Always check that a Name is a String before converting it.

third_party/WebKit/Source/bindings/core/v8/WindowProxy.cpp

 /*
  * Copyright (C) 2008, 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 511 matching lines @@
         Frame* frame = isHTMLIFrameElement(*element) ? toHTMLIFrameElement(*element).contentFrame() : 0;
         if (frame)
             return toV8(frame->domWindow(), creationContext, isolate);
         return toV8(element, creationContext, isolate);
     }
     return toV8(RawPtr<HTMLCollection>(items.release()), creationContext, isolate);
 }
 
 static void getter(v8::Local<v8::Name> property, const v8::PropertyCallbackInfo<v8::Value>& info)
 {
+    if (!property->IsString())
+        return;
     // FIXME: Consider passing StringImpl directly.
     AtomicString name = toCoreAtomicString(property.As<v8::String>());
     HTMLDocument* htmlDocument = V8HTMLDocument::toImpl(info.Holder());
     ASSERT(htmlDocument);
     v8::Local<v8::Value> result = getNamedProperty(htmlDocument, name, info.Holder(), info.GetIsolate());
     if (!result.IsEmpty()) {
         v8SetReturnValue(info, result);
         return;
     }
     v8::Local<v8::Value> prototype = info.Holder()->GetPrototype();
@@ skipping 37 matching lines @@
 }
 
 void WindowProxy::updateSecurityOrigin(SecurityOrigin* origin)
 {
     if (!isContextInitialized())
         return;
     setSecurityToken(origin);
 }
 
 } // namespace blink