diff --git a/test/built-ins/Array/prototype/fill/Array.prototype.fill_basic.js b/test/built-ins/Array/prototype/fill/Array.prototype.fill_basic.js
deleted file mode 100644
index e19d3ab36e..0000000000
--- a/test/built-ins/Array/prototype/fill/Array.prototype.fill_basic.js
+++ /dev/null
@@ -1,31 +0,0 @@
-// Copyright (c) 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-/*---
-es6id: 22.1.3.6
-description: >
-    The fill() method fills all the elements of an array from a start
-    index to an end index with a static value.
-    https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/fill
-includes: [compareArray.js]
----*/
-assert.sameValue(1, Array.prototype.fill.length);
-
-assert(compareArray([].fill(8), []));
-assert(compareArray(
-  [0, 0, 0, 0, 0].fill(),
-  [undefined, undefined, undefined, undefined, undefined]
-));
-assert(compareArray([0, 0, 0, 0, 0].fill(8), [8, 8, 8, 8, 8]));
-assert(compareArray([0, 0, 0, 0, 0].fill(8, 1), [0, 8, 8, 8, 8]));
-assert(compareArray([0, 0, 0, 0, 0].fill(8, 10), [0, 0, 0, 0, 0]));
-assert(compareArray([0, 0, 0, 0, 0].fill(8, -5), [8, 8, 8, 8, 8]));
-assert(compareArray([0, 0, 0, 0, 0].fill(8, 1, 4), [0, 8, 8, 8, 0]));
-assert(compareArray([0, 0, 0, 0, 0].fill(8, 1, -1), [0, 8, 8, 8, 0]));
-assert(compareArray([0, 0, 0, 0, 0].fill(8, 1, 42), [0, 8, 8, 8, 8]));
-assert(compareArray([0, 0, 0, 0, 0].fill(8, -3, 42), [0, 0, 8, 8, 8]));
-assert(compareArray([0, 0, 0, 0, 0].fill(8, -3, 4), [0, 0, 8, 8, 0]));
-assert(compareArray([0, 0, 0, 0, 0].fill(8, -2, -1), [0, 0, 0, 8, 0]));
-assert(compareArray([0, 0, 0, 0, 0].fill(8, -1, -3), [0, 0, 0, 0, 0]));
-assert(compareArray([0, 0, 0, 0, 0].fill(8, undefined, 4), [8, 8, 8, 8, 0]));
-assert(compareArray([ ,  ,  ,  , 0].fill(8, 1, 3), [, 8, 8, , 0]));
diff --git a/test/built-ins/Array/prototype/fill/Array.prototype.fill_cannot-fill-frozen-array.js b/test/built-ins/Array/prototype/fill/Array.prototype.fill_cannot-fill-frozen-array.js
deleted file mode 100644
index e091c6c5d7..0000000000
--- a/test/built-ins/Array/prototype/fill/Array.prototype.fill_cannot-fill-frozen-array.js
+++ /dev/null
@@ -1,16 +0,0 @@
-// Copyright (c) 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-/*---
-es6id: 22.1.3.6
-description: >
-    The fill() method fills all the elements of an array from a start
-    index to an end index with a static value.
-
-    Cannot fill a frozen array
-
-    https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/fill
----*/
-assert.throws(TypeError, function() {
-  Object.freeze([0]).fill();
-});
diff --git a/test/built-ins/Array/prototype/fill/Array.prototype.fill_exceptions.js b/test/built-ins/Array/prototype/fill/Array.prototype.fill_exceptions.js
deleted file mode 100644
index 075c220c41..0000000000
--- a/test/built-ins/Array/prototype/fill/Array.prototype.fill_exceptions.js
+++ /dev/null
@@ -1,19 +0,0 @@
-// Copyright (c) 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-/*---
-es6id: 22.1.3.6
-description: >
-    The fill() method fills all the elements of an array from a start
-    index to an end index with a static value.
-
-    this value cannot be null or undefined
-
-    https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/fill
----*/
-assert.throws(TypeError, function() {
-  Array.prototype.fill.call(null);
-});
-assert.throws(TypeError, function() {
-  Array.prototype.fill.call(undefined);
-});
diff --git a/test/built-ins/Array/prototype/fill/S22.1.3.6_T1.js b/test/built-ins/Array/prototype/fill/S22.1.3.6_T1.js
deleted file mode 100644
index d4911fcbd2..0000000000
--- a/test/built-ins/Array/prototype/fill/S22.1.3.6_T1.js
+++ /dev/null
@@ -1,37 +0,0 @@
-// Copyright (c) 2014 Hank Yates. All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es6id: 22.1.3.6_T1
-description: Testing Array#fill
-author: Hank Yates (hankyates@gmail.com)
-includes: [runTestCase.js]
----*/
-
-runTestCase(function () {
-  var testArr = new Array('testString', 'anotherTestString', 3),
-      updatedArr = testArr.fill('newValue', 1, 3);
-
-  if (updatedArr[3] !== void 0) {
-    return false;
-  }
-
-  if (updatedArr[2] !== 'newValue') {
-    return false;
-  }
-
-  if (updatedArr[1] !== 'newValue') {
-    return false;
-  }
-
-  if (updatedArr[0] !== 'testString') {
-    return false;
-  }
-
-  if (updatedArr.length !== 3) {
-    return false;
-  }
-
-  return true;
-
-});
diff --git a/test/built-ins/Array/prototype/fill/coerced-indexes.js b/test/built-ins/Array/prototype/fill/coerced-indexes.js
new file mode 100644
index 0000000000..a8323cc8d1
--- /dev/null
+++ b/test/built-ins/Array/prototype/fill/coerced-indexes.js
@@ -0,0 +1,89 @@
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+es6id: 22.1.3.6
+description: >
+  Fills elements from coerced to Integer `start` and `end` values
+info: >
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  7. Let relativeStart be ToInteger(start).
+  8. ReturnIfAbrupt(relativeStart).
+  9. If relativeStart < 0, let k be max((len + relativeStart),0); else let k be
+  min(relativeStart, len).
+  10. If end is undefined, let relativeEnd be len; else let relativeEnd be
+  ToInteger(end).
+  ...
+includes: [compareArray.js]
+---*/
+
+assert(
+  compareArray([0, 0].fill(1, undefined), [1, 1]),
+  '`undefined` start coerced to 0'
+);
+
+assert(
+  compareArray([0, 0].fill(1, 0, undefined), [1, 1]),
+  'If end is undefined, let relativeEnd be len'
+);
+
+assert(
+  compareArray([0, 0].fill(1, null), [1, 1]),
+  '`null` start coerced to 0'
+);
+
+assert(
+  compareArray([0, 0].fill(1, 0, null), [0, 0]),
+  '`null` end coerced to 0'
+);
+
+assert(
+  compareArray([0, 0].fill(1, true), [0, 1]),
+  '`true` start coerced to 1'
+);
+
+assert(
+  compareArray([0, 0].fill(1, 0, true), [1, 0]),
+  '`true` end coerced to 1'
+);
+
+assert(
+  compareArray([0, 0].fill(1, false), [1, 1]),
+  '`false` start coerced to 0'
+);
+
+assert(
+  compareArray([0, 0].fill(1, 0, false), [0, 0]),
+  '`false` end coerced to 0'
+);
+
+assert(
+  compareArray([0, 0].fill(1, NaN), [1, 1]),
+  '`NaN` start coerced to 0'
+);
+
+assert(
+  compareArray([0, 0].fill(1, 0, NaN), [0, 0]),
+  '`NaN` end coerced to 0'
+);
+
+assert(
+  compareArray([0, 0].fill(1, '1'), [0, 1]),
+  'string start coerced'
+);
+
+assert(
+  compareArray([0, 0].fill(1, 0, '1'), [1, 0]),
+  'string end coerced'
+);
+
+assert(
+  compareArray([0, 0].fill(1, 1.5), [0, 1]),
+  'start as a float number coerced'
+);
+
+assert(
+  compareArray([0, 0].fill(1, 0, 1.5), [1, 0]),
+  'end as a float number coerced'
+);
diff --git a/test/built-ins/Array/prototype/fill/fill-values-custom-start-and-end.js b/test/built-ins/Array/prototype/fill/fill-values-custom-start-and-end.js
new file mode 100644
index 0000000000..f6165c1864
--- /dev/null
+++ b/test/built-ins/Array/prototype/fill/fill-values-custom-start-and-end.js
@@ -0,0 +1,26 @@
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+es6id: 22.1.3.6
+description: >
+  Fills all the elements from a with a custom start and end indexes.
+info: >
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  7. If relativeStart < 0, let k be max((len + relativeStart),0); else let k be
+  min(relativeStart, len).
+  8. If end is undefined, let relativeEnd be len; else let relativeEnd be
+  ToInteger(end).
+  9. ReturnIfAbrupt(relativeEnd).
+  10. If relativeEnd < 0, let final be max((len + relativeEnd),0); else let
+  final be min(relativeEnd, len).
+  ...
+includes: [compareArray.js]
+---*/
+
+assert(compareArray([0, 0, 0].fill(8, 1, 2), [0, 8, 0]));
+assert(compareArray([0, 0, 0, 0, 0].fill(8, -3, 4), [0, 0, 8, 8, 0]));
+assert(compareArray([0, 0, 0, 0, 0].fill(8, -2, -1), [0, 0, 0, 8, 0]));
+assert(compareArray([0, 0, 0, 0, 0].fill(8, -1, -3), [0, 0, 0, 0, 0]));
+assert(compareArray([ ,  ,  ,  , 0].fill(8, 1, 3), [, 8, 8, , 0]));
diff --git a/test/built-ins/Array/prototype/fill/fill-values-relative-end.js b/test/built-ins/Array/prototype/fill/fill-values-relative-end.js
new file mode 100644
index 0000000000..184ccc681b
--- /dev/null
+++ b/test/built-ins/Array/prototype/fill/fill-values-relative-end.js
@@ -0,0 +1,33 @@
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+es6id: 22.1.3.6
+description: >
+  Fills all the elements from a with a custom start index.
+info: >
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  8. If end is undefined, let relativeEnd be len; else let relativeEnd be
+  ToInteger(end).
+  9. ReturnIfAbrupt(relativeEnd).
+  10. If relativeEnd < 0, let final be max((len + relativeEnd),0); else let
+  final be min(relativeEnd, len).
+  ...
+includes: [compareArray.js]
+---*/
+
+assert(
+  compareArray([0, 0, 0].fill(8, 0, 1), [8, 0, 0]),
+  'Fill elements from custom end position'
+);
+
+assert(
+  compareArray([0, 0, 0].fill(8, 0, -1), [8, 8, 0]),
+  'negative end sets final position to max((this.length + relativeEnd), 0)'
+);
+
+assert(
+  compareArray([0, 0, 0].fill(8, 0, 5), [8, 8, 8]),
+  'end position is never higher than of this.length'
+);
diff --git a/test/built-ins/Array/prototype/fill/fill-values-relative-start.js b/test/built-ins/Array/prototype/fill/fill-values-relative-start.js
new file mode 100644
index 0000000000..4c8b7571e4
--- /dev/null
+++ b/test/built-ins/Array/prototype/fill/fill-values-relative-start.js
@@ -0,0 +1,30 @@
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+es6id: 22.1.3.6
+description: >
+  Fills all the elements from a with a custom start index.
+info: >
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  7. If relativeStart < 0, let k be max((len + relativeStart),0); else let k be
+  min(relativeStart, len).
+  ...
+includes: [compareArray.js]
+---*/
+
+assert(
+  compareArray([0, 0, 0].fill(8, 1), [0, 8, 8]),
+  'Fill elements from custom start position'
+);
+
+assert(
+  compareArray([0, 0, 0].fill(8, 4), [0, 0, 0]),
+  'start position is never higher than this.length'
+);
+
+assert(
+  compareArray([0, 0, 0].fill(8, -1), [0, 0, 8]),
+  'negative start sets initial position to max((this.length + relativeStart),0)'
+);
diff --git a/test/built-ins/Array/prototype/fill/fill-values.js b/test/built-ins/Array/prototype/fill/fill-values.js
new file mode 100644
index 0000000000..702be31993
--- /dev/null
+++ b/test/built-ins/Array/prototype/fill/fill-values.js
@@ -0,0 +1,37 @@
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+es6id: 22.1.3.6
+description: >
+  Fills all the elements with `value` from a defaul start and index.
+info: >
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  7. If relativeStart < 0, let k be max((len + relativeStart),0); else let k be
+  min(relativeStart, len).
+  8. If end is undefined, let relativeEnd be len; else let relativeEnd be
+  ToInteger(end).
+  9. ReturnIfAbrupt(relativeEnd).
+  10. If relativeEnd < 0, let final be max((len + relativeEnd),0); else let
+  final be min(relativeEnd, len).
+  11. Repeat, while k < final
+    a. Let Pk be ToString(k).
+    b. Let setStatus be Set(O, Pk, value, true).
+    c. ReturnIfAbrupt(setStatus).
+    d. Increase k by 1.
+  12. Return O.
+includes: [compareArray.js]
+---*/
+
+assert(compareArray([].fill(8), []));
+
+assert(compareArray(
+  [0, 0].fill(),
+  [undefined, undefined]
+));
+
+assert(
+  compareArray([0, 0, 0].fill(8), [8, 8, 8]),
+  'Default start and end indexes are 0 and this.length'
+);
diff --git a/test/built-ins/Array/prototype/fill/fill.js b/test/built-ins/Array/prototype/fill/fill.js
new file mode 100644
index 0000000000..5b632fe681
--- /dev/null
+++ b/test/built-ins/Array/prototype/fill/fill.js
@@ -0,0 +1,19 @@
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+es6id: 22.1.3.6
+description: Property type and descriptor.
+info: >
+  17 ECMAScript Standard Built-in Objects
+includes: [propertyHelper.js]
+---*/
+
+assert.sameValue(
+  typeof Array.prototype.fill,
+  'function',
+  '`typeof Array.prototype.fill` is `function`'
+);
+
+verifyNotEnumerable(Array.prototype, 'fill');
+verifyWritable(Array.prototype, 'fill');
+verifyConfigurable(Array.prototype, 'fill');
diff --git a/test/built-ins/Array/prototype/fill/length.js b/test/built-ins/Array/prototype/fill/length.js
new file mode 100644
index 0000000000..b0cccf4e38
--- /dev/null
+++ b/test/built-ins/Array/prototype/fill/length.js
@@ -0,0 +1,18 @@
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+es6id: 22.1.3.6
+description: Array.prototype.fill.length value and descriptor.
+info: >
+  17 ECMAScript Standard Built-in Objects
+includes: [propertyHelper.js]
+---*/
+
+assert.sameValue(
+  Array.prototype.fill.length, 1,
+  'The value of `Array.prototype.fill.length` is `1`'
+);
+
+verifyNotEnumerable(Array.prototype.fill, 'length');
+verifyNotWritable(Array.prototype.fill, 'length');
+verifyConfigurable(Array.prototype.fill, 'length');
diff --git a/test/built-ins/Array/prototype/fill/name.js b/test/built-ins/Array/prototype/fill/name.js
new file mode 100644
index 0000000000..19a94fc21e
--- /dev/null
+++ b/test/built-ins/Array/prototype/fill/name.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+es6id: 22.1.3.6
+description: >
+  Array.prototype.fill.name value and descriptor.
+info: >
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  17 ECMAScript Standard Built-in Objects
+
+includes: [propertyHelper.js]
+---*/
+
+assert.sameValue(
+  Array.prototype.fill.name, 'fill',
+  'The value of `Array.prototype.fill.name` is `"fill"`'
+);
+
+verifyNotEnumerable(Array.prototype.fill, 'name');
+verifyNotWritable(Array.prototype.fill, 'name');
+verifyConfigurable(Array.prototype.fill, 'name');
diff --git a/test/built-ins/Array/prototype/fill/return-abrupt-from-end-as-symbol.js b/test/built-ins/Array/prototype/fill/return-abrupt-from-end-as-symbol.js
new file mode 100644
index 0000000000..0be63f01a6
--- /dev/null
+++ b/test/built-ins/Array/prototype/fill/return-abrupt-from-end-as-symbol.js
@@ -0,0 +1,22 @@
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+es6id: 22.1.3.6
+description: >
+  Return abrupt from ToInteger(end) as a Symbol.
+info: >
+  22.1.3.6 Array.prototype.fill (value [ , end [ , end ] ] )
+
+  ...
+  8. If end is undefined, let relativeEnd be len; else let relativeEnd be
+  ToInteger(end).
+  9. ReturnIfAbrupt(relativeEnd).
+  ...
+features: [Symbol]
+---*/
+
+var end = Symbol(1);
+
+assert.throws(TypeError, function() {
+  [].fill(1, 0, end);
+});
diff --git a/test/built-ins/Array/prototype/fill/return-abrupt-from-end.js b/test/built-ins/Array/prototype/fill/return-abrupt-from-end.js
new file mode 100644
index 0000000000..e6c0bdb76f
--- /dev/null
+++ b/test/built-ins/Array/prototype/fill/return-abrupt-from-end.js
@@ -0,0 +1,25 @@
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+es6id: 22.1.3.6
+description: >
+  Return abrupt from ToInteger(end).
+info: >
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  8. If end is undefined, let relativeEnd be len; else let relativeEnd be
+  ToInteger(end).
+  9. ReturnIfAbrupt(relativeEnd).
+  ...
+---*/
+
+var end = {
+  valueOf: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  [].fill(1, 0, end);
+});
diff --git a/test/built-ins/Array/prototype/fill/return-abrupt-from-setting-property-value.js b/test/built-ins/Array/prototype/fill/return-abrupt-from-setting-property-value.js
new file mode 100644
index 0000000000..53e478f018
--- /dev/null
+++ b/test/built-ins/Array/prototype/fill/return-abrupt-from-setting-property-value.js
@@ -0,0 +1,34 @@
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+es6id: 22.1.3.6
+description: >
+  Return abrupt from setting a property value.
+info: >
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  11. Repeat, while k < final
+    a. Let Pk be ToString(k).
+    b. Let setStatus be Set(O, Pk, value, true).
+    c. ReturnIfAbrupt(setStatus).
+  ...
+---*/
+
+var a1 = [];
+Object.freeze(a1);
+
+// won't break on an empty array.
+a1.fill(1);
+
+var a2 = {
+  length: 1
+};
+Object.defineProperty(a2, '0', {
+  set: function() {
+    throw new Test262Error();
+  }
+})
+assert.throws(Test262Error, function() {
+  Array.prototype.fill.call(a2);
+});
diff --git a/test/built-ins/Array/prototype/fill/return-abrupt-from-start-as-symbol.js b/test/built-ins/Array/prototype/fill/return-abrupt-from-start-as-symbol.js
new file mode 100644
index 0000000000..891bc7e0cd
--- /dev/null
+++ b/test/built-ins/Array/prototype/fill/return-abrupt-from-start-as-symbol.js
@@ -0,0 +1,21 @@
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+es6id: 22.1.3.6
+description: >
+  Return abrupt from ToInteger(start) as a Symbol.
+info: >
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  5. Let relativeStart be ToInteger(start).
+  6. ReturnIfAbrupt(relativeStart).
+  ...
+features: [Symbol]
+---*/
+
+var start = Symbol(1);
+
+assert.throws(TypeError, function() {
+  [].fill(1, start);
+});
diff --git a/test/built-ins/Array/prototype/fill/return-abrupt-from-start.js b/test/built-ins/Array/prototype/fill/return-abrupt-from-start.js
new file mode 100644
index 0000000000..a31a04f2f1
--- /dev/null
+++ b/test/built-ins/Array/prototype/fill/return-abrupt-from-start.js
@@ -0,0 +1,24 @@
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+es6id: 22.1.3.6
+description: >
+  Return abrupt from ToInteger(start).
+info: >
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  ...
+  5. Let relativeStart be ToInteger(start).
+  6. ReturnIfAbrupt(relativeStart).
+  ...
+---*/
+
+var start = {
+  valueOf: function() {
+    throw new Test262Error();
+  }
+};
+
+assert.throws(Test262Error, function() {
+  [].fill(1, start);
+});
diff --git a/test/built-ins/Array/prototype/fill/return-abrupt-from-this-length-as-symbol.js b/test/built-ins/Array/prototype/fill/return-abrupt-from-this-length-as-symbol.js
new file mode 100644
index 0000000000..f8ba7cab38
--- /dev/null
+++ b/test/built-ins/Array/prototype/fill/return-abrupt-from-this-length-as-symbol.js
@@ -0,0 +1,24 @@
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+es6id: 22.1.3.6
+description: >
+  Return abrupt from ToLength(Get(O, "length")) where length is a Symbol.
+info: >
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  1. Let O be ToObject(this value).
+  2. ReturnIfAbrupt(O).
+  3. Let len be ToLength(Get(O, "length")).
+  4. ReturnIfAbrupt(len).
+features: [Symbol]
+---*/
+
+var o = {};
+
+o.length = Symbol(1);
+
+// value argument is given to avoid false positives
+assert.throws(TypeError, function() {
+  [].fill.call(o, 1);
+});
diff --git a/test/built-ins/Array/prototype/fill/return-abrupt-from-this-length.js b/test/built-ins/Array/prototype/fill/return-abrupt-from-this-length.js
new file mode 100644
index 0000000000..1325cb90b0
--- /dev/null
+++ b/test/built-ins/Array/prototype/fill/return-abrupt-from-this-length.js
@@ -0,0 +1,37 @@
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+es6id: 22.1.3.6
+description: >
+  Return abrupt from ToLength(Get(O, "length")).
+info: >
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  1. Let O be ToObject(this value).
+  2. ReturnIfAbrupt(O).
+  3. Let len be ToLength(Get(O, "length")).
+  4. ReturnIfAbrupt(len).
+---*/
+
+var o1 = {};
+
+Object.defineProperty(o1, 'length', {
+  get: function() {
+    throw new Test262Error();
+  },
+  configurable: true
+});
+assert.throws(Test262Error, function() {
+  [].fill.call(o1, 1);
+});
+
+var o2 = {
+  length: {
+    valueOf: function() {
+      throw new Test262Error();
+    }
+  }
+};
+assert.throws(Test262Error, function() {
+  [].fill.call(o2, 1);
+});
diff --git a/test/built-ins/Array/prototype/fill/return-abrupt-from-this.js b/test/built-ins/Array/prototype/fill/return-abrupt-from-this.js
new file mode 100644
index 0000000000..7de04a410a
--- /dev/null
+++ b/test/built-ins/Array/prototype/fill/return-abrupt-from-this.js
@@ -0,0 +1,20 @@
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+es6id: 22.1.3.6
+description: >
+  Return abrupt from ToObject(this value).
+info: >
+  22.1.3.6 Array.prototype.fill (value [ , start [ , end ] ] )
+
+  1. Let O be ToObject(this value).
+  2. ReturnIfAbrupt(O).
+---*/
+
+assert.throws(TypeError, function() {
+  Array.prototype.fill.call(undefined, 1);
+});
+
+assert.throws(TypeError, function() {
+  Array.prototype.fill.call(null, 1);
+});
diff --git a/test/built-ins/Array/prototype/fill/return-this.js b/test/built-ins/Array/prototype/fill/return-this.js
new file mode 100644
index 0000000000..7d00936aa8
--- /dev/null
+++ b/test/built-ins/Array/prototype/fill/return-this.js
@@ -0,0 +1,20 @@
+// Copyright (C) 2015 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+es6id: 22.1.3.6
+description: >
+  Returns `this`.
+info: >
+  12. Return O.
+---*/
+
+var arr = [];
+var result = arr.fill(1);
+
+assert.sameValue(result, arr);
+
+var o = {
+  length: 0
+};
+result = Array.prototype.fill.call(o);
+assert.sameValue(result, o);