ValueDeserializer: Only allow valid keys when deserializing object properties.

test/unittests/value-serializer-unittest.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/value-serializer.h"
 
 #include <algorithm>
 #include <string>
 
 #include "include/v8.h"
@@ skipping 664 matching lines @@
   // resolved.
   DecodeTest(
       {0xff, 0x09, 0x3f, 0x00, 0x6f, 0x3f, 0x01, 0x53, 0x04, 0x73,
        0x65, 0x6c, 0x66, 0x3f, 0x01, 0x5e, 0x00, 0x7b, 0x01, 0x00},
       [this](Local<Value> value) {
         ASSERT_TRUE(value->IsObject());
         EXPECT_TRUE(EvaluateScriptForResultBool("result === result.self"));
       });
 }
 
+TEST_F(ValueSerializerTest, InvalidDecodeObjectWithInvalidKeyType) {
+  // Objects which would need conversion to string shouldn't be present as
+  // object keys. The serializer would have obtained them from the own property
+  // keys list, which should only contain names and indices.
+  InvalidDecodeTest(
+      {0xff, 0x09, 0x6f, 0x61, 0x00, 0x40, 0x00, 0x00, 0x7b, 0x01});
+}
+
 TEST_F(ValueSerializerTest, RoundTripOnlyOwnEnumerableStringKeys) {
   // Only "own" properties should be serialized, not ones on the prototype.
   RoundTripTest("(() => { var x = {}; x.__proto__ = {a: 4}; return x; })()",
                 [this](Local<Value> value) {
                   EXPECT_TRUE(EvaluateScriptForResultBool("!('a' in result)"));
                 });
   // Only enumerable properties should be serialized.
   RoundTripTest(
       "(() => {"
       "  var x = {};"
@@ skipping 1988 matching lines @@
   InvalidDecodeTest(raw);
 }
 
 TEST_F(ValueSerializerTestWithWasm, DecodeWasmModuleWithInvalidDataLength) {
   InvalidDecodeTest({0xff, 0x09, 0x3f, 0x00, 0x57, 0x79, 0x7f, 0x00});
   InvalidDecodeTest({0xff, 0x09, 0x3f, 0x00, 0x57, 0x79, 0x00, 0x7f});
 }
 
 }  // namespace
 }  // namespace v8