fix: integer map keys when deserializing from a Value

Deserializing from an owned or borrowed Value by value
(`from_owned_value`, `from_borrowed_value`, `Value::deserialize_*`)
passed each object key as `Value::String`, so integer keys never parsed:

    let v = to_owned_value(br#"{"1":2}"#)?;
    from_owned_value::<BTreeMap<i64, u8>>(v)
        Err(invalid type: string "1", expected i64)

The by-reference path (`from_refowned_value`) and the text path accept
it, and so do serde_json and sonic-rs. Keys now go through
`MapKeyDeserializer` in all four Value paths; its constructor takes
`impl Into<Cow<str>>`, so one `new` serves borrowed and owned keys.

Test: `value_map_integer_keys`; `integer_keys_follow_json_number_syntax`
and `i128_map_keys` now also check the by-value paths (all through the
same `map_key_results` helper: `from_slice` and the four Value
functions). Fails before this change.

Found by a differential fuzzer (serde_json, simd-json, sonic-rs, jiter).

Author: claude

src/serde/value/borrowed/de.rs

@@ -230,7 +230,8 @@ impl<'de> MapAccess<'de> for ObjectAccess<'de> {
         match self.i.next() {
             Some((k, v)) => {
                 self.v = Some(v);
-                seed.deserialize(Value::String(k)).map(Some)
+                // through the key deserializer, as for `&Value`: integer keys parse
+                seed.deserialize(MapKeyDeserializer::new(k)).map(Some)
             }
             _ => Ok(None),
         }
@@ -269,7 +270,7 @@ impl<'de> MapAccess<'de> for ObjectRefAccess<'de> {
         if let Some((k, v)) = self.i.next() {
             self.v = Some(v);
             let s: &str = k;
-            seed.deserialize(MapKeyDeserializer::borrowed(s)).map(Some)
+            seed.deserialize(MapKeyDeserializer::new(s)).map(Some)
         } else {
             Ok(None)
         }

src/serde/value/owned/de.rs

@@ -217,7 +217,8 @@ impl<'de> MapAccess<'de> for ObjectAccess {
         match self.i.next() {
             Some((k, v)) => {
                 self.v = Some(v);
-                seed.deserialize(Value::String(k)).map(Some)
+                // through the key deserializer, as for `&Value`: integer keys parse
+                seed.deserialize(MapKeyDeserializer::new(k)).map(Some)
             }
             _ => Ok(None),
         }
@@ -256,7 +257,8 @@ impl<'de> MapAccess<'de> for ObjectRefAccess<'de> {
     {
         if let Some((k, v)) = self.i.next() {
             self.v = Some(v);
-            seed.deserialize(MapKeyDeserializer::borrowed(k)).map(Some)
+            seed.deserialize(MapKeyDeserializer::new(k.as_str()))
+                .map(Some)
         } else {
             Ok(None)
         }

src/serde/value/shared.rs

@@ -35,10 +35,8 @@ pub(crate) struct MapKeyDeserializer<'de> {
 }
 
 impl<'de> MapKeyDeserializer<'de> {
-    pub(crate) fn borrowed(key: &'de str) -> Self {
-        Self {
-            key: Cow::from(key),
-        }
+    pub(crate) fn new(key: impl Into<Cow<'de, str>>) -> Self {
+        Self { key: key.into() }
     }
 }
 

src/tests/serde.rs

@@ -1450,9 +1450,7 @@ fn integer_keys_follow_json_number_syntax() {
     }
     let ok = BTreeMap::from([(0_i64, 1_u8), (-7, 2), (120, 3)]);
     for (path, r) in map_key_results::<BTreeMap<i64, u8>>(r#"{"0":1,"-7":2,"120":3}"#) {
-        if path == "from_slice" || path.starts_with("from_ref") {
-            assert_eq!(r.as_ref(), Some(&ok), "via {path}");
-        }
+        assert_eq!(r.as_ref(), Some(&ok), "via {path}");
     }
     // string keys are unchanged
     let ok = BTreeMap::from([("01".to_string(), 2_u8), ("-0".to_string(), 3)]);
@@ -1464,24 +1462,33 @@ fn integer_keys_follow_json_number_syntax() {
 #[test]
 fn i128_map_keys() {
     // i128/u128 values deserialize without the `128bit` feature; keys used to fail with
-    // "i128 is not supported" unless it was enabled.
+    // "i128 is not supported" unless it was enabled, from text and from every Value.
     use std::collections::BTreeMap;
     let ok = BTreeMap::from([(i128::MIN, 1_u8), (7, 2)]);
     let json = r#"{"-170141183460469231731687303715884105728":1,"7":2}"#;
     for (path, r) in map_key_results::<BTreeMap<i128, u8>>(json) {
-        if path == "from_slice" || path.starts_with("from_ref") {
-            assert_eq!(r.as_ref(), Some(&ok), "via {path}");
-        }
+        assert_eq!(r.as_ref(), Some(&ok), "via {path}");
     }
     let ok = BTreeMap::from([(u128::MAX, 1_u8)]);
-    let json = r#"{"340282366920938463463374607431768211455":1}"#;
-    for (path, r) in map_key_results::<BTreeMap<u128, u8>>(json) {
-        if path == "from_slice" || path.starts_with("from_ref") {
-            assert_eq!(r.as_ref(), Some(&ok), "via {path}");
-        }
+    for (path, r) in
+        map_key_results::<BTreeMap<u128, u8>>(r#"{"340282366920938463463374607431768211455":1}"#)
+    {
+        assert_eq!(r.as_ref(), Some(&ok), "via {path}");
     }
-    let json = r#"{"340282366920938463463374607431768211456":1}"#;
-    for (path, r) in map_key_results::<BTreeMap<u128, u8>>(json) {
+    for (path, r) in
+        map_key_results::<BTreeMap<u128, u8>>(r#"{"340282366920938463463374607431768211456":1}"#)
+    {
         assert_eq!(r, None, "u128 overflow via {path}");
     }
 }
+
+#[test]
+fn value_map_integer_keys() {
+    // From an owned/borrowed Value (not a reference), map keys were deserialized as plain
+    // strings, so integer keys failed; all four Value functions must parse them.
+    use std::collections::BTreeMap;
+    let ok = BTreeMap::from([(1_i64, 2_u8), (-7, 3)]);
+    for (path, r) in map_key_results::<BTreeMap<i64, u8>>(r#"{"1":2,"-7":3}"#) {
+        assert_eq!(r.as_ref(), Some(&ok), "via {path}");
+    }
+}