diff --git a/implementation-contributed/javascriptcore/stress/regress-189317.js b/implementation-contributed/javascriptcore/stress/regress-189317.js
new file mode 100644
index 0000000000..8e68ee241e
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/regress-189317.js
@@ -0,0 +1,125 @@
+let intrinsics = [
+    "Array.prototype.indexOf",
+    "Array.prototype.pop",
+    "Array.prototype.push",
+    "Array.prototype.slice",
+    "DataView.prototype.getInt8",
+    "DataView.prototype.getUint8",
+    "DataView.prototype.getInt16",
+    "DataView.prototype.getUint16",
+    "DataView.prototype.getInt32",
+    "DataView.prototype.getUint32",
+    "DataView.prototype.getFloat32",
+    "DataView.prototype.getFloat64",
+    "DataView.prototype.setInt8",
+    "DataView.prototype.setUint8",
+    "DataView.prototype.setInt16",
+    "DataView.prototype.setUint16",
+    "DataView.prototype.setInt32",
+    "DataView.prototype.setUint32",
+    "DataView.prototype.setFloat32",
+    "DataView.prototype.setFloat64",
+    "Map.prototype.get",
+    "Map.prototype.has",
+    "Map.prototype.set",
+    "Math.abs",
+    "Math.acos",
+    "Math.asin",
+    "Math.atan",
+    "Math.acosh",
+    "Math.asinh",
+    "Math.atanh",
+    "Math.cbrt",
+    "Math.ceil",
+    "Math.clz32",
+    "Math.cos",
+    "Math.cosh",
+    "Math.exp",
+    "Math.expm1",
+    "Math.floor",
+    "Math.fround",
+    "Math.log",
+    "Math.log10",
+    "Math.log1p",
+    "Math.log2",
+    "Math.max",
+    "Math.min",
+    "Math.pow",
+    "Math.random",
+    "Math.round",
+    "Math.sin",
+    "Math.sinh",
+    "Math.sqrt",
+    "Math.tan",
+    "Math.tanh",
+    "Math.trunc",
+    "Math.imul",
+    "Number.isInteger",
+    "Number.prototype.toString",
+    "Object.create",
+    "Object.getPrototypeOf",
+    "Object.is",
+    "Object.prototype.hasOwnProperty",
+    "parseInt",
+    "Set.prototype.add",
+    "Set.prototype.has",
+    "String.fromCharCode",
+    "String.prototype.charCodeAt",
+    "String.prototype.charAt",
+    "String.prototype.replace",
+    "String.prototype.slice",
+    "String.prototype.toLowerCase",
+    "String.prototype.valueOf",
+    "Reflect.getPrototypeOf",
+    "RegExp.prototype.exec",
+    "RegExp.prototype.test",
+    "WeakMap.prototype.get",
+    "WeakMap.prototype.has",
+    "WeakMap.prototype.set",
+    "WeakSet.prototype.add",
+    "WeakSet.prototype.has",
+];
+
+if (typeof Atomics !== "undefined") {
+    intrinsics = intrinsics.concat([
+        "Atomics.add",
+        "Atomics.and",
+        "Atomics.compareExchange",
+        "Atomics.exchange",
+        "Atomics.isLockFree",
+        "Atomics.load",
+        "Atomics.or",
+        "Atomics.store",
+        "Atomics.sub",
+        "Atomics.wait",
+        "Atomics.wake",
+        "Atomics.xor",
+    ]);
+}
+
+function testGetter(intrinsic) {
+    let runTest = new Function(
+        "let x = {};" + "\n" +
+        "x.__defineGetter__('a', " + intrinsic + ");" + "\n" +
+        "function test() {  x['a']; }" + "\n" +
+        "for (let i = 0; i < 1000; i++) {" + "\n" +
+        "    try { test(); } catch(e) { }" + "\n" +
+        "}");
+    runTest();
+}
+
+function testSetter(intrinsic) {
+    let runTest = new Function(
+        "let x = {};" + "\n" +
+        "x.__defineSetter__('a', " + intrinsic + ");" + "\n" +
+        "function test() {  x['a'] = 42; }" + "\n" +
+        "for (let i = 0; i < 1000; i++) {" + "\n" +
+        "    try { test(); } catch(e) { }" + "\n" +
+        "}");
+    runTest();
+}
+
+for (var i = 0; i < intrinsics.length; ++i) {
+    testGetter(intrinsics[i]);
+    testSetter(intrinsics[i]);
+}
diff --git a/implementation-contributed/javascriptcore/stress/string-to-string-error.js b/implementation-contributed/javascriptcore/stress/string-to-string-error.js
new file mode 100644
index 0000000000..7f98113479
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/string-to-string-error.js
@@ -0,0 +1,45 @@
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error('bad value: ' + actual);
+}
+
+function shouldThrow(func, errorMessage) {
+    var errorThrown = false;
+    var error = null;
+    try {
+        func();
+    } catch (e) {
+        errorThrown = true;
+        error = e;
+    }
+    if (!errorThrown)
+        throw new Error('not thrown');
+    if (String(error) !== errorMessage)
+        throw new Error(`bad error: ${String(error)}`);
+}
+
+var toString = String.prototype.toString;
+function test(string)
+{
+    return toString.call(string);
+}
+noInline(test);
+
+var object = {};
+var symbol = Symbol("Cocoa");
+for (var i = 0; i < 3e3; ++i) {
+    shouldThrow(() => test(object), `TypeError: Type error`);
+    shouldThrow(() => test(false), `TypeError: Type error`);
+    shouldThrow(() => test(true), `TypeError: Type error`);
+    shouldThrow(() => test(42), `TypeError: Type error`);
+    shouldThrow(() => test(null), `TypeError: Type error`);
+    shouldThrow(() => test(undefined), `TypeError: Type error`);
+    shouldThrow(() => test(symbol), `TypeError: Type error`);
+}
+
+var string = "Hello";
+var stringObject = new String(string);
+for (var i = 0; i < 1e2; ++i) {
+    shouldBe(test(string), string);
+    shouldBe(test(stringObject), string);
+}
diff --git a/implementation-contributed/javascriptcore/stress/string-to-string.js b/implementation-contributed/javascriptcore/stress/string-to-string.js
new file mode 100644
index 0000000000..ba0e7e3d60
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/string-to-string.js
@@ -0,0 +1,38 @@
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error('bad value: ' + actual);
+}
+
+function test1(string)
+{
+    return string.toString();
+}
+noInline(test1);
+
+function test2(string)
+{
+    return string.toString();
+}
+noInline(test2);
+
+function test3(string)
+{
+    return string.toString();
+}
+noInline(test3);
+
+var string = "Hello";
+var stringObject = new String(string);
+
+for (var i = 0; i < 1e6; ++i) {
+    shouldBe(test1(string), string);
+    shouldBe(test2(stringObject), string);
+    if (i & 1)
+        shouldBe(test3(string), string);
+    else
+        shouldBe(test3(stringObject), string);
+}
+
+shouldBe(test1({}), `[object Object]`);
+shouldBe(test2({}), `[object Object]`);
+shouldBe(test3({}), `[object Object]`);
diff --git a/implementation-contributed/javascriptcore/stress/string-value-of-error.js b/implementation-contributed/javascriptcore/stress/string-value-of-error.js
new file mode 100644
index 0000000000..53bca53328
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/string-value-of-error.js
@@ -0,0 +1,45 @@
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error('bad value: ' + actual);
+}
+
+function shouldThrow(func, errorMessage) {
+    var errorThrown = false;
+    var error = null;
+    try {
+        func();
+    } catch (e) {
+        errorThrown = true;
+        error = e;
+    }
+    if (!errorThrown)
+        throw new Error('not thrown');
+    if (String(error) !== errorMessage)
+        throw new Error(`bad error: ${String(error)}`);
+}
+
+var valueOf = String.prototype.valueOf;
+function test(string)
+{
+    return valueOf.call(string);
+}
+noInline(test);
+
+var object = {};
+var symbol = Symbol("Cocoa");
+for (var i = 0; i < 3e3; ++i) {
+    shouldThrow(() => test(object), `TypeError: Type error`);
+    shouldThrow(() => test(false), `TypeError: Type error`);
+    shouldThrow(() => test(true), `TypeError: Type error`);
+    shouldThrow(() => test(42), `TypeError: Type error`);
+    shouldThrow(() => test(null), `TypeError: Type error`);
+    shouldThrow(() => test(undefined), `TypeError: Type error`);
+    shouldThrow(() => test(symbol), `TypeError: Type error`);
+}
+
+var string = "Hello";
+var stringObject = new String(string);
+for (var i = 0; i < 1e2; ++i) {
+    shouldBe(test(string), string);
+    shouldBe(test(stringObject), string);
+}
diff --git a/implementation-contributed/javascriptcore/stress/string-value-of.js b/implementation-contributed/javascriptcore/stress/string-value-of.js
new file mode 100644
index 0000000000..4f6d2fd5ec
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/string-value-of.js
@@ -0,0 +1,39 @@
+function shouldBe(actual, expected) {
+    if (actual !== expected)
+        throw new Error('bad value: ' + actual);
+}
+
+function test1(string)
+{
+    return string.valueOf();
+}
+noInline(test1);
+
+function test2(string)
+{
+    return string.valueOf();
+}
+noInline(test2);
+
+function test3(string)
+{
+    return string.valueOf();
+}
+noInline(test3);
+
+var string = "Hello";
+var stringObject = new String(string);
+
+for (var i = 0; i < 1e6; ++i) {
+    shouldBe(test1(string), string);
+    shouldBe(test2(stringObject), string);
+    if (i & 1)
+        shouldBe(test3(string), string);
+    else
+        shouldBe(test3(stringObject), string);
+}
+
+var object = {};
+shouldBe(test1(object), object);
+shouldBe(test2(object), object);
+shouldBe(test3(object), object);