diff --git a/src/builtins/builtins-object-gen.cc b/src/builtins/builtins-object-gen.cc
index 0604549558..5a0174de38 100644
--- a/src/builtins/builtins-object-gen.cc
+++ b/src/builtins/builtins-object-gen.cc
@@ -709,12 +709,12 @@ TF_BUILTIN(ObjectPrototypeIsPrototypeOf, ObjectBuiltinsAssembler) {
 }
 
 TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
-  Label checkstringtag(this), if_arguments(this), if_array(this),
-      if_boolean(this), if_date(this), if_error(this), if_function(this),
-      if_number(this, Label::kDeferred), if_object(this), if_primitive(this),
-      if_proxy(this, Label::kDeferred), if_regexp(this), if_string(this),
-      if_symbol(this, Label::kDeferred), if_value(this),
-      if_bigint(this, Label::kDeferred);
+  Label checkstringtag(this), if_apiobject(this, Label::kDeferred),
+      if_arguments(this), if_array(this), if_boolean(this), if_date(this),
+      if_error(this), if_function(this), if_number(this, Label::kDeferred),
+      if_object(this), if_primitive(this), if_proxy(this, Label::kDeferred),
+      if_regexp(this), if_string(this), if_symbol(this, Label::kDeferred),
+      if_value(this), if_bigint(this, Label::kDeferred);
 
   TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
@@ -740,8 +740,8 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
                     {JS_ARGUMENTS_OBJECT_TYPE, &if_arguments},
                     {JS_DATE_TYPE, &if_date},
                     {JS_BOUND_FUNCTION_TYPE, &if_function},
-                    {JS_API_OBJECT_TYPE, &if_object},
-                    {JS_SPECIAL_API_OBJECT_TYPE, &if_object},
+                    {JS_API_OBJECT_TYPE, &if_apiobject},
+                    {JS_SPECIAL_API_OBJECT_TYPE, &if_apiobject},
                     {JS_PROXY_TYPE, &if_proxy},
                     {JS_ERROR_TYPE, &if_error},
                     {JS_PRIMITIVE_WRAPPER_TYPE, &if_value}};
@@ -755,6 +755,25 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
   Switch(receiver_instance_type, &if_object, case_values, case_labels,
          arraysize(case_values));
 
+  BIND(&if_apiobject);
+  {
+    // Lookup the @@toStringTag property on the {receiver}.
+    TVARIABLE(Object, var_tag,
+              GetProperty(context, receiver,
+                          isolate()->factory()->to_string_tag_symbol()));
+    Label if_tagisnotstring(this), if_tagisstring(this);
+    GotoIf(TaggedIsSmi(var_tag.value()), &if_tagisnotstring);
+    Branch(IsString(CAST(var_tag.value())), &if_tagisstring,
+           &if_tagisnotstring);
+    BIND(&if_tagisnotstring);
+    {
+      var_tag = CallRuntime(Runtime::kClassOf, context, receiver);
+      Goto(&if_tagisstring);
+    }
+    BIND(&if_tagisstring);
+    ReturnToStringFormat(context, CAST(var_tag.value()));
+  }
+
   BIND(&if_arguments);
   {
     var_default = ArgumentsToStringConstant();
diff --git a/src/debug/debug-evaluate.cc b/src/debug/debug-evaluate.cc
index d44abe8e41..bd1ac5df83 100644
--- a/src/debug/debug-evaluate.cc
+++ b/src/debug/debug-evaluate.cc
@@ -313,6 +313,7 @@ bool IntrinsicHasNoSideEffect(Runtime::FunctionId id) {
   V(ArrayIncludes_Slow)                       \
   V(ArrayIndexOf)                             \
   V(ArrayIsArray)                             \
+  V(ClassOf)                                  \
   V(GetFunctionName)                          \
   V(GetOwnPropertyDescriptor)                 \
   V(GlobalPrint)                              \
diff --git a/src/objects/js-objects.cc b/src/objects/js-objects.cc
index ec2b8aa513..80549b308f 100644
--- a/src/objects/js-objects.cc
+++ b/src/objects/js-objects.cc
@@ -405,6 +405,19 @@ String JSReceiver::class_name() {
   if (IsJSWeakSet()) return roots.WeakSet_string();
   if (IsJSGlobalProxy()) return roots.global_string();
 
+  Object maybe_constructor = map().GetConstructor();
+  if (maybe_constructor.IsJSFunction()) {
+    JSFunction constructor = JSFunction::cast(maybe_constructor);
+    if (constructor.shared().IsApiFunction()) {
+      maybe_constructor = constructor.shared().get_api_func_data();
+    }
+  }
+
+  if (maybe_constructor.IsFunctionTemplateInfo()) {
+    FunctionTemplateInfo info = FunctionTemplateInfo::cast(maybe_constructor);
+    if (info.class_name().IsString()) return String::cast(info.class_name());
+  }
+
   return roots.Object_string();
 }
 
@@ -428,6 +441,12 @@ std::pair<MaybeHandle<JSFunction>, Handle<String>> GetConstructorHelper(
         return std::make_pair(handle(constructor, isolate),
                               handle(name, isolate));
       }
+    } else if (maybe_constructor.IsFunctionTemplateInfo()) {
+      FunctionTemplateInfo info = FunctionTemplateInfo::cast(maybe_constructor);
+      if (info.class_name().IsString()) {
+        return std::make_pair(MaybeHandle<JSFunction>(),
+                              handle(String::cast(info.class_name()), isolate));
+      }
     }
   }
 
@@ -4491,13 +4510,14 @@ Maybe<bool> JSObject::SetPrototype(Handle<JSObject> object,
         NewTypeError(MessageTemplate::kImmutablePrototypeSet, object));
   }
 
-  // From 6.1.7.3 Invariants of the Essential Internal Methods
-  //
-  // [[SetPrototypeOf]] ( V )
-  // * ...
-  // * If target is non-extensible, [[SetPrototypeOf]] must return false,
-  //   unless V is the SameValue as the target's observed [[GetPrototypeOf]]
-  //   value.
+  // From 8.6.2 Object Internal Methods
+  // ...
+  // In addition, if [[Extensible]] is false the value of the [[Class]] and
+  // [[Prototype]] internal properties of the object may not be modified.
+  // ...
+  // Implementation specific extensions that modify [[Class]], [[Prototype]]
+  // or [[Extensible]] must not violate the invariants defined in the preceding
+  // paragraph.
   if (!all_extensible) {
     RETURN_FAILURE(isolate, should_throw,
                    NewTypeError(MessageTemplate::kNonExtensibleProto, object));
diff --git a/src/objects/js-objects.h b/src/objects/js-objects.h
index 40881c9138..418c12ac50 100644
--- a/src/objects/js-objects.h
+++ b/src/objects/js-objects.h
@@ -206,17 +206,15 @@ class JSReceiver : public HeapObject {
   V8_WARN_UNUSED_RESULT static Maybe<bool> IsExtensible(
       Handle<JSReceiver> object);
 
-  // Returns the class name.
+  // Returns the class name ([[Class]] property in the specification).
   V8_EXPORT_PRIVATE String class_name();
 
   // Returns the constructor (the function that was used to instantiate the
   // object).
   static MaybeHandle<JSFunction> GetConstructor(Handle<JSReceiver> receiver);
 
-  // Returns the constructor name (the (possibly inferred) name of the function
-  // that was used to instantiate the object), if any. If a FunctionTemplate is
-  // used to instantiate the object, the class_name of the FunctionTemplate is
-  // returned instead.
+  // Returns the constructor name (the name (possibly, inferred name) of the
+  // function that was used to instantiate the object).
   static Handle<String> GetConstructorName(Handle<JSReceiver> receiver);
 
   V8_EXPORT_PRIVATE Handle<NativeContext> GetCreationContext();
diff --git a/src/runtime/runtime-object.cc b/src/runtime/runtime-object.cc
index 30e6ad7cbe..71338b1d39 100644
--- a/src/runtime/runtime-object.cc
+++ b/src/runtime/runtime-object.cc
@@ -989,6 +989,14 @@ RUNTIME_FUNCTION(Runtime_IsJSReceiver) {
   return isolate->heap()->ToBoolean(obj.IsJSReceiver());
 }
 
+RUNTIME_FUNCTION(Runtime_ClassOf) {
+  SealHandleScope shs(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_CHECKED(Object, obj, 0);
+  if (!obj.IsJSReceiver()) return ReadOnlyRoots(isolate).null_value();
+  return JSReceiver::cast(obj).class_name();
+}
+
 RUNTIME_FUNCTION(Runtime_GetFunctionName) {
   HandleScope scope(isolate);
   DCHECK_EQ(1, args.length());
diff --git a/src/runtime/runtime.h b/src/runtime/runtime.h
index 67cec15c27..688143c4f5 100644
--- a/src/runtime/runtime.h
+++ b/src/runtime/runtime.h
@@ -285,6 +285,7 @@ namespace internal {
   F(AddPrivateField, 3, 1)                                      \
   F(AddPrivateBrand, 3, 1)                                      \
   F(AllocateHeapNumber, 0, 1)                                   \
+  F(ClassOf, 1, 1)                                              \
   F(CollectTypeProfile, 3, 1)                                   \
   F(CompleteInobjectSlackTrackingForMap, 1, 1)                  \
   I(CopyDataProperties, 2, 1)                                   \
diff --git a/test/cctest/test-api.cc b/test/cctest/test-api.cc
index faa963cb8b..518dd232c7 100644
--- a/test/cctest/test-api.cc
+++ b/test/cctest/test-api.cc
@@ -1075,23 +1075,20 @@ template<typename Constructor, typename Accessor>
 static void TestFunctionTemplateAccessor(Constructor constructor,
                                          Accessor accessor) {
   LocalContext env;
-  v8::Isolate* isolate = env->GetIsolate();
-  v8::HandleScope scope(isolate);
+  v8::HandleScope scope(env->GetIsolate());
 
   Local<v8::FunctionTemplate> fun_templ =
-      v8::FunctionTemplate::New(isolate, constructor);
-  fun_templ->PrototypeTemplate()->Set(
-      v8::Symbol::GetToStringTag(isolate), v8_str("funky"),
-      static_cast<v8::PropertyAttribute>(v8::ReadOnly | v8::DontEnum));
+      v8::FunctionTemplate::New(env->GetIsolate(), constructor);
+  fun_templ->SetClassName(v8_str("funky"));
   fun_templ->InstanceTemplate()->SetAccessor(v8_str("m"), accessor);
-
   Local<Function> fun = fun_templ->GetFunction(env.local()).ToLocalChecked();
   CHECK(env->Global()->Set(env.local(), v8_str("obj"), fun).FromJust());
-  Local<Value> result = CompileRun("(new obj()).toString()");
+  Local<Value> result =
+      v8_compile("(new obj()).toString()")->Run(env.local()).ToLocalChecked();
   CHECK(v8_str("[object funky]")->Equals(env.local(), result).FromJust());
   CompileRun("var obj_instance = new obj();");
-
-  Local<Script> script = v8_compile("obj_instance.x");
+  Local<Script> script;
+  script = v8_compile("obj_instance.x");
   for (int i = 0; i < 30; i++) {
     CHECK_EQ(1, v8_run_int32value(script));
   }
@@ -12636,20 +12633,22 @@ THREADED_TEST(NewTargetHandler) {
 }
 
 THREADED_TEST(ObjectProtoToString) {
-  LocalContext context;
   v8::Isolate* isolate = CcTest::isolate();
   v8::HandleScope scope(isolate);
   Local<v8::FunctionTemplate> templ = v8::FunctionTemplate::New(isolate);
   templ->SetClassName(v8_str("MyClass"));
 
+  LocalContext context;
 
   Local<String> customized_tostring = v8_str("customized toString");
 
   // Replace Object.prototype.toString
-  CompileRun(R"(
-      Object.prototype.toString = function() {
-        return 'customized toString';
-      })");
+  v8_compile(
+      "Object.prototype.toString = function() {"
+      "  return 'customized toString';"
+      "}")
+      ->Run(context.local())
+      .ToLocalChecked();
 
   // Normal ToString call should call replaced Object.prototype.toString
   Local<v8::Object> instance = templ->GetFunction(context.local())
@@ -12660,12 +12659,57 @@ THREADED_TEST(ObjectProtoToString) {
   CHECK(value->IsString() &&
         value->Equals(context.local(), customized_tostring).FromJust());
 
-  // ObjectProtoToString should not call replace toString function. It should
-  // not look at the class name either.
+  // ObjectProtoToString should not call replace toString function.
   value = instance->ObjectProtoToString(context.local()).ToLocalChecked();
+  CHECK(value->IsString() &&
+        value->Equals(context.local(), v8_str("[object MyClass]")).FromJust());
+
+  // Check global
+  value =
+      context->Global()->ObjectProtoToString(context.local()).ToLocalChecked();
   CHECK(value->IsString() &&
         value->Equals(context.local(), v8_str("[object Object]")).FromJust());
 
+  // Check ordinary object
+  Local<Value> object =
+      v8_compile("new Object()")->Run(context.local()).ToLocalChecked();
+  value = object.As<v8::Object>()
+              ->ObjectProtoToString(context.local())
+              .ToLocalChecked();
+  CHECK(value->IsString() &&
+        value->Equals(context.local(), v8_str("[object Object]")).FromJust());
+}
+
+
+TEST(ObjectProtoToStringES6) {
+  LocalContext context;
+  v8::Isolate* isolate = CcTest::isolate();
+  v8::HandleScope scope(isolate);
+  Local<v8::FunctionTemplate> templ = v8::FunctionTemplate::New(isolate);
+  templ->SetClassName(v8_str("MyClass"));
+
+  Local<String> customized_tostring = v8_str("customized toString");
+
+  // Replace Object.prototype.toString
+  CompileRun(
+      "Object.prototype.toString = function() {"
+      "  return 'customized toString';"
+      "}");
+
+  // Normal ToString call should call replaced Object.prototype.toString
+  Local<v8::Object> instance = templ->GetFunction(context.local())
+                                   .ToLocalChecked()
+                                   ->NewInstance(context.local())
+                                   .ToLocalChecked();
+  Local<String> value = instance->ToString(context.local()).ToLocalChecked();
+  CHECK(value->IsString() &&
+        value->Equals(context.local(), customized_tostring).FromJust());
+
+  // ObjectProtoToString should not call replace toString function.
+  value = instance->ObjectProtoToString(context.local()).ToLocalChecked();
+  CHECK(value->IsString() &&
+        value->Equals(context.local(), v8_str("[object MyClass]")).FromJust());
+
   // Check global
   value =
       context->Global()->ObjectProtoToString(context.local()).ToLocalChecked();
@@ -12679,49 +12723,10 @@ THREADED_TEST(ObjectProtoToString) {
               .ToLocalChecked();
   CHECK(value->IsString() &&
         value->Equals(context.local(), v8_str("[object Object]")).FromJust());
-}
 
-
-TEST(ObjectProtoToStringES6) {
-  LocalContext context;
-  v8::Isolate* isolate = CcTest::isolate();
-  v8::HandleScope scope(isolate);
-
-  // Check that ES6 semantics using @@toStringTag work.
+  // Check that ES6 semantics using @@toStringTag work
   Local<v8::Symbol> toStringTag = v8::Symbol::GetToStringTag(isolate);
 
-  Local<v8::FunctionTemplate> templ = v8::FunctionTemplate::New(isolate);
-  templ->SetClassName(v8_str("MyClass"));
-  templ->PrototypeTemplate()->Set(
-      toStringTag, v8_str("MyClassToStringTag"),
-      static_cast<v8::PropertyAttribute>(v8::ReadOnly | v8::DontEnum));
-
-  Local<String> customized_tostring = v8_str("customized toString");
-
-  // Replace Object.prototype.toString
-  CompileRun(R"(
-      Object.prototype.toString = function() {
-        return 'customized toString';
-      })");
-
-  // Normal ToString call should call replaced Object.prototype.toString
-  Local<v8::Object> instance = templ->GetFunction(context.local())
-                                   .ToLocalChecked()
-                                   ->NewInstance(context.local())
-                                   .ToLocalChecked();
-  Local<String> value = instance->ToString(context.local()).ToLocalChecked();
-  CHECK(value->IsString() &&
-        value->Equals(context.local(), customized_tostring).FromJust());
-
-  // ObjectProtoToString should not call replace toString function. Instead it
-  // should look at the @@toStringTag property.
-  value = instance->ObjectProtoToString(context.local()).ToLocalChecked();
-  CHECK(value->IsString() &&
-        value->Equals(context.local(), v8_str("[object MyClassToStringTag]"))
-            .FromJust());
-
-  Local<Value> object;
-
 #define TEST_TOSTRINGTAG(type, tag, expected)                              \
   do {                                                                     \
     object = CompileRun("new " #type "()");                                \
diff --git a/test/mjsunit/object-tostring-builtins.js b/test/mjsunit/class-of-builtins.js
similarity index 95%
rename from test/mjsunit/object-tostring-builtins.js
rename to test/mjsunit/class-of-builtins.js
index 8717770979..59fefffa75 100644
--- a/test/mjsunit/object-tostring-builtins.js
+++ b/test/mjsunit/class-of-builtins.js
@@ -25,8 +25,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Object.prototype.toString should return the correct values for instances of
-// various built-in classes.
+// The [[Class]] property of (instances of) builtin functions must be
+// correctly set.
 var funs = {
   Object:   [ Object ],
   Function: [ Function ],
diff --git a/test/mjsunit/es6/array-copywithin.js b/test/mjsunit/es6/array-copywithin.js
index 140f27b785..ed52b7d5fa 100644
--- a/test/mjsunit/es6/array-copywithin.js
+++ b/test/mjsunit/es6/array-copywithin.js
@@ -42,7 +42,7 @@
   Array.prototype.copyWithin.call(args, -2, 0);
   assertArrayEquals([1, 1, 2], Array.prototype.slice.call(args));
 
-  // Object.prototype.toString branding does not change
+  // [[Class]] does not change
   assertArrayEquals("[object Arguments]", Object.prototype.toString.call(args));
 })();
 
diff --git a/test/mjsunit/mjsunit.js b/test/mjsunit/mjsunit.js
index 0aeb3862ca..58dcd6c9ed 100644
--- a/test/mjsunit/mjsunit.js
+++ b/test/mjsunit/mjsunit.js
@@ -295,7 +295,7 @@ var prettyPrinted;
           default:
             return objectClass + "(" + String(value) + ")";
         }
-        // classOf() returned "Object".
+        // [[Class]] is "Object".
         var name = value.constructor.name;
         if (name) return name + "()";
         return "Object()";
diff --git a/test/unittests/api/remote-object-unittest.cc b/test/unittests/api/remote-object-unittest.cc
index a73db835a4..5fcc78bbe1 100644
--- a/test/unittests/api/remote-object-unittest.cc
+++ b/test/unittests/api/remote-object-unittest.cc
@@ -98,5 +98,22 @@ TEST_F(RemoteObjectTest, TypeOfRemoteObject) {
   EXPECT_STREQ("object", *result);
 }
 
+TEST_F(RemoteObjectTest, ClassOf) {
+  Local<FunctionTemplate> constructor_template =
+      FunctionTemplate::New(isolate(), Constructor);
+  constructor_template->InstanceTemplate()->SetAccessCheckCallbackAndHandler(
+      AccessCheck, NamedPropertyHandlerConfiguration(NamedGetter),
+      IndexedPropertyHandlerConfiguration());
+  constructor_template->SetClassName(
+      String::NewFromUtf8Literal(isolate(), "test_class"));
+
+  Local<Object> remote_object =
+      constructor_template->NewRemoteInstance().ToLocalChecked();
+  Local<String> class_name = Utils::ToLocal(
+      i::handle(Utils::OpenHandle(*remote_object)->class_name(), i_isolate()));
+  String::Utf8Value result(isolate(), class_name);
+  EXPECT_STREQ("test_class", *result);
+}
+
 }  // namespace remote_object_unittest
 }  // namespace v8