diff --git a/WebIDL/ecmascript-binding/class-string-interface.any.js b/WebIDL/ecmascript-binding/class-string-interface.any.js
new file mode 100644
index 00000000000000..ee792d5368389b
--- /dev/null
+++ b/WebIDL/ecmascript-binding/class-string-interface.any.js
@@ -0,0 +1,62 @@
+"use strict";
+
+test(() => {
+  assert_own_property(Blob.prototype, Symbol.toStringTag);
+
+  const propDesc = Object.getOwnPropertyDescriptor(Blob.prototype, Symbol.toStringTag);
+  assert_equals(propDesc.value, "Blob", "value");
+  assert_equals(propDesc.configurable, true, "configurable");
+  assert_equals(propDesc.enumerable, false, "enumerable");
+  assert_equals(propDesc.writable, false, "writable");
+}, "@@toStringTag exists on the prototype with the appropriate descriptor");
+
+test(() => {
+  assert_not_own_property(new Blob(), Symbol.toStringTag);
+}, "@@toStringTag must not exist on the instance");
+
+test(() => {
+  assert_equals(Object.prototype.toString.call(Blob.prototype), "[object Blob]");
+}, "Object.prototype.toString applied to the prototype");
+
+test(() => {
+  assert_equals(Object.prototype.toString.call(new Blob()), "[object Blob]");
+}, "Object.prototype.toString applied to an instance");
+
+test(t => {
+  assert_own_property(Blob.prototype, Symbol.toStringTag, "Precondition for this test: @@toStringTag on the prototype");
+
+  t.add_cleanup(() => {
+    Object.defineProperty(Blob.prototype, Symbol.toStringTag, { value: "Blob" });
+  });
+
+  Object.defineProperty(Blob.prototype, Symbol.toStringTag, { value: "NotABlob" });
+  assert_equals(Object.prototype.toString.call(Blob.prototype), "[object NotABlob]", "prototype");
+  assert_equals(Object.prototype.toString.call(new Blob()), "[object NotABlob]", "instance");
+}, "Object.prototype.toString applied after modifying the prototype's @@toStringTag");
+
+test(t => {
+  const instance = new Blob();
+  assert_not_own_property(instance, Symbol.toStringTag, "Precondition for this test: no @@toStringTag on the instance");
+
+  Object.defineProperty(instance, Symbol.toStringTag, { value: "NotABlob" });
+  assert_equals(Object.prototype.toString.call(instance), "[object NotABlob]");
+}, "Object.prototype.toString applied to the instance after modifying the instance's @@toStringTag");
+
+// Chrome had a bug (https://bugs.chromium.org/p/chromium/issues/detail?id=793406) where if there
+// was no @@toStringTag in the prototype, it would fall back to a magic class string. This tests
+// that the bug is fixed.
+
+test(() => {
+  const instance = new Blob();
+  Object.setPrototypeOf(instance, null);
+
+  assert_equals(Object.prototype.toString.call(instance), "[object Object]");
+}, "Object.prototype.toString applied to a null-prototype instance");
+
+// This test must be last.
+test(() => {
+  delete Blob.prototype[Symbol.toStringTag];
+
+  assert_equals(Object.prototype.toString.call(Blob.prototype), "[object Object]", "prototype");
+  assert_equals(Object.prototype.toString.call(new Blob()), "[object Object]", "instance");
+}, "Object.prototype.toString applied after deleting @@toStringTag");
diff --git a/WebIDL/ecmascript-binding/class-string-iterator-prototype-object.any.js b/WebIDL/ecmascript-binding/class-string-iterator-prototype-object.any.js
new file mode 100644
index 00000000000000..2185ae0bb7bac6
--- /dev/null
+++ b/WebIDL/ecmascript-binding/class-string-iterator-prototype-object.any.js
@@ -0,0 +1,50 @@
+"use strict";
+
+const iteratorProto = Object.getPrototypeOf((new URLSearchParams()).entries());
+
+test(() => {
+  assert_own_property(iteratorProto, Symbol.toStringTag);
+
+  const propDesc = Object.getOwnPropertyDescriptor(iteratorProto, Symbol.toStringTag);
+  assert_equals(propDesc.value, "URLSearchParams Iterator", "value");
+  assert_equals(propDesc.configurable, true, "configurable");
+  assert_equals(propDesc.enumerable, false, "enumerable");
+  assert_equals(propDesc.writable, false, "writable");
+}, "@@toStringTag exists with the appropriate descriptor");
+
+test(() => {
+  assert_equals(Object.prototype.toString.call(iteratorProto), "[object URLSearchParams Iterator]");
+}, "Object.prototype.toString");
+
+test(t => {
+  assert_own_property(iteratorProto, Symbol.toStringTag, "Precondition for this test: @@toStringTag exists");
+
+  t.add_cleanup(() => {
+    Object.defineProperty(iteratorProto, Symbol.toStringTag, { value: "URLSearchParams Iterator" });
+  });
+
+  Object.defineProperty(iteratorProto, Symbol.toStringTag, { value: "Not URLSearchParams Iterator" });
+  assert_equals(Object.prototype.toString.call(iteratorProto), "[object Not URLSearchParams Iterator]");
+}, "Object.prototype.toString applied after modifying @@toStringTag");
+
+// Chrome had a bug (https://bugs.chromium.org/p/chromium/issues/detail?id=793406) where if there
+// was no @@toStringTag, it would fall back to a magic class string. This tests that the bug is
+// fixed.
+
+test(t => {
+  const proto = Object.getPrototypeOf(iteratorProto);
+  t.add_cleanup(() => {
+    Object.setPrototypeOf(iteratorProto, proto);
+  });
+
+  Object.setPrototypeOf(iteratorProto, null);
+
+  assert_equals(Object.prototype.toString.call(iteratorProto), "[object Object]");
+}, "Object.prototype.toString applied after nulling the prototype");
+
+// This test must be last.
+test(() => {
+  delete iteratorProto[Symbol.toStringTag];
+
+  assert_equals(Object.prototype.toString.call(iteratorProto), "[object Object]", "prototype");
+}, "Object.prototype.toString applied after deleting @@toStringTag");
diff --git a/WebIDL/ecmascript-binding/class-string-named-properties-object.window.js b/WebIDL/ecmascript-binding/class-string-named-properties-object.window.js
new file mode 100644
index 00000000000000..ad466188baed43
--- /dev/null
+++ b/WebIDL/ecmascript-binding/class-string-named-properties-object.window.js
@@ -0,0 +1,42 @@
+"use strict";
+
+const namedPropertiesObject = Object.getPrototypeOf(Window.prototype);
+
+test(() => {
+  assert_own_property(namedPropertiesObject, Symbol.toStringTag);
+
+  const propDesc = Object.getOwnPropertyDescriptor(namedPropertiesObject, Symbol.toStringTag);
+  assert_equals(propDesc.value, "WindowProperties", "value");
+  assert_equals(propDesc.configurable, true, "configurable");
+  assert_equals(propDesc.enumerable, false, "enumerable");
+  assert_equals(propDesc.writable, false, "writable");
+}, "@@toStringTag exists with the appropriate descriptor");
+
+test(() => {
+  assert_equals(Object.prototype.toString.call(namedPropertiesObject), "[object WindowProperties]");
+}, "Object.prototype.toString");
+
+test(t => {
+  assert_own_property(namedPropertiesObject, Symbol.toStringTag, "Precondition for this test: @@toStringTag exists");
+
+  t.add_cleanup(() => {
+    Object.defineProperty(namedPropertiesObject, Symbol.toStringTag, { value: "WindowProperties" });
+  });
+
+  Object.defineProperty(namedPropertiesObject, Symbol.toStringTag, { value: "NotWindowProperties" });
+  assert_equals(Object.prototype.toString.call(namedPropertiesObject), "[object NotWindowProperties]");
+}, "Object.prototype.toString applied after modifying @@toStringTag");
+
+// Chrome had a bug (https://bugs.chromium.org/p/chromium/issues/detail?id=793406) where if there
+// was no @@toStringTag, it would fall back to a magic class string. This tests that the bug is
+// fixed.
+
+// Note: we cannot null out the prototype of the named properties object per
+// https://heycam.github.io/webidl/#named-properties-object-setprototypeof so we don't have a test that does that.
+
+// This test must be last.
+test(() => {
+  delete namedPropertiesObject[Symbol.toStringTag];
+
+  assert_equals(Object.prototype.toString.call(namedPropertiesObject), "[object EventTarget]", "prototype");
+}, "Object.prototype.toString applied after deleting @@toStringTag");
diff --git a/WebIDL/ecmascript-binding/interface-prototype-object.html b/WebIDL/ecmascript-binding/interface-prototype-object.html
index 03ada7aa0d4d43..d2d43eda9a9468 100644
--- a/WebIDL/ecmascript-binding/interface-prototype-object.html
+++ b/WebIDL/ecmascript-binding/interface-prototype-object.html
@@ -5,18 +5,6 @@
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <script>
-// A specification issue was raised for this behavior.
-// https://www.w3.org/Bugs/Public/show_bug.cgi?id=28244
-test(function() {
-  // Checks toString() behavior.
-  assert_class_string(Document.prototype, "DocumentPrototype");
-
-  assert_true(Document.prototype.hasOwnProperty(Symbol.toStringTag),
-              "An interface prototype object should have toStringTag property.");
-  assert_equals(Document.prototype[Symbol.toStringTag], "DocumentPrototype");
-}, "The class string of an interface prototype object is the concatenation of " +
-   "the interface's identifier and the string 'Prototype'.");
-
 test(function() {
   // https://heycam.github.io/webidl/#create-an-interface-prototype-object
   assert_own_property(Element.prototype, Symbol.unscopables, "Element.prototype has @@unscopables.");
diff --git a/WebIDL/ecmascript-binding/iterator-prototype-object.html b/WebIDL/ecmascript-binding/iterator-prototype-object.html
index 466973dc08f0e3..7859c1e46ac464 100644
--- a/WebIDL/ecmascript-binding/iterator-prototype-object.html
+++ b/WebIDL/ecmascript-binding/iterator-prototype-object.html
@@ -37,16 +37,7 @@
   });
 }, "next() throws TypeError when called on ineligible receiver");
 
-test(() => {
-  const iteratorProto = Object.getPrototypeOf(new URLSearchParams().entries());
-  assert_equals(Object.prototype.toString.call(iteratorProto), "[object URLSearchParams Iterator]");
-}, "Object.prototype.toString returns correct value");
-
-test(() => {
-  const iteratorProto = Object.getPrototypeOf(new URLSearchParams().entries());
-  assert_equals(Object.getOwnPropertyDescriptor(iteratorProto, Symbol.toStringTag).value, "URLSearchParams Iterator");
-  // Property attributes have not yet been fully spec'd.
-}, "@@toStringTag has correct value");
+// class string behavior tested in a dedicated file
 
 test(() => {
   const iteratorProto1 = Object.getPrototypeOf(new URLSearchParams().entries());
diff --git a/html/browsers/the-window-object/window-prototype-chain.html b/html/browsers/the-window-object/window-prototype-chain.html
index d29a8e11f43c29..4cad9483003675 100644
--- a/html/browsers/the-window-object/window-prototype-chain.html
+++ b/html/browsers/the-window-object/window-prototype-chain.html
@@ -15,7 +15,6 @@
 }, "window object");
 test(function() {
   var proto = Object.getPrototypeOf(window);
-  assert_class_string(proto, "WindowPrototype");
   assert_equals(proto, Window.prototype);
 }, "Window.prototype");
 test(function() {
@@ -24,12 +23,10 @@
 }, "Global scope polluter");
 test(function() {
   var protoproto = Object.getPrototypeOf(Object.getPrototypeOf(Object.getPrototypeOf(window)));
-  assert_class_string(protoproto, "EventTargetPrototype");
   assert_equals(protoproto, EventTarget.prototype);
 }, "EventTarget.prototype");
 test(function() {
   var protoprotoproto = Object.getPrototypeOf(Object.getPrototypeOf(Object.getPrototypeOf(Object.getPrototypeOf(window))));
-  assert_class_string(protoprotoproto, "Object");
   assert_equals(protoprotoproto, Object.prototype);
 }, "Object.prototype");
 </script>