LibWeb: Don't assume name is string in HTMLCollectionWrapper::get()

If the property name is not a string (symbol or integer), we should
just defer to the base class instead of trying to handle it.

Fixes #6575.

1 files changed, 2 insertions, 0 deletions

diff --git a/Userland/Libraries/LibWeb/Bindings/HTMLCollectionWrapperCustom.cpp b/Userland/Libraries/LibWeb/Bindings/HTMLCollectionWrapperCustom.cpp
index dae42548f1..1bec8b5fce 100644
--- a/Userland/Libraries/LibWeb/Bindings/HTMLCollectionWrapperCustom.cpp
+++ b/Userland/Libraries/LibWeb/Bindings/HTMLCollectionWrapperCustom.cpp
@@ -14,6 +14,8 @@ namespace Web::Bindings {
 
 JS::Value HTMLCollectionWrapper::get(JS::PropertyName const& name, JS::Value receiver, bool without_side_effects) const
 {
+    if (!name.is_string())
+        return Base::get(name, receiver, without_side_effects);
     auto* item = const_cast<DOM::HTMLCollection&>(impl()).named_item(name.to_string());
     if (!item)
         return Base::get(name, receiver, without_side_effects);