Crash in blink::getTypeExtension

third_party/WebKit/Source/core/dom/Document.cpp

Index: third_party/WebKit/Source/core/dom/Document.cpp
diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index 987f43e2c966951bc6e1f3cf4a3d0644d1e95c0b..6366ad7e02ade36f65937688ddca1d8b59f5c748 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -690,10 +690,11 @@ String getTypeExtension(Document* document,
     ElementCreationOptions impl;
     V8ElementCreationOptions::toImpl(dict.isolate(), dict.v8Value(), impl,
                                      exceptionState);
+    if (exceptionState.hadException())
+      return emptyString;
+
     if (impl.hasIs())
       return impl.is();
-
-    return toCoreString(dict.v8Value()->ToString());
   }
 
   return emptyString;