Check for validity when accessing call site objects in runtime.

src/messages.cc

Index: src/messages.cc
diff --git a/src/messages.cc b/src/messages.cc
index 640c2dff4e891266ce2fab0c206173dc1f7067c5..fb7a0ddb1b288059c78d07a9f2084ed6b4524e2c 100644
--- a/src/messages.cc
+++ b/src/messages.cc
@@ -144,10 +144,13 @@ base::SmartArrayPointer<char> MessageHandler::GetLocalizedMessage(
 
 CallSite::CallSite(Isolate* isolate, Handle<JSObject> call_site_obj)
     : isolate_(isolate) {
+  Handle<Object> maybe_function = JSObject::GetDataProperty(
+      call_site_obj, isolate->factory()->call_site_function_symbol());
+  if (!maybe_function->IsJSFunction()) return;
+
+  fun_ = Handle<JSFunction>::cast(maybe_function);
   receiver_ = JSObject::GetDataProperty(
       call_site_obj, isolate->factory()->call_site_receiver_symbol());
-  fun_ = Handle<JSFunction>::cast(JSObject::GetDataProperty(
-      call_site_obj, isolate->factory()->call_site_function_symbol()));
   pos_ = Handle<Smi>::cast(JSObject::GetDataProperty(
                                call_site_obj,
                                isolate->factory()->call_site_position_symbol()))