Crash in blink::getTypeExtension

third_party/WebKit/Source/core/dom/Document.cpp

Index: third_party/WebKit/Source/core/dom/Document.cpp
diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index 28b112be99449b67dc8eb19bb4ba095de02305ce..6a62ef9b7fe252eb90a8a88e67d528da0515cf85 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -690,10 +690,11 @@ String getTypeExtension(Document* document,
     ElementCreationOptions impl;
     V8ElementCreationOptions::toImpl(dict.isolate(), dict.v8Value(), impl,
                                      exceptionState);
+    if (exceptionState.hadException())
+      return emptyString();
+
     if (impl.hasIs())
       return impl.is();
-
-    return toCoreString(dict.v8Value()->ToString());
   }
 
   return emptyString();