Check for validity when accessing call site objects in runtime.

src/messages.cc

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/messages.h"
 
 #include "src/api.h"
 #include "src/execution.h"
 #include "src/isolate-inl.h"
 #include "src/string-builder.h"
@@ skipping 126 matching lines @@
 
 base::SmartArrayPointer<char> MessageHandler::GetLocalizedMessage(
     Isolate* isolate, Handle<Object> data) {
   HandleScope scope(isolate);
   return GetMessage(isolate, data)->ToCString(DISALLOW_NULLS);
 }
 
 
 CallSite::CallSite(Isolate* isolate, Handle<JSObject> call_site_obj)
     : isolate_(isolate) {
+  Handle<Object> maybe_function = JSObject::GetDataProperty(
+      call_site_obj, isolate->factory()->call_site_function_symbol());
+  if (!maybe_function->IsJSFunction()) return;
+
+  fun_ = Handle<JSFunction>::cast(maybe_function);
   receiver_ = JSObject::GetDataProperty(
       call_site_obj, isolate->factory()->call_site_receiver_symbol());
-  fun_ = Handle<JSFunction>::cast(JSObject::GetDataProperty(
-      call_site_obj, isolate->factory()->call_site_function_symbol()));
   pos_ = Handle<Smi>::cast(JSObject::GetDataProperty(
                                call_site_obj,
                                isolate->factory()->call_site_position_symbol()))
              ->value();
 }
 
 
 Handle<Object> CallSite::GetFileName() {
   Handle<Object> script(fun_->shared()->script(), isolate_);
   if (script->IsScript()) {
@@ skipping 312 matching lines @@
   if (obj->IsUndefined()) return default_value;
   if (!obj->IsString()) {
     ASSIGN_RETURN_ON_EXCEPTION(isolate, obj, Object::ToString(isolate, obj),
                                String);
   }
   return Handle<String>::cast(obj);
 }
 
 }  // namespace internal
 }  // namespace v8