Convert targetOrigin to string in render process

lib/renderer/window-setup.js

@@ -32,6 +32,9 @@ const resolveURL = function (url) {
   return a.href
 }
 
+// Use this method to ensure value expected as string in the main process
+// are convertible to string in the renderer process. This ensures exceptions
+// converting values to string are thrown in this process.
 const toString = (value) => {
   return value != null ? `${value}` : value
 }
@@ -86,7 +89,7 @@ function BrowserWindowProxy (ipcRenderer, guestId) {
   }
 
   this.postMessage = (message, targetOrigin) => {
-    ipcRenderer.send('ELECTRON_GUEST_WINDOW_MANAGER_WINDOW_POSTMESSAGE', guestId, message, targetOrigin, window.location.origin)
+    ipcRenderer.send('ELECTRON_GUEST_WINDOW_MANAGER_WINDOW_POSTMESSAGE', guestId, message, toString(targetOrigin), window.location.origin)
   }
 
   this.eval = (...args) => {

spec/chromium-spec.js

@@ -548,6 +548,14 @@ describe('chromium feature', function () {
       })
       b = window.open('file://' + fixtures + '/pages/window-open-postMessage.html', '', 'show=no')
     })
+
+    it('throws an exception when the targetOrigin cannot be converted to a string', function () {
+      var b = window.open('')
+      assert.throws(function () {
+        b.postMessage('test', {toString: null})
+      }, /Cannot convert object to primitive value/)
+      b.close()
+    })
   })
 
   describe('window.opener.postMessage', function () {