Do not use js builtins object when constructing an error.

src/messages.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/api.h"
 #include "src/execution.h"
 #include "src/messages.h"
 #include "src/string-builder.h"
@@ skipping 304 matching lines @@
   }
   // A string that has been obtained from JS code in this way is
   // likely to be a complicated ConsString of some sort.  We flatten it
   // here to improve the efficiency of converting it to a C string and
   // other operations that are likely to take place (see GetLocalizedMessage
   // for example).
   return String::Flatten(result_string);
 }
 
 
+const char* MessageTemplate::TemplateString(int template_index) {
+  switch (template_index) {
+#define CASE(NAME, STRING) \
+  case k##NAME:            \
+    return STRING;
+    MESSAGE_TEMPLATES(CASE)
+#undef CASE
+    case kLastMessage:
+    default:
+      return NULL;
+  }
+}
+
+
 MaybeHandle<String> MessageTemplate::FormatMessage(int template_index,
                                                    Handle<String> arg0,
                                                    Handle<String> arg1,
                                                    Handle<String> arg2) {
   Isolate* isolate = arg0->GetIsolate();
-  const char* template_string;
-  switch (template_index) {
-#define CASE(NAME, STRING)    \
-  case k##NAME:               \
-    template_string = STRING; \
-    break;
-    MESSAGE_TEMPLATES(CASE)
-#undef CASE
-    case kLastMessage:
-    default:
-      isolate->ThrowIllegalOperation();
-      return MaybeHandle<String>();
+  const char* template_string = TemplateString(template_index);
+  if (template_string == NULL) {
+    isolate->ThrowIllegalOperation();
+    return MaybeHandle<String>();
   }
 
   IncrementalStringBuilder builder(isolate);
 
   unsigned int i = 0;
   Handle<String> args[] = {arg0, arg1, arg2};
   for (const char* c = template_string; *c != '\0'; c++) {
     if (*c == '%') {
       // %% results in verbatim %.
       if (*(c + 1) == '%') {
@@ skipping 98 matching lines @@
   if (obj->IsUndefined()) return default_value;
   if (!obj->IsString()) {
     ASSIGN_RETURN_ON_EXCEPTION(isolate, obj, Execution::ToString(isolate, obj),
                                String);
   }
   return Handle<String>::cast(obj);
 }
 
 }  // namespace internal
 }  // namespace v8