Version 4.6.85.6 (cherry-pick)

src/messages.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/api.h"
 #include "src/execution.h"
 #include "src/messages.h"
 #include "src/string-builder.h"
@@ skipping 416 matching lines @@
   builder.AppendString(name);
   builder.AppendCString(": ");
   builder.AppendString(message);
   return builder.Finish();
 }
 
 
 bool ErrorToStringHelper::ShadowsInternalError(
     Isolate* isolate, LookupIterator* property_lookup,
     LookupIterator* internal_error_lookup) {
+  if (!property_lookup->IsFound()) return false;
   Handle<JSObject> holder = property_lookup->GetHolder<JSObject>();
   // It's fine if the property is defined on the error itself.
   if (holder.is_identical_to(property_lookup->GetReceiver())) return true;
   PrototypeIterator it(isolate, holder, PrototypeIterator::START_AT_RECEIVER);
   while (true) {
     if (it.IsAtEnd()) return false;
     if (it.IsAtEnd(internal_error_lookup->GetHolder<JSObject>())) return true;
     it.AdvanceIgnoringProxies();
   }
 }
 
 
 MaybeHandle<String> ErrorToStringHelper::GetStringifiedProperty(
     Isolate* isolate, LookupIterator* property_lookup,
     Handle<String> default_value) {
   if (!property_lookup->IsFound()) return default_value;
   Handle<Object> obj;
   ASSIGN_RETURN_ON_EXCEPTION(isolate, obj, Object::GetProperty(property_lookup),
                              String);
   if (obj->IsUndefined()) return default_value;
   if (!obj->IsString()) {
     ASSIGN_RETURN_ON_EXCEPTION(isolate, obj, Execution::ToString(isolate, obj),
                                String);
   }
   return Handle<String>::cast(obj);
 }
 
 }  // namespace internal
 }  // namespace v8