https://bugs.ecmascript.org/show_bug.cgi?id=276 fixed.

test/suite/ch15/15.5/15.5.4/15.5.4.13/S15.5.4.13_A3_T3.js

@@ -8,7 +8,7 @@
  * @description Apply String.prototype.slice to Object instance, and call instance.slice(...).slice(...)
  */
 
-var __instance =  function(){};
+var __instance = { toString: function() { return "function(){}";} };
 
 __instance.slice = String.prototype.slice;
 

test/suite/ch15/15.5/15.5.4/15.5.4.14/S15.5.4.14_A3_T3.js

@@ -10,7 +10,7 @@
  * @description Instance is function(){}
  */
 
-var __instance = function(){};
+var __instance = { toString: function() { return "function(){}";} };
 
 __instance.split = String.prototype.split;
 

test/suite/ch15/15.5/15.5.4/15.5.4.15/S15.5.4.15_A3_T7.js

@@ -9,7 +9,7 @@
  * @description Apply String.prototype.substring to Object instance. Call instance.substring(...).substring(...)
  */
 
-var __instance = function(){};
+var __instance = { toString: function() { return "function(){}";} };
  
 __instance.substring = String.prototype.substring;