From c6b0864d2b9931f1c82ff7af4e521dbbc32e291a Mon Sep 17 00:00:00 2001
From: jugglinmike <mike@mikepennisi.com>
Date: Thu, 19 May 2016 20:16:21 -0400
Subject: [PATCH] Extend tests for Annex B String HTML methods (#627)

- Add tests for abrupt completion handling from ToString operations
- Add tests for method property descriptors
- Remove redundant assertion
---
 .../String/prototype/anchor/B.2.3.2.js        |  1 -
 .../prototype/anchor/attr-tostring-err.js     | 23 +++++++++++++++++++
 .../String/prototype/anchor/prop-desc.js      | 16 +++++++++++++
 .../prototype/anchor/this-val-tostring-err.js | 22 ++++++++++++++++++
 .../built-ins/String/prototype/big/B.2.3.3.js |  1 -
 .../String/prototype/big/prop-desc.js         | 16 +++++++++++++
 .../prototype/big/this-val-tostring-err.js    | 22 ++++++++++++++++++
 .../String/prototype/blink/B.2.3.4.js         |  1 -
 .../String/prototype/blink/prop-desc.js       | 16 +++++++++++++
 .../prototype/blink/this-val-tostring-err.js  | 22 ++++++++++++++++++
 .../String/prototype/bold/B.2.3.5.js          |  1 -
 .../String/prototype/bold/prop-desc.js        | 16 +++++++++++++
 .../prototype/bold/this-val-tostring-err.js   | 22 ++++++++++++++++++
 .../String/prototype/fixed/B.2.3.6.js         |  1 -
 .../String/prototype/fixed/prop-desc.js       | 16 +++++++++++++
 .../prototype/fixed/this-val-tostring-err.js  | 22 ++++++++++++++++++
 .../String/prototype/fontcolor/B.2.3.7.js     |  1 -
 .../prototype/fontcolor/attr-tostring-err.js  | 23 +++++++++++++++++++
 .../String/prototype/fontcolor/prop-desc.js   | 16 +++++++++++++
 .../fontcolor/this-val-tostring-err.js        | 22 ++++++++++++++++++
 .../String/prototype/fontsize/B.2.3.8.js      |  1 -
 .../prototype/fontsize/attr-tostring-err.js   | 23 +++++++++++++++++++
 .../String/prototype/fontsize/prop-desc.js    | 16 +++++++++++++
 .../fontsize/this-val-tostring-err.js         | 22 ++++++++++++++++++
 .../String/prototype/italics/B.2.3.9.js       |  1 -
 .../String/prototype/italics/prop-desc.js     | 16 +++++++++++++
 .../italics/this-val-tostring-err.js          | 22 ++++++++++++++++++
 .../String/prototype/link/B.2.3.10.js         |  3 +--
 .../prototype/link/attr-tostring-err.js       | 23 +++++++++++++++++++
 .../String/prototype/link/prop-desc.js        | 16 +++++++++++++
 .../prototype/link/this-val-tostring-err.js   | 22 ++++++++++++++++++
 .../String/prototype/small/B.2.3.11.js        |  1 -
 .../String/prototype/small/prop-desc.js       | 16 +++++++++++++
 .../prototype/small/this-val-tostring-err.js  | 22 ++++++++++++++++++
 .../String/prototype/strike/B.2.3.12.js       |  1 -
 .../String/prototype/strike/prop-desc.js      | 16 +++++++++++++
 .../prototype/strike/this-val-tostring-err.js | 22 ++++++++++++++++++
 .../String/prototype/sub/B.2.3.13.js          |  1 -
 .../String/prototype/sub/prop-desc.js         | 16 +++++++++++++
 .../prototype/sub/this-val-tostring-err.js    | 22 ++++++++++++++++++
 .../String/prototype/sup/B.2.3.14.js          |  1 -
 .../String/prototype/sup/prop-desc.js         | 16 +++++++++++++
 .../prototype/sup/this-val-tostring-err.js    | 22 ++++++++++++++++++
 43 files changed, 587 insertions(+), 14 deletions(-)
 create mode 100644 test/annexB/built-ins/String/prototype/anchor/attr-tostring-err.js
 create mode 100644 test/annexB/built-ins/String/prototype/anchor/prop-desc.js
 create mode 100644 test/annexB/built-ins/String/prototype/anchor/this-val-tostring-err.js
 create mode 100644 test/annexB/built-ins/String/prototype/big/prop-desc.js
 create mode 100644 test/annexB/built-ins/String/prototype/big/this-val-tostring-err.js
 create mode 100644 test/annexB/built-ins/String/prototype/blink/prop-desc.js
 create mode 100644 test/annexB/built-ins/String/prototype/blink/this-val-tostring-err.js
 create mode 100644 test/annexB/built-ins/String/prototype/bold/prop-desc.js
 create mode 100644 test/annexB/built-ins/String/prototype/bold/this-val-tostring-err.js
 create mode 100644 test/annexB/built-ins/String/prototype/fixed/prop-desc.js
 create mode 100644 test/annexB/built-ins/String/prototype/fixed/this-val-tostring-err.js
 create mode 100644 test/annexB/built-ins/String/prototype/fontcolor/attr-tostring-err.js
 create mode 100644 test/annexB/built-ins/String/prototype/fontcolor/prop-desc.js
 create mode 100644 test/annexB/built-ins/String/prototype/fontcolor/this-val-tostring-err.js
 create mode 100644 test/annexB/built-ins/String/prototype/fontsize/attr-tostring-err.js
 create mode 100644 test/annexB/built-ins/String/prototype/fontsize/prop-desc.js
 create mode 100644 test/annexB/built-ins/String/prototype/fontsize/this-val-tostring-err.js
 create mode 100644 test/annexB/built-ins/String/prototype/italics/prop-desc.js
 create mode 100644 test/annexB/built-ins/String/prototype/italics/this-val-tostring-err.js
 create mode 100644 test/annexB/built-ins/String/prototype/link/attr-tostring-err.js
 create mode 100644 test/annexB/built-ins/String/prototype/link/prop-desc.js
 create mode 100644 test/annexB/built-ins/String/prototype/link/this-val-tostring-err.js
 create mode 100644 test/annexB/built-ins/String/prototype/small/prop-desc.js
 create mode 100644 test/annexB/built-ins/String/prototype/small/this-val-tostring-err.js
 create mode 100644 test/annexB/built-ins/String/prototype/strike/prop-desc.js
 create mode 100644 test/annexB/built-ins/String/prototype/strike/this-val-tostring-err.js
 create mode 100644 test/annexB/built-ins/String/prototype/sub/prop-desc.js
 create mode 100644 test/annexB/built-ins/String/prototype/sub/this-val-tostring-err.js
 create mode 100644 test/annexB/built-ins/String/prototype/sup/prop-desc.js
 create mode 100644 test/annexB/built-ins/String/prototype/sup/this-val-tostring-err.js

diff --git a/test/annexB/built-ins/String/prototype/anchor/B.2.3.2.js b/test/annexB/built-ins/String/prototype/anchor/B.2.3.2.js
index f39c60510f..4b7a55236c 100644
--- a/test/annexB/built-ins/String/prototype/anchor/B.2.3.2.js
+++ b/test/annexB/built-ins/String/prototype/anchor/B.2.3.2.js
@@ -24,4 +24,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.anchor.call(null);
 });
-assert.sameValue(String.prototype.anchor.length, 1);
diff --git a/test/annexB/built-ins/String/prototype/anchor/attr-tostring-err.js b/test/annexB/built-ins/String/prototype/anchor/attr-tostring-err.js
new file mode 100644
index 0000000000..fa8497cbc8
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/anchor/attr-tostring-err.js
@@ -0,0 +1,23 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.anchor
+es6id: B.2.3.2
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    [...]
+    4. If attribute is not the empty String, then
+       a. Let V be ? ToString(value).
+---*/
+
+var attr = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  ''.anchor(attr);
+});
diff --git a/test/annexB/built-ins/String/prototype/anchor/prop-desc.js b/test/annexB/built-ins/String/prototype/anchor/prop-desc.js
new file mode 100644
index 0000000000..ae78dc60e0
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/anchor/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.anchor
+es6id: B.2.3.2
+description: Property descriptor for String.prototype.anchor
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'anchor');
+verifyWritable(String.prototype, 'anchor');
+verifyConfigurable(String.prototype, 'anchor');
diff --git a/test/annexB/built-ins/String/prototype/anchor/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/anchor/this-val-tostring-err.js
new file mode 100644
index 0000000000..a93e97f4af
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/anchor/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.anchor
+es6id: B.2.3.2
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.anchor.call(thisVal);
+});
diff --git a/test/annexB/built-ins/String/prototype/big/B.2.3.3.js b/test/annexB/built-ins/String/prototype/big/B.2.3.3.js
index 380919d741..4b33362a0e 100644
--- a/test/annexB/built-ins/String/prototype/big/B.2.3.3.js
+++ b/test/annexB/built-ins/String/prototype/big/B.2.3.3.js
@@ -21,4 +21,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.big.call(null);
 });
-assert.sameValue(String.prototype.big.length, 0);
diff --git a/test/annexB/built-ins/String/prototype/big/prop-desc.js b/test/annexB/built-ins/String/prototype/big/prop-desc.js
new file mode 100644
index 0000000000..8e7f73ae3a
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/big/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.big
+es6id: B.2.3.3
+description: Property descriptor for String.prototype.big
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'big');
+verifyWritable(String.prototype, 'big');
+verifyConfigurable(String.prototype, 'big');
diff --git a/test/annexB/built-ins/String/prototype/big/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/big/this-val-tostring-err.js
new file mode 100644
index 0000000000..16c074e0ff
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/big/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.big
+es6id: B.2.3.3
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.big.call(thisVal);
+});
diff --git a/test/annexB/built-ins/String/prototype/blink/B.2.3.4.js b/test/annexB/built-ins/String/prototype/blink/B.2.3.4.js
index 619e591d29..c4dda6bfb1 100644
--- a/test/annexB/built-ins/String/prototype/blink/B.2.3.4.js
+++ b/test/annexB/built-ins/String/prototype/blink/B.2.3.4.js
@@ -21,4 +21,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.blink.call(null);
 });
-assert.sameValue(String.prototype.blink.length, 0);
diff --git a/test/annexB/built-ins/String/prototype/blink/prop-desc.js b/test/annexB/built-ins/String/prototype/blink/prop-desc.js
new file mode 100644
index 0000000000..05f4d1dbfb
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/blink/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.blink
+es6id: B.2.3.4
+description: Property descriptor for String.prototype.blink
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'blink');
+verifyWritable(String.prototype, 'blink');
+verifyConfigurable(String.prototype, 'blink');
diff --git a/test/annexB/built-ins/String/prototype/blink/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/blink/this-val-tostring-err.js
new file mode 100644
index 0000000000..35a710a6ab
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/blink/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.blink
+es6id: B.2.3.4
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.blink.call(thisVal);
+});
diff --git a/test/annexB/built-ins/String/prototype/bold/B.2.3.5.js b/test/annexB/built-ins/String/prototype/bold/B.2.3.5.js
index 54e9d5bbdf..30cff12810 100644
--- a/test/annexB/built-ins/String/prototype/bold/B.2.3.5.js
+++ b/test/annexB/built-ins/String/prototype/bold/B.2.3.5.js
@@ -21,4 +21,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.bold.call(null);
 });
-assert.sameValue(String.prototype.bold.length, 0);
diff --git a/test/annexB/built-ins/String/prototype/bold/prop-desc.js b/test/annexB/built-ins/String/prototype/bold/prop-desc.js
new file mode 100644
index 0000000000..2f853dbf3f
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/bold/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.bold
+es6id: B.2.3.5
+description: Property descriptor for String.prototype.bold
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'bold');
+verifyWritable(String.prototype, 'bold');
+verifyConfigurable(String.prototype, 'bold');
diff --git a/test/annexB/built-ins/String/prototype/bold/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/bold/this-val-tostring-err.js
new file mode 100644
index 0000000000..3c38825f28
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/bold/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.bold
+es6id: B.2.3.5
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.bold.call(thisVal);
+});
diff --git a/test/annexB/built-ins/String/prototype/fixed/B.2.3.6.js b/test/annexB/built-ins/String/prototype/fixed/B.2.3.6.js
index 1d5a18543c..d5a8c671d0 100644
--- a/test/annexB/built-ins/String/prototype/fixed/B.2.3.6.js
+++ b/test/annexB/built-ins/String/prototype/fixed/B.2.3.6.js
@@ -21,4 +21,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.fixed.call(null);
 });
-assert.sameValue(String.prototype.fixed.length, 0);
diff --git a/test/annexB/built-ins/String/prototype/fixed/prop-desc.js b/test/annexB/built-ins/String/prototype/fixed/prop-desc.js
new file mode 100644
index 0000000000..6460969ea3
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/fixed/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.fixed
+es6id: B.2.3.6
+description: Property descriptor for String.prototype.fixed
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'fixed');
+verifyWritable(String.prototype, 'fixed');
+verifyConfigurable(String.prototype, 'fixed');
diff --git a/test/annexB/built-ins/String/prototype/fixed/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/fixed/this-val-tostring-err.js
new file mode 100644
index 0000000000..885fcedc6b
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/fixed/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.fixed
+es6id: B.2.3.6
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.fixed.call(thisVal);
+});
diff --git a/test/annexB/built-ins/String/prototype/fontcolor/B.2.3.7.js b/test/annexB/built-ins/String/prototype/fontcolor/B.2.3.7.js
index 4bc59d21ad..10d1fce9bf 100644
--- a/test/annexB/built-ins/String/prototype/fontcolor/B.2.3.7.js
+++ b/test/annexB/built-ins/String/prototype/fontcolor/B.2.3.7.js
@@ -26,4 +26,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.fontcolor.call(null);
 });
-assert.sameValue(String.prototype.fontcolor.length, 1);
diff --git a/test/annexB/built-ins/String/prototype/fontcolor/attr-tostring-err.js b/test/annexB/built-ins/String/prototype/fontcolor/attr-tostring-err.js
new file mode 100644
index 0000000000..3aaaac7d85
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/fontcolor/attr-tostring-err.js
@@ -0,0 +1,23 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.fontcolor
+es6id: B.2.3.7
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    [...]
+    4. If attribute is not the empty String, then
+       a. Let V be ? ToString(value).
+---*/
+
+var attr = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  ''.fontcolor(attr);
+});
diff --git a/test/annexB/built-ins/String/prototype/fontcolor/prop-desc.js b/test/annexB/built-ins/String/prototype/fontcolor/prop-desc.js
new file mode 100644
index 0000000000..9bc83e2f10
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/fontcolor/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.fontcolor
+es6id: B.2.3.7
+description: Property descriptor for String.prototype.fontcolor
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'fontcolor');
+verifyWritable(String.prototype, 'fontcolor');
+verifyConfigurable(String.prototype, 'fontcolor');
diff --git a/test/annexB/built-ins/String/prototype/fontcolor/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/fontcolor/this-val-tostring-err.js
new file mode 100644
index 0000000000..adb03bc2f3
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/fontcolor/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.fontcolor
+es6id: B.2.3.7
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.fontcolor.call(thisVal);
+});
diff --git a/test/annexB/built-ins/String/prototype/fontsize/B.2.3.8.js b/test/annexB/built-ins/String/prototype/fontsize/B.2.3.8.js
index f966275b87..d70c72b6dd 100644
--- a/test/annexB/built-ins/String/prototype/fontsize/B.2.3.8.js
+++ b/test/annexB/built-ins/String/prototype/fontsize/B.2.3.8.js
@@ -26,4 +26,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.fontsize.call(null);
 });
-assert.sameValue(String.prototype.fontsize.length, 1);
diff --git a/test/annexB/built-ins/String/prototype/fontsize/attr-tostring-err.js b/test/annexB/built-ins/String/prototype/fontsize/attr-tostring-err.js
new file mode 100644
index 0000000000..5e8fc6c975
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/fontsize/attr-tostring-err.js
@@ -0,0 +1,23 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.fontsize
+es6id: B.2.3.8
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    [...]
+    4. If attribute is not the empty String, then
+       a. Let V be ? ToString(value).
+---*/
+
+var attr = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  ''.fontsize(attr);
+});
diff --git a/test/annexB/built-ins/String/prototype/fontsize/prop-desc.js b/test/annexB/built-ins/String/prototype/fontsize/prop-desc.js
new file mode 100644
index 0000000000..c6c3c4beda
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/fontsize/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.fontsize
+es6id: B.2.3.8
+description: Property descriptor for String.prototype.fontsize
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'fontsize');
+verifyWritable(String.prototype, 'fontsize');
+verifyConfigurable(String.prototype, 'fontsize');
diff --git a/test/annexB/built-ins/String/prototype/fontsize/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/fontsize/this-val-tostring-err.js
new file mode 100644
index 0000000000..318d6afdf3
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/fontsize/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.fontsize
+es6id: B.2.3.8
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.fontsize.call(thisVal);
+});
diff --git a/test/annexB/built-ins/String/prototype/italics/B.2.3.9.js b/test/annexB/built-ins/String/prototype/italics/B.2.3.9.js
index e81cd0f1e3..ea7c1e1360 100644
--- a/test/annexB/built-ins/String/prototype/italics/B.2.3.9.js
+++ b/test/annexB/built-ins/String/prototype/italics/B.2.3.9.js
@@ -21,4 +21,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.italics.call(null);
 });
-assert.sameValue(String.prototype.italics.length, 0);
diff --git a/test/annexB/built-ins/String/prototype/italics/prop-desc.js b/test/annexB/built-ins/String/prototype/italics/prop-desc.js
new file mode 100644
index 0000000000..73b5fba41e
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/italics/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.italics
+es6id: B.2.3.9
+description: Property descriptor for String.prototype.italics
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'italics');
+verifyWritable(String.prototype, 'italics');
+verifyConfigurable(String.prototype, 'italics');
diff --git a/test/annexB/built-ins/String/prototype/italics/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/italics/this-val-tostring-err.js
new file mode 100644
index 0000000000..8265772f71
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/italics/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.italics
+es6id: B.2.3.9
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.italics.call(thisVal);
+});
diff --git a/test/annexB/built-ins/String/prototype/link/B.2.3.10.js b/test/annexB/built-ins/String/prototype/link/B.2.3.10.js
index 58b1118dc9..c9a798e706 100644
--- a/test/annexB/built-ins/String/prototype/link/B.2.3.10.js
+++ b/test/annexB/built-ins/String/prototype/link/B.2.3.10.js
@@ -7,7 +7,7 @@
 /*---
  description: >
      String.prototype.link returns a string of HTML describing a single HTML
-     anchor element. The element's content is the `this` value of the function
+     link element. The element's content is the `this` value of the function
      invocation, coerced to a string. If specified, the first argument will be
      coerced to a string, escaped, and set as the element's `href` attribute.
  es6id: B.2.3.10
@@ -24,4 +24,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.link.call(null);
 });
-assert.sameValue(String.prototype.link.length, 1);
diff --git a/test/annexB/built-ins/String/prototype/link/attr-tostring-err.js b/test/annexB/built-ins/String/prototype/link/attr-tostring-err.js
new file mode 100644
index 0000000000..e863036093
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/link/attr-tostring-err.js
@@ -0,0 +1,23 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.link
+es6id: B.2.3.10
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    [...]
+    4. If attribute is not the empty String, then
+       a. Let V be ? ToString(value).
+---*/
+
+var attr = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  ''.link(attr);
+});
diff --git a/test/annexB/built-ins/String/prototype/link/prop-desc.js b/test/annexB/built-ins/String/prototype/link/prop-desc.js
new file mode 100644
index 0000000000..30b46b9d5f
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/link/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.link
+es6id: B.2.3.10
+description: Property descriptor for String.prototype.link
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'link');
+verifyWritable(String.prototype, 'link');
+verifyConfigurable(String.prototype, 'link');
diff --git a/test/annexB/built-ins/String/prototype/link/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/link/this-val-tostring-err.js
new file mode 100644
index 0000000000..b58290af92
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/link/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.link
+es6id: B.2.3.10
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.link.call(thisVal);
+});
diff --git a/test/annexB/built-ins/String/prototype/small/B.2.3.11.js b/test/annexB/built-ins/String/prototype/small/B.2.3.11.js
index 2fc9a85a8a..70f2e2c70f 100644
--- a/test/annexB/built-ins/String/prototype/small/B.2.3.11.js
+++ b/test/annexB/built-ins/String/prototype/small/B.2.3.11.js
@@ -21,4 +21,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.small.call(null);
 });
-assert.sameValue(String.prototype.small.length, 0);
diff --git a/test/annexB/built-ins/String/prototype/small/prop-desc.js b/test/annexB/built-ins/String/prototype/small/prop-desc.js
new file mode 100644
index 0000000000..ad765ee3a0
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/small/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.small
+es6id: B.2.3.11
+description: Property descriptor for String.prototype.small
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'small');
+verifyWritable(String.prototype, 'small');
+verifyConfigurable(String.prototype, 'small');
diff --git a/test/annexB/built-ins/String/prototype/small/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/small/this-val-tostring-err.js
new file mode 100644
index 0000000000..2fa1eed148
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/small/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.small
+es6id: B.2.3.11
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.small.call(thisVal);
+});
diff --git a/test/annexB/built-ins/String/prototype/strike/B.2.3.12.js b/test/annexB/built-ins/String/prototype/strike/B.2.3.12.js
index 6dee590e6c..ea51fe80c9 100644
--- a/test/annexB/built-ins/String/prototype/strike/B.2.3.12.js
+++ b/test/annexB/built-ins/String/prototype/strike/B.2.3.12.js
@@ -21,4 +21,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.strike.call(null);
 });
-assert.sameValue(String.prototype.strike.length, 0);
diff --git a/test/annexB/built-ins/String/prototype/strike/prop-desc.js b/test/annexB/built-ins/String/prototype/strike/prop-desc.js
new file mode 100644
index 0000000000..e9902e8d7c
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/strike/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.strike
+es6id: B.2.3.12
+description: Property descriptor for String.prototype.strike
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'strike');
+verifyWritable(String.prototype, 'strike');
+verifyConfigurable(String.prototype, 'strike');
diff --git a/test/annexB/built-ins/String/prototype/strike/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/strike/this-val-tostring-err.js
new file mode 100644
index 0000000000..e61a0e4f52
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/strike/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.strike
+es6id: B.2.3.12
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.strike.call(thisVal);
+});
diff --git a/test/annexB/built-ins/String/prototype/sub/B.2.3.13.js b/test/annexB/built-ins/String/prototype/sub/B.2.3.13.js
index 64a9c830cd..b6dda91664 100644
--- a/test/annexB/built-ins/String/prototype/sub/B.2.3.13.js
+++ b/test/annexB/built-ins/String/prototype/sub/B.2.3.13.js
@@ -21,4 +21,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.sub.call(null);
 });
-assert.sameValue(String.prototype.sub.length, 0);
diff --git a/test/annexB/built-ins/String/prototype/sub/prop-desc.js b/test/annexB/built-ins/String/prototype/sub/prop-desc.js
new file mode 100644
index 0000000000..680844024b
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/sub/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.sub
+es6id: B.2.3.13
+description: Property descriptor for String.prototype.sub
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'sub');
+verifyWritable(String.prototype, 'sub');
+verifyConfigurable(String.prototype, 'sub');
diff --git a/test/annexB/built-ins/String/prototype/sub/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/sub/this-val-tostring-err.js
new file mode 100644
index 0000000000..e5355bb9db
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/sub/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.sub
+es6id: B.2.3.13
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.sub.call(thisVal);
+});
diff --git a/test/annexB/built-ins/String/prototype/sup/B.2.3.14.js b/test/annexB/built-ins/String/prototype/sup/B.2.3.14.js
index f20c3b705c..b08da85427 100644
--- a/test/annexB/built-ins/String/prototype/sup/B.2.3.14.js
+++ b/test/annexB/built-ins/String/prototype/sup/B.2.3.14.js
@@ -21,4 +21,3 @@ assert.throws(TypeError, function() {
 assert.throws(TypeError, function() {
   String.prototype.sup.call(null);
 });
-assert.sameValue(String.prototype.sup.length, 0);
diff --git a/test/annexB/built-ins/String/prototype/sup/prop-desc.js b/test/annexB/built-ins/String/prototype/sup/prop-desc.js
new file mode 100644
index 0000000000..72894c2206
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/sup/prop-desc.js
@@ -0,0 +1,16 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.sup
+es6id: B.2.3.14
+description: Property descriptor for String.prototype.sup
+info: >
+    Every other data property described in clauses 18 through 26 and in Annex
+    B.2 has the attributes { [[Writable]]: true, [[Enumerable]]: false,
+    [[Configurable]]: true } unless otherwise specified.
+includes: [propertyHelper.js]
+---*/
+
+verifyNotEnumerable(String.prototype, 'sup');
+verifyWritable(String.prototype, 'sup');
+verifyConfigurable(String.prototype, 'sup');
diff --git a/test/annexB/built-ins/String/prototype/sup/this-val-tostring-err.js b/test/annexB/built-ins/String/prototype/sup/this-val-tostring-err.js
new file mode 100644
index 0000000000..06c38f5f86
--- /dev/null
+++ b/test/annexB/built-ins/String/prototype/sup/this-val-tostring-err.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2016 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+esid: sec-string.prototype.sup
+es6id: B.2.3.14
+description: Abrupt completion when coercing "this" value to string
+info: |
+    B.2.3.2.1 Runtime Semantics: CreateHTML
+
+    1. Let str be ? RequireObjectCoercible(string).
+    2. Let S be ? ToString(str).
+---*/
+
+var thisVal = {
+  toString: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  String.prototype.sup.call(thisVal);
+});