fix(CookieMap): use identifierToUSVString for property name conversion

When creating a CookieMap from an object, calling propertyName.string()
directly could cause a null pointer reference crash with UBSAN. This
change uses identifierToUSVString() which properly handles the conversion
of property names to strings, following the same pattern used in
JSDOMConvertRecord.h.

Fixes: ENG-21750

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

Author: Claude Bot

src/bun.js/bindings/webcore/JSCookieMap.cpp

@@ -164,7 +164,10 @@ template<> JSC::EncodedJSValue JSC_HOST_CALL_ATTRIBUTES JSCookieMapDOMConstructo
                 auto valueStr = value.toString(lexicalGlobalObject)->value(lexicalGlobalObject);
                 RETURN_IF_EXCEPTION(throwScope, {});
 
-                record.set(propertyName.string(), valueStr);
+                auto keyStr = identifierToUSVString(*lexicalGlobalObject, propertyName);
+                RETURN_IF_EXCEPTION(throwScope, {});
+
+                record.set(keyStr, valueStr);
             }
             init = WTFMove(record);
         }

test/regression/issue/ENG-21750.test.ts

@@ -0,0 +1,20 @@
+import { expect, test } from "bun:test";
+
+// https://linear.app/oven/issue/ENG-21750
+// CookieMap constructor should not crash when passed an object with symbol properties
+test("CookieMap should handle objects with symbol properties without crashing", () => {
+  // This should not crash - Bun object has symbol properties
+  const cookieMap = new Bun.CookieMap(Bun);
+  expect(cookieMap).toBeInstanceOf(Bun.CookieMap);
+
+  // Also test with a custom object that has symbol properties
+  const obj = {
+    foo: "bar",
+    [Symbol.for("test")]: "value",
+    [Symbol("local")]: "another",
+  };
+  const cookieMap2 = new Bun.CookieMap(obj);
+  expect(cookieMap2).toBeInstanceOf(Bun.CookieMap);
+  // Symbol properties should be skipped, but string properties should work
+  expect(cookieMap2.get("foo")).toBe("bar");
+});