[deserialize] add error object to id_map_ when deserialize

When serialize object, error will be added to id_map as reference
by other object. Error object should be added to id_map_ when
deserialize too.

Bug: v8:12542
Change-Id: If95b4047570de9927b67e64cda762f4c4a23e711
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3468875Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79202}

src/objects/value-serializer.cc

@@ -1995,6 +1995,8 @@ MaybeHandle<JSArrayBufferView> ValueDeserializer::ReadJSArrayBufferView(
 }
 
 MaybeHandle<Object> ValueDeserializer::ReadJSError() {
+  uint32_t id = next_id_++;
+
   Handle<Object> message = isolate_->factory()->undefined_value();
   Handle<Object> options = isolate_->factory()->undefined_value();
   Handle<Object> stack = isolate_->factory()->undefined_value();
@@ -2073,6 +2075,7 @@ MaybeHandle<Object> ValueDeserializer::ReadJSError() {
   }
 
   ErrorUtils::SetFormattedStack(isolate_, error, stack);
+  AddObjectWithID(id, error);
   return error;
 }
 

test/mjsunit/d8/d8-worker.js

@@ -82,8 +82,16 @@ var workerScript =
            if (t[i] !== i)
              throw new Error('ArrayBuffer transfer value ' + i);
          break;
+      case 10:
+        if (JSON.stringify(m) !== '{"foo":{},"err":{}}')
+          throw new Error('Object ' + JSON.stringify(m));
+        break;
+      case 11:
+        if (m.message != "message")
+          throw new Error('Error ' + JSON.stringify(m));
+        break;
      }
-     if (c == 10) {
+     if (c == 12) {
        postMessage('DONE');
      }
    };`;
@@ -162,6 +170,13 @@ if (this.Worker) {
 
   assertEquals("undefined", typeof foo);
 
+  // Transfer Error
+  const err = new Error();
+  w.postMessage({ foo: err, err })
+
+  // Transfer single Error
+  w.postMessage(new Error("message"))
+
   // Read a message from the worker.
   assertEquals("DONE", w.getMessage());