only in patch2:
unchanged:
--- a/core/modules/user/src/PermissionHandler.php
+++ b/core/modules/user/src/PermissionHandler.php
@@ -149,7 +149,10 @@ protected function buildPermissionsYaml() {
         unset($permissions['permission_callbacks']);
       }
 
-      foreach ($permissions as &$permission) {
+      foreach ($permissions as $permission_name => &$permission) {
+        if (!$this->checkValidPermissionName($permission_name)) {
+          throw new \Exception("Permission '$permission_name' is not a valid machine name.");
+        }
         if (!is_array($permission)) {
           $permission = array(
             'title' => $permission,
@@ -219,4 +222,20 @@ protected function systemRebuildModuleData() {
     return system_rebuild_module_data();
   }
 
+  /**
+   * Checks if a permission name is a valid machine name.
+   *
+   * @param string $name
+   *   A permission name to check.
+   *
+   * @return bool
+   *   TRUE if the permission name is valid.
+   */
+  protected function checkValidPermissionName($name) {
+    if (preg_match('@^' . DRUPAL_PHP_FUNCTION_PATTERN . '$@', $name)) {
+      return TRUE;
+    }
+    return FALSE;
+  }
+
 }