Better edge case handling of missing variables.

core/lib/Drupal/Core/EventSubscriber/AccessSubscriber.php

@@ -35,8 +35,8 @@ public function onKernelRequestAccessCheck(GetResponseEvent $event) {
 
     $router_item = $event->getRequest()->attributes->get('drupal_menu_item');
 
-    if (!$router_item['access']) {
-      throw new AccessDeniedHttpException($message);
+    if (isset($router_item['access']) && !$router_item['access']) {
+      throw new AccessDeniedHttpException();
     }
   }
 

core/lib/Drupal/Core/EventSubscriber/LegacyControllerSubscriber.php

@@ -42,7 +42,7 @@ public function onKernelControllerLegacy(FilterControllerEvent $event) {
     $controller = $event->getController();
 
     // This BC logic applies only to functions.  Otherwise, skip it.
-    if (function_exists($controller)) {
+    if (is_string($controller) && function_exists($controller)) {
       $new_controller = function() use ($router_item) {
         return call_user_func_array($router_item['page_callback'], $router_item['page_arguments']);
       };