Fix another message object leak.

src/messages.js

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 64 matching lines @@
 }
 
 
 var kMessages = 0;
 
 
 function FormatString(format, args) {
   var result = format;
   for (var i = 0; i < args.length; i++) {
     var str;
-    try { str = ToDetailString(args[i]); }
-    catch (e) { str = "#<error>"; }
+    try {
+      str = ToDetailString(args[i]);
+    } catch (e) {
+      str = "#<error>";
+    }
     result = ArrayJoin.call(StringSplit.call(result, "%" + i), str);
   }
   return result;
 }
 
 
 // To check if something is a native error we need to check the
 // concrete native error types. It is not enough to check "obj
 // instanceof $Error" because user code can replace
 // NativeError.prototype.__proto__. User code cannot replace
@@ skipping 20 matching lines @@
     return ToString(obj);
   }
 }
 
 
 function ToDetailString(obj) {
   if (obj != null && IS_OBJECT(obj) && obj.toString === $Object.prototype.toString) {
     var constructor = obj.constructor;
     if (!constructor) return ToStringCheckErrorObject(obj);
     var constructorName = constructor.name;
-    if (!constructorName) return ToStringCheckErrorObject(obj);
+    if (!constructorName || !IS_STRING(constructorName)) {
+      return ToStringCheckErrorObject(obj);
+    }
     return "#<" + GetInstanceName(constructorName) + ">";
   } else {
     return ToStringCheckErrorObject(obj);
   }
 }
 
 
 function MakeGenericError(constructor, type, args) {
   if (IS_UNDEFINED(args)) {
     args = [];
@@ skipping 935 matching lines @@
     else throw e;
   }
 }
 
 %FunctionSetName(errorToString, 'toString');
 %SetProperty($Error.prototype, 'toString', errorToString, DONT_ENUM);
 
 // Boilerplate for exceptions for stack overflows. Used from
 // Top::StackOverflow().
 const kStackOverflowBoilerplate = MakeRangeError('stack_overflow', []);