Fix another message object leak.

src/messages.js

Index: src/messages.js
diff --git a/src/messages.js b/src/messages.js
index 634771524f31b3453ef0678a259e1a4672a11a3a..ec97d9cc2e47fe5748cd3e9430167d4d7378b9e0 100644
--- a/src/messages.js
+++ b/src/messages.js
@@ -82,8 +82,11 @@ function FormatString(format, args) {
   var result = format;
   for (var i = 0; i < args.length; i++) {
     var str;
-    try { str = ToDetailString(args[i]); }
-    catch (e) { str = "#<error>"; }
+    try {
+      str = ToDetailString(args[i]);
+    } catch (e) {
+      str = "#<error>";
+    }
     result = ArrayJoin.call(StringSplit.call(result, "%" + i), str);
   }
   return result;
@@ -124,7 +127,9 @@ function ToDetailString(obj) {
     var constructor = obj.constructor;
     if (!constructor) return ToStringCheckErrorObject(obj);
     var constructorName = constructor.name;
-    if (!constructorName) return ToStringCheckErrorObject(obj);
+    if (!constructorName || !IS_STRING(constructorName)) {
+      return ToStringCheckErrorObject(obj);
+    }
     return "#<" + GetInstanceName(constructorName) + ">";
   } else {
     return ToStringCheckErrorObject(obj);