Only expect new data properties in ValueDeserializer.

Bug: chromium:906313
Change-Id: Ie5d91e086d02433e2dec7728e29e4ae87cdd34c3
Reviewed-on: https://chromium-review.googlesource.com/c/1340290Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57632}

src/value-serializer.cc

@@ -1988,6 +1988,7 @@ Maybe<uint32_t> ValueDeserializer::ReadJSObjectProperties(
       bool success;
       LookupIterator it = LookupIterator::PropertyOrElement(
           isolate_, object, key, &success, LookupIterator::OWN);
+      CHECK_EQ(LookupIterator::NOT_FOUND, it.state());
       if (!success ||
           JSObject::DefineOwnPropertyIgnoreAttributes(&it, value, NONE)
               .is_null()) {
@@ -2022,6 +2023,7 @@ Maybe<uint32_t> ValueDeserializer::ReadJSObjectProperties(
     bool success;
     LookupIterator it = LookupIterator::PropertyOrElement(
         isolate_, object, key, &success, LookupIterator::OWN);
+    CHECK_EQ(LookupIterator::NOT_FOUND, it.state());
     if (!success ||
         JSObject::DefineOwnPropertyIgnoreAttributes(&it, value, NONE)
             .is_null()) {
@@ -2069,6 +2071,7 @@ static Maybe<bool> SetPropertiesFromKeyValuePairs(Isolate* isolate,
     bool success;
     LookupIterator it = LookupIterator::PropertyOrElement(
         isolate, object, key, &success, LookupIterator::OWN);
+    CHECK_EQ(LookupIterator::NOT_FOUND, it.state());
     if (!success ||
         JSObject::DefineOwnPropertyIgnoreAttributes(&it, value, NONE)
             .is_null()) {

test/unittests/value-serializer-unittest.cc

@@ -1871,11 +1871,11 @@ TEST_F(ValueSerializerTest, DecodeDataView) {
 }
 
 TEST_F(ValueSerializerTest, DecodeArrayWithLengthProperty1) {
-  Local<Value> value = DecodeTest(
-      {0xff, 0x0d, 0x41, 0x03, 0x49, 0x02, 0x49, 0x04, 0x49, 0x06, 0x22, 0x06,
-       0x6c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x49, 0x02, 0x24, 0x01, 0x03});
-  ASSERT_TRUE(value->IsArray());
-  EXPECT_EQ(1u, Local<Array>::Cast(value)->Length());
+  ASSERT_DEATH_IF_SUPPORTED(
+      DecodeTest({0xff, 0x0d, 0x41, 0x03, 0x49, 0x02, 0x49, 0x04,
+                  0x49, 0x06, 0x22, 0x06, 0x6c, 0x65, 0x6e, 0x67,
+                  0x74, 0x68, 0x49, 0x02, 0x24, 0x01, 0x03}),
+      ".*LookupIterator::NOT_FOUND == it.state\\(\\).*");
 }
 
 TEST_F(ValueSerializerTest, DecodeArrayWithLengthProperty2) {
@@ -1883,7 +1883,7 @@ TEST_F(ValueSerializerTest, DecodeArrayWithLengthProperty2) {
       DecodeTest({0xff, 0x0d, 0x41, 0x03, 0x49, 0x02, 0x49, 0x04,
                   0x49, 0x06, 0x22, 0x06, 0x6c, 0x65, 0x6e, 0x67,
                   0x74, 0x68, 0x6f, 0x7b, 0x00, 0x24, 0x01, 0x03}),
-      ".*AllowJavascriptExecution::IsAllowed.*");
+      ".*LookupIterator::NOT_FOUND == it.state\\(\\).*");
 }
 
 TEST_F(ValueSerializerTest, DecodeInvalidDataView) {