Handle failed stack trace captures

BUG=630953
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2191713004
Cr-Commit-Position: refs/heads/master@{#38131}

src/builtins/builtins-error.cc

@@ -44,6 +44,7 @@ BUILTIN(ErrorCaptureStackTrace) {
 
   Handle<Object> stack_trace =
       isolate->CaptureSimpleStackTrace(object, mode, caller);
+  if (!stack_trace->IsJSArray()) return *isolate->factory()->undefined_value();
 
   Handle<Object> formatted_stack_trace;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(

test/mjsunit/stack-traces.js

@@ -395,3 +395,8 @@ Error.prepareStackTrace = function(e, frames) { throw 42; }
 
 var x = {}
 assertThrows(() => Error.captureStackTrace(x));
+
+// Check that we don't crash when CaptureSimpleStackTrace returns undefined.
+var o = {};
+Error.stackTraceLimit = "not a number";
+Error.captureStackTrace(o);