Version 4.6.85.6 (cherry-pick)

src/messages.cc

Index: src/messages.cc
diff --git a/src/messages.cc b/src/messages.cc
index 4e0c45f0f1992ca70ed191bfe63c6a4fac4bed7c..3de6717cbcece426eb4a73b2a3b02db8d4b66738 100644
--- a/src/messages.cc
+++ b/src/messages.cc
@@ -434,6 +434,7 @@ MaybeHandle<String> ErrorToStringHelper::Stringify(Isolate* isolate,
 bool ErrorToStringHelper::ShadowsInternalError(
     Isolate* isolate, LookupIterator* property_lookup,
     LookupIterator* internal_error_lookup) {
+  if (!property_lookup->IsFound()) return false;
   Handle<JSObject> holder = property_lookup->GetHolder<JSObject>();
   // It's fine if the property is defined on the error itself.
   if (holder.is_identical_to(property_lookup->GetReceiver())) return true;