Always check that a Name is a String before converting it.

third_party/WebKit/Source/bindings/core/v8/custom/V8CSSStyleDeclarationCustom.cpp

 /*
  * Copyright (C) 2007-2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 169 matching lines @@
     // NOTE: cssPropertyInfo lookups incur several mallocs.
     // Successful lookups have the same cost the first time, but are cached.
     if (cssPropertyInfo(v8Name.As<v8::String>())) {
         v8SetReturnValueInt(info, 0);
         return;
     }
 }
 
 void V8CSSStyleDeclaration::namedPropertyGetterCustom(v8::Local<v8::Name> name, const v8::PropertyCallbackInfo<v8::Value>& info)
 {
+    if (!name->IsString())
+        return;
+
     // Search the style declaration.
     CSSPropertyID unresolvedProperty = cssPropertyInfo(name.As<v8::String>());
 
     // Do not handle non-property names.
     if (!unresolvedProperty)
         return;
     CSSPropertyID resolvedProperty = resolveCSSPropertyID(unresolvedProperty);
 
     CSSStyleDeclaration* impl = V8CSSStyleDeclaration::toImpl(info.Holder());
     // TODO(leviw): This API doesn't support custom properties.
@@ skipping 21 matching lines @@
     // TODO(leviw): This API doesn't support custom properties.
     impl->setPropertyInternal(unresolvedProperty, String(), propertyValue, false, exceptionState);
 
     if (exceptionState.throwIfNeeded())
         return;
 
     v8SetReturnValue(info, value);
 }
 
 } // namespace blink