+verifyWritable(String.prototype, 'fontsize');
+verifyConfigurable(String.prototype, 'fontsize');
diff --git a/test/annexB/built-ins/String/prototype/fontsize/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/fontsize/this-val-tostring-err.js
new file mode 100644
index 0000000000000000000000000000000000000000..318d6afdf3e2daef6d7caaea9824343eb2022de0
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/fontsize/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.fontsize
+es6id: B.2.3.8
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.fontsize.call(thisVal);
+});
diff --git a/test/annexB/built-ins/String/prototype/italics/B.2.3.9.js b/test/annexB/built-ins/String/prototype/italics/B.2.3.9.js
index e81cd0f1e3c7ee99e4f8576a8e6942d0c6c1a85d..ea7c1e13600ff4a14c098645548e652dc535ca87 100644
--- a/test/annexB/built-ins/String/prototype/italics/B.2.3.9.js
+++ b/test/annexB/built-ins/String/prototype/italics/B.2.3.9.js
@@ -21,4 +21,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.italics.call(null);
 });
-assert.sameValue(String.prototype.italics.length, 0);
diff --git a/test/annexB/built-ins/String/prototype/italics/prop-desc.js b/test/annexB/built-ins/String/prototype/italics/prop-desc.js
new file mode 100644
index 0000000000000000000000000000000000000000..73b5fba41efd7578b701b2804a0b3591a6009ec9
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/italics/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.italics
+es6id: B.2.3.9
+description: Property descriptor for String.prototype.italics
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'italics');
+verifyWritable(String.prototype, 'italics');
+verifyConfigurable(String.prototype, 'italics');
diff --git a/test/annexB/built-ins/String/prototype/italics/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/italics/this-val-tostring-err.js
new file mode 100644
index 0000000000000000000000000000000000000000..8265772f71f0038941a0256c47587c42571ac6a6
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/italics/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.italics
+es6id: B.2.3.9
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.italics.call(thisVal);
+});
diff --git a/test/annexB/built-ins/String/prototype/link/B.2.3.10.js b/test/annexB/built-ins/String/prototype/link/B.2.3.10.js
index 58b1118dc91400a10225e86c2b7e490f392185e5..c9a798e70628edc7f9a09d4213e0ab7ab94bec7f 100644
--- a/test/annexB/built-ins/String/prototype/link/B.2.3.10.js
+++ b/test/annexB/built-ins/String/prototype/link/B.2.3.10.js
@@ -7,7 +7,7 @@
 /*---
  description: >
      String.prototype.link returns a string of HTML describing a single HTML
-     anchor element. The element's content is the `this` value of the function
+     link element. The element's content is the `this` value of the function
      invocation, coerced to a string. If specified, the first argument will be
      coerced to a string, escaped, and set as the element's `href` attribute.
  es6id: B.2.3.10
@@ -24,4 +24,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.link.call(null);
 });
-assert.sameValue(String.prototype.link.length, 1);
diff --git a/test/annexB/built-ins/String/prototype/link/attr-tostring-err.js b/test/annexB/built-ins/String/prototype/link/attr-tostring-err.js
new file mode 100644
index 0000000000000000000000000000000000000000..e863036093e088dbf7333af3c31875d7d4a66ed3
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/link/attr-tostring-err.js
@@ -0,0 +1,23 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.link
+es6id: B.2.3.10
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    [...]
+    4. If attribute is not the empty String, then
+       a. Let V be ? ToString(value).
+---*/
+
+var attr = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  ''.link(attr);
+});
diff --git a/test/annexB/built-ins/String/prototype/link/prop-desc.js b/test/annexB/built-ins/String/prototype/link/prop-desc.js
new file mode 100644
index 0000000000000000000000000000000000000000..30b46b9d5f2d7f083b0da86d6786c3b8bf97d6d0
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/link/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.link
+es6id: B.2.3.10
+description: Property descriptor for String.prototype.link
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'link');
+verifyWritable(String.prototype, 'link');
+verifyConfigurable(String.prototype, 'link');
diff --git a/test/annexB/built-ins/String/prototype/link/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/link/this-val-tostring-err.js
new file mode 100644
index 0000000000000000000000000000000000000000..b58290af92969155044d87408020ca73077add89
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/link/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.link
+es6id: B.2.3.10
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.link.call(thisVal);
+});
diff --git a/test/annexB/built-ins/String/prototype/small/B.2.3.11.js b/test/annexB/built-ins/String/prototype/small/B.2.3.11.js
index 2fc9a85a8a6c2cfea16c3bba63c1bbeb65519950..70f2e2c70feedff23d4488b0a955de523cce6445 100644
--- a/test/annexB/built-ins/String/prototype/small/B.2.3.11.js
+++ b/test/annexB/built-ins/String/prototype/small/B.2.3.11.js
@@ -21,4 +21,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.small.call(null);
 });
-assert.sameValue(String.prototype.small.length, 0);
diff --git a/test/annexB/built-ins/String/prototype/small/prop-desc.js b/test/annexB/built-ins/String/prototype/small/prop-desc.js
new file mode 100644
index 0000000000000000000000000000000000000000..ad765ee3a0181430312a5d1f6c9e997eb8dff834
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/small/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.small
+es6id: B.2.3.11
+description: Property descriptor for String.prototype.small
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'small');
+verifyWritable(String.prototype, 'small');
+verifyConfigurable(String.prototype, 'small');
diff --git a/test/annexB/built-ins/String/prototype/small/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/small/this-val-tostring-err.js
new file mode 100644
index 0000000000000000000000000000000000000000..2fa1eed1485e6a0e83bcf6dc3da4d5fd742f313d
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/small/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.small
+es6id: B.2.3.11
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.small.call(thisVal);
+});
diff --git a/test/annexB/built-ins/String/prototype/strike/B.2.3.12.js b/test/annexB/built-ins/String/prototype/strike/B.2.3.12.js
index 6dee590e6ca69beb5f286c4e94608134c34939fb..ea51fe80c9cbd0ca81de60616d0a66ad636c2e2b 100644
--- a/test/annexB/built-ins/String/prototype/strike/B.2.3.12.js
+++ b/test/annexB/built-ins/String/prototype/strike/B.2.3.12.js
@@ -21,4 +21,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.strike.call(null);
 });
-assert.sameValue(String.prototype.strike.length, 0);
diff --git a/test/annexB/built-ins/String/prototype/strike/prop-desc.js b/test/annexB/built-ins/String/prototype/strike/prop-desc.js
new file mode 100644
index 0000000000000000000000000000000000000000..e9902e8d7c92c9e18e1204a61cdf7d3d1c17efc3
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/strike/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.strike
+es6id: B.2.3.12
+description: Property descriptor for String.prototype.strike
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'strike');
+verifyWritable(String.prototype, 'strike');
+verifyConfigurable(String.prototype, 'strike');
diff --git a/test/annexB/built-ins/String/prototype/strike/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/strike/this-val-tostring-err.js
new file mode 100644
index 0000000000000000000000000000000000000000..e61a0e4f52223af23ee854fbcf7344d7e72aa03a
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/strike/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.strike
+es6id: B.2.3.12
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.strike.call(thisVal);
+});
diff --git a/test/annexB/built-ins/String/prototype/sub/B.2.3.13.js b/test/annexB/built-ins/String/prototype/sub/B.2.3.13.js
index 64a9c830cd786b423e1983675565ab3da17a750e..b6dda9166475a81a99f05cf5e86f1278e1744065 100644
--- a/test/annexB/built-ins/String/prototype/sub/B.2.3.13.js
+++ b/test/annexB/built-ins/String/prototype/sub/B.2.3.13.js
@@ -21,4 +21,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.sub.call(null);
 });
-assert.sameValue(String.prototype.sub.length, 0);
diff --git a/test/annexB/built-ins/String/prototype/sub/prop-desc.js b/test/annexB/built-ins/String/prototype/sub/prop-desc.js
new file mode 100644
index 0000000000000000000000000000000000000000..680844024b9dc2fa75f92e6f5ea61a9515aabe79
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/sub/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.sub
+es6id: B.2.3.13
+description: Property descriptor for String.prototype.sub
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'sub');
+verifyWritable(String.prototype, 'sub');
+verifyConfigurable(String.prototype, 'sub');
diff --git a/test/annexB/built-ins/String/prototype/sub/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/sub/this-val-tostring-err.js
new file mode 100644
index 0000000000000000000000000000000000000000..e5355bb9dbcf8917a179180552e6be67447bfd0a
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/sub/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.sub
+es6id: B.2.3.13
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.sub.call(thisVal);
+});
diff --git a/test/annexB/built-ins/String/prototype/sup/B.2.3.14.js b/test/annexB/built-ins/String/prototype/sup/B.2.3.14.js
index f20c3b705c1631ece83df74a38e80d0e33853837..b08da854273d5dda6e25ffad78f0ba71d29dec13 100644
--- a/test/annexB/built-ins/String/prototype/sup/B.2.3.14.js
+++ b/test/annexB/built-ins/String/prototype/sup/B.2.3.14.js
@@ -21,4 +21,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.sup.call(null);
 });
-assert.sameValue(String.prototype.sup.length, 0);
diff --git a/test/annexB/built-ins/String/prototype/sup/prop-desc.js b/test/annexB/built-ins/String/prototype/sup/prop-desc.js
new file mode 100644
index 0000000000000000000000000000000000000000..72894c2206893dda129cf4d81153afe226473880
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/sup/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.sup
+es6id: B.2.3.14
+description: Property descriptor for String.prototype.sup
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'sup');
+verifyWritable(String.prototype, 'sup');
+verifyConfigurable(String.prototype, 'sup');
diff --git a/test/annexB/built-ins/String/prototype/sup/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/sup/this-val-tostring-err.js
new file mode 100644
index 0000000000000000000000000000000000000000..06c38f5f86ef2f3e2d9754eaa047d865e665b9ff
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/sup/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.sup
+es6id: B.2.3.14
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.sup.call(thisVal);
+});