Always check that a Name is a String before converting it.

third_party/WebKit/Source/bindings/core/v8/custom/V8WindowCustom.cpp

 /*
  * Copyright (C) 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 264 matching lines @@
                     return true;
                 }
             }
         }
     }
     return false;
 }
 
 void V8Window::namedPropertyGetterCustom(v8::Local<v8::Name> name, const v8::PropertyCallbackInfo<v8::Value>& info)
 {
+    if (!name->IsString())
+        return;
     auto nameString = name.As<v8::String>();
     DOMWindow* window = V8Window::toImpl(info.Holder());
     if (!window)
         return;
 
     Frame* frame = window->frame();
     // window is detached from a frame.
     if (!frame)
         return;
 
@@ skipping 43 matching lines @@
         if (items->hasExactlyOneItem()) {
             v8SetReturnValueFast(info, items->item(0), window);
             return;
         }
         v8SetReturnValueFast(info, items, window);
         return;
     }
 }
 
 } // namespace blink