According to https://w3c.github.io/browser-payment-api/#dfn-json-serializable-object:

"The term JSON-serializable object used in this specification means an object that can be serialized to a string using JSON.stringify and later deserialized back to an object using JSON.parse with no loss of data."

But it looks like we only actually validate that JSON.stringify succeeds.  So, for example:

new PaymentRequest([{supportedMethods: ["visa", "mastercard"], data:data}], {total: { label:"tot", amount: {currency: "USD", value:"60.00"}}})

Succeeds in the following cases where the spec implies it should throw:
data = {a:undefined};
data = {a:navigator};

Spec debate: https://github.com/w3c/browser-payment-api/issues/307