stream: speed up async iteration over WHATWG byte streams

for await / reader.read() loops over byte streams were ~4x slower than
over default streams. Three per-chunk costs, none required by the spec:
- ArrayBufferViewGetBuffer/ByteLength/ByteOffset went through
ReflectGet(view.constructor.prototype, ...), a reflective get that is
~3.5x slower than the original prototype getters from primordials and
spoofable through a user-defined .constructor to boot.
- The buffered fast paths in ReadableStreamDefaultReader.read() and the
async iterator only covered default controllers, so byte streams with
queued data still allocated a read request and PromiseWithResolvers
per chunk. Byte-queue dequeue is fully synchronous (it is the
queue-filled arm of the byte controller's pull steps), so both fast
paths now resolve directly from the byte queue.
- readableByteStreamControllerEnqueue re-ran the reader brand check and
re-loaded the read request list four times per chunk across
HasDefaultReader / ProcessReadRequestsUsingQueue / GetNumReadRequests
/ FulfillReadRequest; it now does a single pass. The async iterator
also reuses its read request object across reads (at most one is ever
in flight).
benchmark/webstreams interleaved same-day A/B, --runs 10:
readable-async-iterator bytes +16.3% (***), readable-read byob +9.1%
(***), all other rows neutral. Profiler harness: parked byte iteration
+14%, buffered byte iteration +37%, buffered byte read loop +18%,
default-stream rows at parity. WPT streams/compression/encoding
subtests identical to baseline.
Signed-off-by: Matteo Collina <hello@matteocollina.com>
PR-URL: #64291
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Author: aduh95

lib/internal/webstreams/readablestream.js

@@ -497,6 +497,12 @@ class ReadableStream {
 current: undefined,
 };
 letstarted=false;
+// A single reusable read request: at most one read is ever in flight
+// (next() chains through state.current), and the request is consumed
+// before the next read starts, so only its promise record changes
+// per read.
+// eslint-disable-next-line no-use-before-define
+constreadRequest=newReadableStreamAsyncIteratorReadRequest(reader,state,undefined);
 
 // The nextSteps function is not an async function in order
 // to make it more efficient. Because nextSteps explicitly
@@ -515,8 +521,8 @@ class ReadableStream {
 }
 constpromise=PromiseWithResolvers();
 
-// eslint-disable-next-line no-use-before-define
-readableStreamDefaultReaderRead(reader,newReadableStreamAsyncIteratorReadRequest(reader,state,promise));
+readRequest.promise=promise;
+readableStreamDefaultReaderRead(reader,readRequest);
 returnpromise.promise;
 }
 
@@ -570,28 +576,38 @@ class ReadableStream {
 }
 // No read is in flight. Mirror the buffered fast path of
 // ReadableStreamDefaultReader.read(): when data is already queued
-// in a default controller, resolve immediately without allocating
-// a read request. The result settles synchronously, so leaving
+// in the controller, resolve immediately without allocating a
+// read request. The result settles synchronously, so leaving
 // state.current undefined matches the state the slow path reaches
 // once its read request callbacks have settled.
 conststream=reader[kState].stream;
-if(!state.done&&stream!==undefined){
+if(!state.done&&stream!==undefined&&
+stream[kState].state==='readable'){
 constcontroller=stream[kState].controller;
-if(stream[kState].state==='readable'&&
-isReadableStreamDefaultController(controller)&&
-controller[kState].queue.length>0){
-stream[kState].disturbed=true;
-constchunk=dequeueValue(controller);
-
-if(controller[kState].closeRequested&&
-!controller[kState].queue.length){
-readableStreamDefaultControllerClearAlgorithms(controller);
-readableStreamClose(stream);
-}else{
-readableStreamDefaultControllerCallPullIfNeeded(controller);
+if(isReadableStreamDefaultController(controller)){
+if(controller[kState].queue.length>0){
+stream[kState].disturbed=true;
+constchunk=dequeueValue(controller);
+
+if(controller[kState].closeRequested&&
+!controller[kState].queue.length){
+readableStreamDefaultControllerClearAlgorithms(controller);
+readableStreamClose(stream);
+}else{
+readableStreamDefaultControllerCallPullIfNeeded(controller);
+}
+
+returnPromiseResolve({done: false,value: chunk});
 }
+}elseif(controller[kState].queueTotalSize>0){
+// Byte controller with buffered data: same shape as above via
+// the queue-filled arm of the byte controller's pull steps.
+stream[kState].disturbed=true;
+returnPromiseResolve({
+done: false,
 
-returnPromiseResolve({done: false,value: chunk});
+value: readableByteStreamControllerDequeueChunk(controller),
+});
 }
 }
 state.current=nextSteps();
@@ -914,24 +930,36 @@ class ReadableStreamDefaultReader {
 conststream=this[kState].stream;
 constcontroller=stream[kState].controller;
 
-// Fast path: if data is already buffered in a default controller,
+// Fast path: if data is already buffered in the controller's queue,
 // return a resolved promise immediately without creating a read request.
 // This is spec-compliant because read() returns a Promise, and
 // Promise.resolve() callbacks still run in the microtask queue.
-if(stream[kState].state==='readable'&&
-isReadableStreamDefaultController(controller)&&
-controller[kState].queue.length>0){
-stream[kState].disturbed=true;
-constchunk=dequeueValue(controller);
+if(stream[kState].state==='readable'){
+if(isReadableStreamDefaultController(controller)){
+if(controller[kState].queue.length>0){
+stream[kState].disturbed=true;
+constchunk=dequeueValue(controller);
+
+if(controller[kState].closeRequested&&!controller[kState].queue.length){
+readableStreamDefaultControllerClearAlgorithms(controller);
+readableStreamClose(stream);
+}else{
+readableStreamDefaultControllerCallPullIfNeeded(controller);
+}
 
-if(controller[kState].closeRequested&&!controller[kState].queue.length){
-readableStreamDefaultControllerClearAlgorithms(controller);
-readableStreamClose(stream);
-}else{
-readableStreamDefaultControllerCallPullIfNeeded(controller);
+returnPromiseResolve({done: false,value: chunk});
+}
+}elseif(controller[kState].queueTotalSize>0){
+// Byte controller with buffered data: mirror the queue-filled arm
+// of its pull steps (which never consults pendingPullIntos) minus
+// the read request.
+stream[kState].disturbed=true;
+returnPromiseResolve({
+done: false,
+
+value: readableByteStreamControllerDequeueChunk(controller),
+});
 }
-
-returnPromiseResolve({value: chunk,done: false});
 }
 
 // Slow path: create request and go through normal flow
@@ -3040,9 +3068,23 @@ function readableByteStreamControllerEnqueue(controller, chunk) {
 }
 }
 
-if(readableStreamHasDefaultReader(stream)){
-readableByteStreamControllerProcessReadRequestsUsingQueue(controller);
-if(!readableStreamGetNumReadRequests(stream)){
+// Single consolidated pass over the reader state. The spec routes this
+// through HasDefaultReader / ProcessReadRequestsUsingQueue /
+// GetNumReadRequests / FulfillReadRequest, which would re-run the same
+// reader brand check and re-load the read request list four times on
+// this per-chunk path.
+const{ reader }=stream[kState];
+if(reader!==undefined&&
+reader[kState]!==undefined&&
+reader[kType]==='ReadableStreamDefaultReader'){
+const{ readRequests }=reader[kState];
+if(readRequests.length&&controller[kState].queueTotalSize>0){
+// Only possible when data was enqueued while the stream was not
+// being read; read requests otherwise never coexist with a
+// non-empty queue.
+readableByteStreamControllerProcessReadRequestsUsingQueue(controller);
+}
+if(!readRequests.length){
 readableByteStreamControllerEnqueueChunkToQueue(
 controller,
 transferredBuffer,
@@ -3056,7 +3098,8 @@ function readableByteStreamControllerEnqueue(controller, chunk) {
 }
 consttransferredView=
 newUint8Array(transferredBuffer,byteOffset,byteLength);
-readableStreamFulfillReadRequest(stream,transferredView,false);
+constreadRequest=ArrayPrototypeShift(readRequests);
+readRequest[kChunk](transferredView);
 }
 }elseif(readableStreamHasBYOBReader(stream)){
 readableByteStreamControllerEnqueueChunkToQueue(
@@ -3391,22 +3434,28 @@ function readableByteStreamControllerCancelSteps(controller, reason) {
 returnresult;
 }
 
-functionreadableByteStreamControllerFillReadRequestFromQueue(controller,readRequest){
-const{
- queue,
- queueTotalSize,
-}=controller[kState];
-assert(queueTotalSize>0);
+// Dequeues the first chunk of the byte queue as a Uint8Array view,
+// handling queue drain (close-on-empty or pull) before the view is
+// created. This is the [[queueTotalSize]] > 0 arm of the byte
+// controller's pull steps; it is also called directly from the
+// buffered fast paths in ReadableStreamDefaultReader.read() and the
+// async iterator, which resolve with the view without allocating a
+// read request.
+functionreadableByteStreamControllerDequeueChunk(controller){
+assert(controller[kState].queueTotalSize>0);
 const{
  buffer,
  byteOffset,
  byteLength,
-}=ArrayPrototypeShift(queue);
+}=ArrayPrototypeShift(controller[kState].queue);
 
 controller[kState].queueTotalSize-=byteLength;
 readableByteStreamControllerHandleQueueDrain(controller);
-constview=newUint8Array(buffer,byteOffset,byteLength);
-readRequest[kChunk](view);
+returnnewUint8Array(buffer,byteOffset,byteLength);
+}
+
+functionreadableByteStreamControllerFillReadRequestFromQueue(controller,readRequest){
+readRequest[kChunk](readableByteStreamControllerDequeueChunk(controller));
 }
 
 functionreadableByteStreamControllerProcessReadRequestsUsingQueue(controller){

lib/internal/webstreams/util.js

@@ -7,14 +7,19 @@ const {
  ArrayPrototypePush,
  ArrayPrototypeShift,
  AsyncIteratorPrototype,
+ DataViewPrototypeGetBuffer,
+ DataViewPrototypeGetByteLength,
+ DataViewPrototypeGetByteOffset,
  FunctionPrototypeCall,
  MathMax,
  NumberIsNaN,
  PromisePrototypeThen,
  PromiseReject,
  PromiseResolve,
- ReflectGet,
  Symbol,
+ TypedArrayPrototypeGetBuffer,
+ TypedArrayPrototypeGetByteLength,
+ TypedArrayPrototypeGetByteOffset,
  Uint8Array,
 }=primordials;
 
@@ -41,6 +46,10 @@ const {
 
 constassert=require('internal/assert');
 
+const{
+ isDataView,
+}=require('internal/util/types');
+
 const{
  validateFunction,
 }=require('internal/validators');
@@ -93,20 +102,29 @@ function customInspect(depth, options, name, data) {
 return`${name}${inspect(data,opts)}`;
 }
 
-// These are defensive to work around the possibility that
-// the buffer, byteLength, and byteOffset properties on
-// ArrayBuffer and ArrayBufferView's may have been tampered with.
+// These use the original prototype getters so that user tampering with
+// the buffer, byteLength, and byteOffset properties on ArrayBuffer and
+// ArrayBufferView's is not observed. They run once or more per chunk on
+// every byte-stream path, so they must not go through a reflective get
+// (the previous view.constructor.prototype lookup was both slower and
+// spoofable via a user-defined .constructor).
 
 functionArrayBufferViewGetBuffer(view){
-returnReflectGet(view.constructor.prototype,'buffer',view);
+returnisDataView(view) ?
+DataViewPrototypeGetBuffer(view) :
+TypedArrayPrototypeGetBuffer(view);
 }
 
 functionArrayBufferViewGetByteLength(view){
-returnReflectGet(view.constructor.prototype,'byteLength',view);
+returnisDataView(view) ?
+DataViewPrototypeGetByteLength(view) :
+TypedArrayPrototypeGetByteLength(view);
 }
 
 functionArrayBufferViewGetByteOffset(view){
-returnReflectGet(view.constructor.prototype,'byteOffset',view);
+returnisDataView(view) ?
+DataViewPrototypeGetByteOffset(view) :
+TypedArrayPrototypeGetByteOffset(view);
 }
 
 functioncloneAsUint8Array(view){

lib/internal/webstreams/readablestream.js

@@ -497,6 +497,12 @@ class ReadableStream {
 current: undefined,
 };
 letstarted=false;
+// A single reusable read request: at most one read is ever in flight
+// (next() chains through state.current), and the request is consumed
+// before the next read starts, so only its promise record changes
+// per read.
+// eslint-disable-next-line no-use-before-define
+constreadRequest=newReadableStreamAsyncIteratorReadRequest(reader,state,undefined);
 
 // The nextSteps function is not an async function in order
 // to make it more efficient. Because nextSteps explicitly
@@ -515,8 +521,8 @@ class ReadableStream {
 }
 constpromise=PromiseWithResolvers();
 
-// eslint-disable-next-line no-use-before-define
-readableStreamDefaultReaderRead(reader,newReadableStreamAsyncIteratorReadRequest(reader,state,promise));
+readRequest.promise=promise;
+readableStreamDefaultReaderRead(reader,readRequest);
 returnpromise.promise;
 }
 
@@ -570,28 +576,38 @@ class ReadableStream {
 }
 // No read is in flight. Mirror the buffered fast path of
 // ReadableStreamDefaultReader.read(): when data is already queued
-// in a default controller, resolve immediately without allocating
-// a read request. The result settles synchronously, so leaving
+// in the controller, resolve immediately without allocating a
+// read request. The result settles synchronously, so leaving
 // state.current undefined matches the state the slow path reaches
 // once its read request callbacks have settled.
 conststream=reader[kState].stream;
-if(!state.done&&stream!==undefined){
+if(!state.done&&stream!==undefined&&
+stream[kState].state==='readable'){
 constcontroller=stream[kState].controller;
-if(stream[kState].state==='readable'&&
-isReadableStreamDefaultController(controller)&&
-controller[kState].queue.length>0){
-stream[kState].disturbed=true;
-constchunk=dequeueValue(controller);
-
-if(controller[kState].closeRequested&&
-!controller[kState].queue.length){
-readableStreamDefaultControllerClearAlgorithms(controller);
-readableStreamClose(stream);
-}else{
-readableStreamDefaultControllerCallPullIfNeeded(controller);
+if(isReadableStreamDefaultController(controller)){
+if(controller[kState].queue.length>0){
+stream[kState].disturbed=true;
+constchunk=dequeueValue(controller);
+
+if(controller[kState].closeRequested&&
+!controller[kState].queue.length){
+readableStreamDefaultControllerClearAlgorithms(controller);
+readableStreamClose(stream);
+}else{
+readableStreamDefaultControllerCallPullIfNeeded(controller);
+}
+
+returnPromiseResolve({done: false,value: chunk});
 }
+}elseif(controller[kState].queueTotalSize>0){
+// Byte controller with buffered data: same shape as above via
+// the queue-filled arm of the byte controller's pull steps.
+stream[kState].disturbed=true;
+returnPromiseResolve({
+done: false,
 
-returnPromiseResolve({done: false,value: chunk});
+value: readableByteStreamControllerDequeueChunk(controller),
+});
 }
 }
 state.current=nextSteps();
@@ -914,24 +930,36 @@ class ReadableStreamDefaultReader {
 conststream=this[kState].stream;
 constcontroller=stream[kState].controller;
 
-// Fast path: if data is already buffered in a default controller,
+// Fast path: if data is already buffered in the controller's queue,
 // return a resolved promise immediately without creating a read request.
 // This is spec-compliant because read() returns a Promise, and
 // Promise.resolve() callbacks still run in the microtask queue.
-if(stream[kState].state==='readable'&&
-isReadableStreamDefaultController(controller)&&
-controller[kState].queue.length>0){
-stream[kState].disturbed=true;
-constchunk=dequeueValue(controller);
+if(stream[kState].state==='readable'){
+if(isReadableStreamDefaultController(controller)){
+if(controller[kState].queue.length>0){
+stream[kState].disturbed=true;
+constchunk=dequeueValue(controller);
+
+if(controller[kState].closeRequested&&!controller[kState].queue.length){
+readableStreamDefaultControllerClearAlgorithms(controller);
+readableStreamClose(stream);
+}else{
+readableStreamDefaultControllerCallPullIfNeeded(controller);
+}
 
-if(controller[kState].closeRequested&&!controller[kState].queue.length){
-readableStreamDefaultControllerClearAlgorithms(controller);
-readableStreamClose(stream);
-}else{
-readableStreamDefaultControllerCallPullIfNeeded(controller);
+returnPromiseResolve({done: false,value: chunk});
+}
+}elseif(controller[kState].queueTotalSize>0){
+// Byte controller with buffered data: mirror the queue-filled arm
+// of its pull steps (which never consults pendingPullIntos) minus
+// the read request.
+stream[kState].disturbed=true;
+returnPromiseResolve({
+done: false,
+
+value: readableByteStreamControllerDequeueChunk(controller),
+});
 }
-
-returnPromiseResolve({value: chunk,done: false});
 }
 
 // Slow path: create request and go through normal flow
@@ -3040,9 +3068,23 @@ function readableByteStreamControllerEnqueue(controller, chunk) {
 }
 }
 
-if(readableStreamHasDefaultReader(stream)){
-readableByteStreamControllerProcessReadRequestsUsingQueue(controller);
-if(!readableStreamGetNumReadRequests(stream)){
+// Single consolidated pass over the reader state. The spec routes this
+// through HasDefaultReader / ProcessReadRequestsUsingQueue /
+// GetNumReadRequests / FulfillReadRequest, which would re-run the same
+// reader brand check and re-load the read request list four times on
+// this per-chunk path.
+const{ reader }=stream[kState];
+if(reader!==undefined&&
+reader[kState]!==undefined&&
+reader[kType]==='ReadableStreamDefaultReader'){
+const{ readRequests }=reader[kState];
+if(readRequests.length&&controller[kState].queueTotalSize>0){
+// Only possible when data was enqueued while the stream was not
+// being read; read requests otherwise never coexist with a
+// non-empty queue.
+readableByteStreamControllerProcessReadRequestsUsingQueue(controller);
+}
+if(!readRequests.length){
 readableByteStreamControllerEnqueueChunkToQueue(
 controller,
 transferredBuffer,
@@ -3056,7 +3098,8 @@ function readableByteStreamControllerEnqueue(controller, chunk) {
 }
 consttransferredView=
 newUint8Array(transferredBuffer,byteOffset,byteLength);
-readableStreamFulfillReadRequest(stream,transferredView,false);
+constreadRequest=ArrayPrototypeShift(readRequests);
+readRequest[kChunk](transferredView);
 }
 }elseif(readableStreamHasBYOBReader(stream)){
 readableByteStreamControllerEnqueueChunkToQueue(
@@ -3391,22 +3434,28 @@ function readableByteStreamControllerCancelSteps(controller, reason) {
 returnresult;
 }
 
-functionreadableByteStreamControllerFillReadRequestFromQueue(controller,readRequest){
-const{
- queue,
- queueTotalSize,
-}=controller[kState];
-assert(queueTotalSize>0);
+// Dequeues the first chunk of the byte queue as a Uint8Array view,
+// handling queue drain (close-on-empty or pull) before the view is
+// created. This is the [[queueTotalSize]] > 0 arm of the byte
+// controller's pull steps; it is also called directly from the
+// buffered fast paths in ReadableStreamDefaultReader.read() and the
+// async iterator, which resolve with the view without allocating a
+// read request.
+functionreadableByteStreamControllerDequeueChunk(controller){
+assert(controller[kState].queueTotalSize>0);
 const{
  buffer,
  byteOffset,
  byteLength,
-}=ArrayPrototypeShift(queue);
+}=ArrayPrototypeShift(controller[kState].queue);
 
 controller[kState].queueTotalSize-=byteLength;
 readableByteStreamControllerHandleQueueDrain(controller);
-constview=newUint8Array(buffer,byteOffset,byteLength);
-readRequest[kChunk](view);
+returnnewUint8Array(buffer,byteOffset,byteLength);
+}
+
+functionreadableByteStreamControllerFillReadRequestFromQueue(controller,readRequest){
+readRequest[kChunk](readableByteStreamControllerDequeueChunk(controller));
 }
 
 functionreadableByteStreamControllerProcessReadRequestsUsingQueue(controller){

lib/internal/webstreams/util.js

@@ -7,14 +7,19 @@ const {
  ArrayPrototypePush,
  ArrayPrototypeShift,
  AsyncIteratorPrototype,
+ DataViewPrototypeGetBuffer,
+ DataViewPrototypeGetByteLength,
+ DataViewPrototypeGetByteOffset,
  FunctionPrototypeCall,
  MathMax,
  NumberIsNaN,
  PromisePrototypeThen,
  PromiseReject,
  PromiseResolve,
- ReflectGet,
  Symbol,
+ TypedArrayPrototypeGetBuffer,
+ TypedArrayPrototypeGetByteLength,
+ TypedArrayPrototypeGetByteOffset,
  Uint8Array,
 }=primordials;
 
@@ -41,6 +46,10 @@ const {
 
 constassert=require('internal/assert');
 
+const{
+ isDataView,
+}=require('internal/util/types');
+
 const{
  validateFunction,
 }=require('internal/validators');
@@ -93,20 +102,29 @@ function customInspect(depth, options, name, data) {
 return`${name}${inspect(data,opts)}`;
 }
 
-// These are defensive to work around the possibility that
-// the buffer, byteLength, and byteOffset properties on
-// ArrayBuffer and ArrayBufferView's may have been tampered with.
+// These use the original prototype getters so that user tampering with
+// the buffer, byteLength, and byteOffset properties on ArrayBuffer and
+// ArrayBufferView's is not observed. They run once or more per chunk on
+// every byte-stream path, so they must not go through a reflective get
+// (the previous view.constructor.prototype lookup was both slower and
+// spoofable via a user-defined .constructor).
 
 functionArrayBufferViewGetBuffer(view){
-returnReflectGet(view.constructor.prototype,'buffer',view);
+returnisDataView(view) ?
+DataViewPrototypeGetBuffer(view) :
+TypedArrayPrototypeGetBuffer(view);
 }
 
 functionArrayBufferViewGetByteLength(view){
-returnReflectGet(view.constructor.prototype,'byteLength',view);
+returnisDataView(view) ?
+DataViewPrototypeGetByteLength(view) :
+TypedArrayPrototypeGetByteLength(view);
 }
 
 functionArrayBufferViewGetByteOffset(view){
-returnReflectGet(view.constructor.prototype,'byteOffset',view);
+returnisDataView(view) ?
+DataViewPrototypeGetByteOffset(view) :
+TypedArrayPrototypeGetByteOffset(view);
 }
 
 functioncloneAsUint8Array(view){

lib/internal/webstreams/readablestream.js

@@ -497,6 +497,12 @@ class ReadableStream {
 current: undefined,
 };
 letstarted=false;
+// A single reusable read request: at most one read is ever in flight
+// (next() chains through state.current), and the request is consumed
+// before the next read starts, so only its promise record changes
+// per read.
+// eslint-disable-next-line no-use-before-define
+constreadRequest=newReadableStreamAsyncIteratorReadRequest(reader,state,undefined);
 
 // The nextSteps function is not an async function in order
 // to make it more efficient. Because nextSteps explicitly
@@ -515,8 +521,8 @@ class ReadableStream {
 }
 constpromise=PromiseWithResolvers();
 
-// eslint-disable-next-line no-use-before-define
-readableStreamDefaultReaderRead(reader,newReadableStreamAsyncIteratorReadRequest(reader,state,promise));
+readRequest.promise=promise;
+readableStreamDefaultReaderRead(reader,readRequest);
 returnpromise.promise;
 }
 
@@ -570,28 +576,38 @@ class ReadableStream {
 }
 // No read is in flight. Mirror the buffered fast path of
 // ReadableStreamDefaultReader.read(): when data is already queued
-// in a default controller, resolve immediately without allocating
-// a read request. The result settles synchronously, so leaving
+// in the controller, resolve immediately without allocating a
+// read request. The result settles synchronously, so leaving
 // state.current undefined matches the state the slow path reaches
 // once its read request callbacks have settled.
 conststream=reader[kState].stream;
-if(!state.done&&stream!==undefined){
+if(!state.done&&stream!==undefined&&
+stream[kState].state==='readable'){
 constcontroller=stream[kState].controller;
-if(stream[kState].state==='readable'&&
-isReadableStreamDefaultController(controller)&&
-controller[kState].queue.length>0){
-stream[kState].disturbed=true;
-constchunk=dequeueValue(controller);
-
-if(controller[kState].closeRequested&&
-!controller[kState].queue.length){
-readableStreamDefaultControllerClearAlgorithms(controller);
-readableStreamClose(stream);
-}else{
-readableStreamDefaultControllerCallPullIfNeeded(controller);
+if(isReadableStreamDefaultController(controller)){
+if(controller[kState].queue.length>0){
+stream[kState].disturbed=true;
+constchunk=dequeueValue(controller);
+
+if(controller[kState].closeRequested&&
+!controller[kState].queue.length){
+readableStreamDefaultControllerClearAlgorithms(controller);
+readableStreamClose(stream);
+}else{
+readableStreamDefaultControllerCallPullIfNeeded(controller);
+}
+
+returnPromiseResolve({done: false,value: chunk});
 }
+}elseif(controller[kState].queueTotalSize>0){
+// Byte controller with buffered data: same shape as above via
+// the queue-filled arm of the byte controller's pull steps.
+stream[kState].disturbed=true;
+returnPromiseResolve({
+done: false,
 
-returnPromiseResolve({done: false,value: chunk});
+value: readableByteStreamControllerDequeueChunk(controller),
+});
 }
 }
 state.current=nextSteps();
@@ -914,24 +930,36 @@ class ReadableStreamDefaultReader {
 conststream=this[kState].stream;
 constcontroller=stream[kState].controller;
 
-// Fast path: if data is already buffered in a default controller,
+// Fast path: if data is already buffered in the controller's queue,
 // return a resolved promise immediately without creating a read request.
 // This is spec-compliant because read() returns a Promise, and
 // Promise.resolve() callbacks still run in the microtask queue.
-if(stream[kState].state==='readable'&&
-isReadableStreamDefaultController(controller)&&
-controller[kState].queue.length>0){
-stream[kState].disturbed=true;
-constchunk=dequeueValue(controller);
+if(stream[kState].state==='readable'){
+if(isReadableStreamDefaultController(controller)){
+if(controller[kState].queue.length>0){
+stream[kState].disturbed=true;
+constchunk=dequeueValue(controller);
+
+if(controller[kState].closeRequested&&!controller[kState].queue.length){
+readableStreamDefaultControllerClearAlgorithms(controller);
+readableStreamClose(stream);
+}else{
+readableStreamDefaultControllerCallPullIfNeeded(controller);
+}
 
-if(controller[kState].closeRequested&&!controller[kState].queue.length){
-readableStreamDefaultControllerClearAlgorithms(controller);
-readableStreamClose(stream);
-}else{
-readableStreamDefaultControllerCallPullIfNeeded(controller);
+returnPromiseResolve({done: false,value: chunk});
+}
+}elseif(controller[kState].queueTotalSize>0){
+// Byte controller with buffered data: mirror the queue-filled arm
+// of its pull steps (which never consults pendingPullIntos) minus
+// the read request.
+stream[kState].disturbed=true;
+returnPromiseResolve({
+done: false,
+
+value: readableByteStreamControllerDequeueChunk(controller),
+});
 }
-
-returnPromiseResolve({value: chunk,done: false});
 }
 
 // Slow path: create request and go through normal flow
@@ -3040,9 +3068,23 @@ function readableByteStreamControllerEnqueue(controller, chunk) {
 }
 }
 
-if(readableStreamHasDefaultReader(stream)){
-readableByteStreamControllerProcessReadRequestsUsingQueue(controller);
-if(!readableStreamGetNumReadRequests(stream)){
+// Single consolidated pass over the reader state. The spec routes this
+// through HasDefaultReader / ProcessReadRequestsUsingQueue /
+// GetNumReadRequests / FulfillReadRequest, which would re-run the same
+// reader brand check and re-load the read request list four times on
+// this per-chunk path.
+const{ reader }=stream[kState];
+if(reader!==undefined&&
+reader[kState]!==undefined&&
+reader[kType]==='ReadableStreamDefaultReader'){
+const{ readRequests }=reader[kState];
+if(readRequests.length&&controller[kState].queueTotalSize>0){
+// Only possible when data was enqueued while the stream was not
+// being read; read requests otherwise never coexist with a
+// non-empty queue.
+readableByteStreamControllerProcessReadRequestsUsingQueue(controller);
+}
+if(!readRequests.length){
 readableByteStreamControllerEnqueueChunkToQueue(
 controller,
 transferredBuffer,
@@ -3056,7 +3098,8 @@ function readableByteStreamControllerEnqueue(controller, chunk) {
 }
 consttransferredView=
 newUint8Array(transferredBuffer,byteOffset,byteLength);
-readableStreamFulfillReadRequest(stream,transferredView,false);
+constreadRequest=ArrayPrototypeShift(readRequests);
+readRequest[kChunk](transferredView);
 }
 }elseif(readableStreamHasBYOBReader(stream)){
 readableByteStreamControllerEnqueueChunkToQueue(
@@ -3391,22 +3434,28 @@ function readableByteStreamControllerCancelSteps(controller, reason) {
 returnresult;
 }
 
-functionreadableByteStreamControllerFillReadRequestFromQueue(controller,readRequest){
-const{
- queue,
- queueTotalSize,
-}=controller[kState];
-assert(queueTotalSize>0);
+// Dequeues the first chunk of the byte queue as a Uint8Array view,
+// handling queue drain (close-on-empty or pull) before the view is
+// created. This is the [[queueTotalSize]] > 0 arm of the byte
+// controller's pull steps; it is also called directly from the
+// buffered fast paths in ReadableStreamDefaultReader.read() and the
+// async iterator, which resolve with the view without allocating a
+// read request.
+functionreadableByteStreamControllerDequeueChunk(controller){
+assert(controller[kState].queueTotalSize>0);
 const{
  buffer,
  byteOffset,
  byteLength,
-}=ArrayPrototypeShift(queue);
+}=ArrayPrototypeShift(controller[kState].queue);
 
 controller[kState].queueTotalSize-=byteLength;
 readableByteStreamControllerHandleQueueDrain(controller);
-constview=newUint8Array(buffer,byteOffset,byteLength);
-readRequest[kChunk](view);
+returnnewUint8Array(buffer,byteOffset,byteLength);
+}
+
+functionreadableByteStreamControllerFillReadRequestFromQueue(controller,readRequest){
+readRequest[kChunk](readableByteStreamControllerDequeueChunk(controller));
 }
 
 functionreadableByteStreamControllerProcessReadRequestsUsingQueue(controller){

lib/internal/webstreams/util.js

@@ -7,14 +7,19 @@ const {
  ArrayPrototypePush,
  ArrayPrototypeShift,
  AsyncIteratorPrototype,
+ DataViewPrototypeGetBuffer,
+ DataViewPrototypeGetByteLength,
+ DataViewPrototypeGetByteOffset,
  FunctionPrototypeCall,
  MathMax,
  NumberIsNaN,
  PromisePrototypeThen,
  PromiseReject,
  PromiseResolve,
- ReflectGet,
  Symbol,
+ TypedArrayPrototypeGetBuffer,
+ TypedArrayPrototypeGetByteLength,
+ TypedArrayPrototypeGetByteOffset,
  Uint8Array,
 }=primordials;
 
@@ -41,6 +46,10 @@ const {
 
 constassert=require('internal/assert');
 
+const{
+ isDataView,
+}=require('internal/util/types');
+
 const{
  validateFunction,
 }=require('internal/validators');
@@ -93,20 +102,29 @@ function customInspect(depth, options, name, data) {
 return`${name}${inspect(data,opts)}`;
 }
 
-// These are defensive to work around the possibility that
-// the buffer, byteLength, and byteOffset properties on
-// ArrayBuffer and ArrayBufferView's may have been tampered with.
+// These use the original prototype getters so that user tampering with
+// the buffer, byteLength, and byteOffset properties on ArrayBuffer and
+// ArrayBufferView's is not observed. They run once or more per chunk on
+// every byte-stream path, so they must not go through a reflective get
+// (the previous view.constructor.prototype lookup was both slower and
+// spoofable via a user-defined .constructor).
 
 functionArrayBufferViewGetBuffer(view){
-returnReflectGet(view.constructor.prototype,'buffer',view);
+returnisDataView(view) ?
+DataViewPrototypeGetBuffer(view) :
+TypedArrayPrototypeGetBuffer(view);
 }
 
 functionArrayBufferViewGetByteLength(view){
-returnReflectGet(view.constructor.prototype,'byteLength',view);
+returnisDataView(view) ?
+DataViewPrototypeGetByteLength(view) :
+TypedArrayPrototypeGetByteLength(view);
 }
 
 functionArrayBufferViewGetByteOffset(view){
-returnReflectGet(view.constructor.prototype,'byteOffset',view);
+returnisDataView(view) ?
+DataViewPrototypeGetByteOffset(view) :
+TypedArrayPrototypeGetByteOffset(view);
 }
 
 functioncloneAsUint8Array(view){

lib/internal/webstreams/readablestream.js

@@ -497,6 +497,12 @@ class ReadableStream {
 current: undefined,
 };
 letstarted=false;
+// A single reusable read request: at most one read is ever in flight
+// (next() chains through state.current), and the request is consumed
+// before the next read starts, so only its promise record changes
+// per read.
+// eslint-disable-next-line no-use-before-define
+constreadRequest=newReadableStreamAsyncIteratorReadRequest(reader,state,undefined);
 
 // The nextSteps function is not an async function in order
 // to make it more efficient. Because nextSteps explicitly
@@ -515,8 +521,8 @@ class ReadableStream {
 }
 constpromise=PromiseWithResolvers();
 
-// eslint-disable-next-line no-use-before-define
-readableStreamDefaultReaderRead(reader,newReadableStreamAsyncIteratorReadRequest(reader,state,promise));
+readRequest.promise=promise;
+readableStreamDefaultReaderRead(reader,readRequest);
 returnpromise.promise;
 }
 
@@ -570,28 +576,38 @@ class ReadableStream {
 }
 // No read is in flight. Mirror the buffered fast path of
 // ReadableStreamDefaultReader.read(): when data is already queued
-// in a default controller, resolve immediately without allocating
-// a read request. The result settles synchronously, so leaving
+// in the controller, resolve immediately without allocating a
+// read request. The result settles synchronously, so leaving
 // state.current undefined matches the state the slow path reaches
 // once its read request callbacks have settled.
 conststream=reader[kState].stream;
-if(!state.done&&stream!==undefined){
+if(!state.done&&stream!==undefined&&
+stream[kState].state==='readable'){
 constcontroller=stream[kState].controller;
-if(stream[kState].state==='readable'&&
-isReadableStreamDefaultController(controller)&&
-controller[kState].queue.length>0){
-stream[kState].disturbed=true;
-constchunk=dequeueValue(controller);
-
-if(controller[kState].closeRequested&&
-!controller[kState].queue.length){
-readableStreamDefaultControllerClearAlgorithms(controller);
-readableStreamClose(stream);
-}else{
-readableStreamDefaultControllerCallPullIfNeeded(controller);
+if(isReadableStreamDefaultController(controller)){
+if(controller[kState].queue.length>0){
+stream[kState].disturbed=true;
+constchunk=dequeueValue(controller);
+
+if(controller[kState].closeRequested&&
+!controller[kState].queue.length){
+readableStreamDefaultControllerClearAlgorithms(controller);
+readableStreamClose(stream);
+}else{
+readableStreamDefaultControllerCallPullIfNeeded(controller);
+}
+
+returnPromiseResolve({done: false,value: chunk});
 }
+}elseif(controller[kState].queueTotalSize>0){
+// Byte controller with buffered data: same shape as above via
+// the queue-filled arm of the byte controller's pull steps.
+stream[kState].disturbed=true;
+returnPromiseResolve({
+done: false,
 
-returnPromiseResolve({done: false,value: chunk});
+value: readableByteStreamControllerDequeueChunk(controller),
+});
 }
 }
 state.current=nextSteps();
@@ -914,24 +930,36 @@ class ReadableStreamDefaultReader {
 conststream=this[kState].stream;
 constcontroller=stream[kState].controller;
 
-// Fast path: if data is already buffered in a default controller,
+// Fast path: if data is already buffered in the controller's queue,
 // return a resolved promise immediately without creating a read request.
 // This is spec-compliant because read() returns a Promise, and
 // Promise.resolve() callbacks still run in the microtask queue.
-if(stream[kState].state==='readable'&&
-isReadableStreamDefaultController(controller)&&
-controller[kState].queue.length>0){
-stream[kState].disturbed=true;
-constchunk=dequeueValue(controller);
+if(stream[kState].state==='readable'){
+if(isReadableStreamDefaultController(controller)){
+if(controller[kState].queue.length>0){
+stream[kState].disturbed=true;
+constchunk=dequeueValue(controller);
+
+if(controller[kState].closeRequested&&!controller[kState].queue.length){
+readableStreamDefaultControllerClearAlgorithms(controller);
+readableStreamClose(stream);
+}else{
+readableStreamDefaultControllerCallPullIfNeeded(controller);
+}
 
-if(controller[kState].closeRequested&&!controller[kState].queue.length){
-readableStreamDefaultControllerClearAlgorithms(controller);
-readableStreamClose(stream);
-}else{
-readableStreamDefaultControllerCallPullIfNeeded(controller);
+returnPromiseResolve({done: false,value: chunk});
+}
+}elseif(controller[kState].queueTotalSize>0){
+// Byte controller with buffered data: mirror the queue-filled arm
+// of its pull steps (which never consults pendingPullIntos) minus
+// the read request.
+stream[kState].disturbed=true;
+returnPromiseResolve({
+done: false,
+
+value: readableByteStreamControllerDequeueChunk(controller),
+});
 }
-
-returnPromiseResolve({value: chunk,done: false});
 }
 
 // Slow path: create request and go through normal flow
@@ -3040,9 +3068,23 @@ function readableByteStreamControllerEnqueue(controller, chunk) {
 }
 }
 
-if(readableStreamHasDefaultReader(stream)){
-readableByteStreamControllerProcessReadRequestsUsingQueue(controller);
-if(!readableStreamGetNumReadRequests(stream)){
+// Single consolidated pass over the reader state. The spec routes this
+// through HasDefaultReader / ProcessReadRequestsUsingQueue /
+// GetNumReadRequests / FulfillReadRequest, which would re-run the same
+// reader brand check and re-load the read request list four times on
+// this per-chunk path.
+const{ reader }=stream[kState];
+if(reader!==undefined&&
+reader[kState]!==undefined&&
+reader[kType]==='ReadableStreamDefaultReader'){
+const{ readRequests }=reader[kState];
+if(readRequests.length&&controller[kState].queueTotalSize>0){
+// Only possible when data was enqueued while the stream was not
+// being read; read requests otherwise never coexist with a
+// non-empty queue.
+readableByteStreamControllerProcessReadRequestsUsingQueue(controller);
+}
+if(!readRequests.length){
 readableByteStreamControllerEnqueueChunkToQueue(
 controller,
 transferredBuffer,
@@ -3056,7 +3098,8 @@ function readableByteStreamControllerEnqueue(controller, chunk) {
 }
 consttransferredView=
 newUint8Array(transferredBuffer,byteOffset,byteLength);
-readableStreamFulfillReadRequest(stream,transferredView,false);
+constreadRequest=ArrayPrototypeShift(readRequests);
+readRequest[kChunk](transferredView);
 }
 }elseif(readableStreamHasBYOBReader(stream)){
 readableByteStreamControllerEnqueueChunkToQueue(
@@ -3391,22 +3434,28 @@ function readableByteStreamControllerCancelSteps(controller, reason) {
 returnresult;
 }
 
-functionreadableByteStreamControllerFillReadRequestFromQueue(controller,readRequest){
-const{
- queue,
- queueTotalSize,
-}=controller[kState];
-assert(queueTotalSize>0);
+// Dequeues the first chunk of the byte queue as a Uint8Array view,
+// handling queue drain (close-on-empty or pull) before the view is
+// created. This is the [[queueTotalSize]] > 0 arm of the byte
+// controller's pull steps; it is also called directly from the
+// buffered fast paths in ReadableStreamDefaultReader.read() and the
+// async iterator, which resolve with the view without allocating a
+// read request.
+functionreadableByteStreamControllerDequeueChunk(controller){
+assert(controller[kState].queueTotalSize>0);
 const{
  buffer,
  byteOffset,
  byteLength,
-}=ArrayPrototypeShift(queue);
+}=ArrayPrototypeShift(controller[kState].queue);
 
 controller[kState].queueTotalSize-=byteLength;
 readableByteStreamControllerHandleQueueDrain(controller);
-constview=newUint8Array(buffer,byteOffset,byteLength);
-readRequest[kChunk](view);
+returnnewUint8Array(buffer,byteOffset,byteLength);
+}
+
+functionreadableByteStreamControllerFillReadRequestFromQueue(controller,readRequest){
+readRequest[kChunk](readableByteStreamControllerDequeueChunk(controller));
 }
 
 functionreadableByteStreamControllerProcessReadRequestsUsingQueue(controller){

lib/internal/webstreams/util.js

@@ -7,14 +7,19 @@ const {
  ArrayPrototypePush,
  ArrayPrototypeShift,
  AsyncIteratorPrototype,
+ DataViewPrototypeGetBuffer,
+ DataViewPrototypeGetByteLength,
+ DataViewPrototypeGetByteOffset,
  FunctionPrototypeCall,
  MathMax,
  NumberIsNaN,
  PromisePrototypeThen,
  PromiseReject,
  PromiseResolve,
- ReflectGet,
  Symbol,
+ TypedArrayPrototypeGetBuffer,
+ TypedArrayPrototypeGetByteLength,
+ TypedArrayPrototypeGetByteOffset,
  Uint8Array,
 }=primordials;
 
@@ -41,6 +46,10 @@ const {
 
 constassert=require('internal/assert');
 
+const{
+ isDataView,
+}=require('internal/util/types');
+
 const{
  validateFunction,
 }=require('internal/validators');
@@ -93,20 +102,29 @@ function customInspect(depth, options, name, data) {
 return`${name}${inspect(data,opts)}`;
 }
 
-// These are defensive to work around the possibility that
-// the buffer, byteLength, and byteOffset properties on
-// ArrayBuffer and ArrayBufferView's may have been tampered with.
+// These use the original prototype getters so that user tampering with
+// the buffer, byteLength, and byteOffset properties on ArrayBuffer and
+// ArrayBufferView's is not observed. They run once or more per chunk on
+// every byte-stream path, so they must not go through a reflective get
+// (the previous view.constructor.prototype lookup was both slower and
+// spoofable via a user-defined .constructor).
 
 functionArrayBufferViewGetBuffer(view){
-returnReflectGet(view.constructor.prototype,'buffer',view);
+returnisDataView(view) ?
+DataViewPrototypeGetBuffer(view) :
+TypedArrayPrototypeGetBuffer(view);
 }
 
 functionArrayBufferViewGetByteLength(view){
-returnReflectGet(view.constructor.prototype,'byteLength',view);
+returnisDataView(view) ?
+DataViewPrototypeGetByteLength(view) :
+TypedArrayPrototypeGetByteLength(view);
 }
 
 functionArrayBufferViewGetByteOffset(view){
-returnReflectGet(view.constructor.prototype,'byteOffset',view);
+returnisDataView(view) ?
+DataViewPrototypeGetByteOffset(view) :
+TypedArrayPrototypeGetByteOffset(view);
 }
 
 functioncloneAsUint8Array(view){

lib/internal/webstreams/readablestream.js

@@ -497,6 +497,12 @@ class ReadableStream {
 current: undefined,
 };
 letstarted=false;
+// A single reusable read request: at most one read is ever in flight
+// (next() chains through state.current), and the request is consumed
+// before the next read starts, so only its promise record changes
+// per read.
+// eslint-disable-next-line no-use-before-define
+constreadRequest=newReadableStreamAsyncIteratorReadRequest(reader,state,undefined);
 
 // The nextSteps function is not an async function in order
 // to make it more efficient. Because nextSteps explicitly
@@ -515,8 +521,8 @@ class ReadableStream {
 }
 constpromise=PromiseWithResolvers();
 
-// eslint-disable-next-line no-use-before-define
-readableStreamDefaultReaderRead(reader,newReadableStreamAsyncIteratorReadRequest(reader,state,promise));
+readRequest.promise=promise;
+readableStreamDefaultReaderRead(reader,readRequest);
 returnpromise.promise;
 }
 
@@ -570,28 +576,38 @@ class ReadableStream {
 }
 // No read is in flight. Mirror the buffered fast path of
 // ReadableStreamDefaultReader.read(): when data is already queued
-// in a default controller, resolve immediately without allocating
-// a read request. The result settles synchronously, so leaving
+// in the controller, resolve immediately without allocating a
+// read request. The result settles synchronously, so leaving
 // state.current undefined matches the state the slow path reaches
 // once its read request callbacks have settled.
 conststream=reader[kState].stream;
-if(!state.done&&stream!==undefined){
+if(!state.done&&stream!==undefined&&
+stream[kState].state==='readable'){
 constcontroller=stream[kState].controller;
-if(stream[kState].state==='readable'&&
-isReadableStreamDefaultController(controller)&&
-controller[kState].queue.length>0){
-stream[kState].disturbed=true;
-constchunk=dequeueValue(controller);
-
-if(controller[kState].closeRequested&&
-!controller[kState].queue.length){
-readableStreamDefaultControllerClearAlgorithms(controller);
-readableStreamClose(stream);
-}else{
-readableStreamDefaultControllerCallPullIfNeeded(controller);
+if(isReadableStreamDefaultController(controller)){
+if(controller[kState].queue.length>0){
+stream[kState].disturbed=true;
+constchunk=dequeueValue(controller);
+
+if(controller[kState].closeRequested&&
+!controller[kState].queue.length){
+readableStreamDefaultControllerClearAlgorithms(controller);
+readableStreamClose(stream);
+}else{
+readableStreamDefaultControllerCallPullIfNeeded(controller);
+}
+
+returnPromiseResolve({done: false,value: chunk});
 }
+}elseif(controller[kState].queueTotalSize>0){
+// Byte controller with buffered data: same shape as above via
+// the queue-filled arm of the byte controller's pull steps.
+stream[kState].disturbed=true;
+returnPromiseResolve({
+done: false,
 
-returnPromiseResolve({done: false,value: chunk});
+value: readableByteStreamControllerDequeueChunk(controller),
+});
 }
 }
 state.current=nextSteps();
@@ -914,24 +930,36 @@ class ReadableStreamDefaultReader {
 conststream=this[kState].stream;
 constcontroller=stream[kState].controller;
 
-// Fast path: if data is already buffered in a default controller,
+// Fast path: if data is already buffered in the controller's queue,
 // return a resolved promise immediately without creating a read request.
 // This is spec-compliant because read() returns a Promise, and
 // Promise.resolve() callbacks still run in the microtask queue.
-if(stream[kState].state==='readable'&&
-isReadableStreamDefaultController(controller)&&
-controller[kState].queue.length>0){
-stream[kState].disturbed=true;
-constchunk=dequeueValue(controller);
+if(stream[kState].state==='readable'){
+if(isReadableStreamDefaultController(controller)){
+if(controller[kState].queue.length>0){
+stream[kState].disturbed=true;
+constchunk=dequeueValue(controller);
+
+if(controller[kState].closeRequested&&!controller[kState].queue.length){
+readableStreamDefaultControllerClearAlgorithms(controller);
+readableStreamClose(stream);
+}else{
+readableStreamDefaultControllerCallPullIfNeeded(controller);
+}
 
-if(controller[kState].closeRequested&&!controller[kState].queue.length){
-readableStreamDefaultControllerClearAlgorithms(controller);
-readableStreamClose(stream);
-}else{
-readableStreamDefaultControllerCallPullIfNeeded(controller);
+returnPromiseResolve({done: false,value: chunk});
+}
+}elseif(controller[kState].queueTotalSize>0){
+// Byte controller with buffered data: mirror the queue-filled arm
+// of its pull steps (which never consults pendingPullIntos) minus
+// the read request.
+stream[kState].disturbed=true;
+returnPromiseResolve({
+done: false,
+
+value: readableByteStreamControllerDequeueChunk(controller),
+});
 }
-
-returnPromiseResolve({value: chunk,done: false});
 }
 
 // Slow path: create request and go through normal flow
@@ -3040,9 +3068,23 @@ function readableByteStreamControllerEnqueue(controller, chunk) {
 }
 }
 
-if(readableStreamHasDefaultReader(stream)){
-readableByteStreamControllerProcessReadRequestsUsingQueue(controller);
-if(!readableStreamGetNumReadRequests(stream)){
+// Single consolidated pass over the reader state. The spec routes this
+// through HasDefaultReader / ProcessReadRequestsUsingQueue /
+// GetNumReadRequests / FulfillReadRequest, which would re-run the same
+// reader brand check and re-load the read request list four times on
+// this per-chunk path.
+const{ reader }=stream[kState];
+if(reader!==undefined&&
+reader[kState]!==undefined&&
+reader[kType]==='ReadableStreamDefaultReader'){
+const{ readRequests }=reader[kState];
+if(readRequests.length&&controller[kState].queueTotalSize>0){
+// Only possible when data was enqueued while the stream was not
+// being read; read requests otherwise never coexist with a
+// non-empty queue.
+readableByteStreamControllerProcessReadRequestsUsingQueue(controller);
+}
+if(!readRequests.length){
 readableByteStreamControllerEnqueueChunkToQueue(
 controller,
 transferredBuffer,
@@ -3056,7 +3098,8 @@ function readableByteStreamControllerEnqueue(controller, chunk) {
 }
 consttransferredView=
 newUint8Array(transferredBuffer,byteOffset,byteLength);
-readableStreamFulfillReadRequest(stream,transferredView,false);
+constreadRequest=ArrayPrototypeShift(readRequests);
+readRequest[kChunk](transferredView);
 }
 }elseif(readableStreamHasBYOBReader(stream)){
 readableByteStreamControllerEnqueueChunkToQueue(
@@ -3391,22 +3434,28 @@ function readableByteStreamControllerCancelSteps(controller, reason) {
 returnresult;
 }
 
-functionreadableByteStreamControllerFillReadRequestFromQueue(controller,readRequest){
-const{
- queue,
- queueTotalSize,
-}=controller[kState];
-assert(queueTotalSize>0);
+// Dequeues the first chunk of the byte queue as a Uint8Array view,
+// handling queue drain (close-on-empty or pull) before the view is
+// created. This is the [[queueTotalSize]] > 0 arm of the byte
+// controller's pull steps; it is also called directly from the
+// buffered fast paths in ReadableStreamDefaultReader.read() and the
+// async iterator, which resolve with the view without allocating a
+// read request.
+functionreadableByteStreamControllerDequeueChunk(controller){
+assert(controller[kState].queueTotalSize>0);
 const{
  buffer,
  byteOffset,
  byteLength,
-}=ArrayPrototypeShift(queue);
+}=ArrayPrototypeShift(controller[kState].queue);
 
 controller[kState].queueTotalSize-=byteLength;
 readableByteStreamControllerHandleQueueDrain(controller);
-constview=newUint8Array(buffer,byteOffset,byteLength);
-readRequest[kChunk](view);
+returnnewUint8Array(buffer,byteOffset,byteLength);
+}
+
+functionreadableByteStreamControllerFillReadRequestFromQueue(controller,readRequest){
+readRequest[kChunk](readableByteStreamControllerDequeueChunk(controller));
 }
 
 functionreadableByteStreamControllerProcessReadRequestsUsingQueue(controller){

lib/internal/webstreams/util.js

@@ -7,14 +7,19 @@ const {
  ArrayPrototypePush,
  ArrayPrototypeShift,
  AsyncIteratorPrototype,
+ DataViewPrototypeGetBuffer,
+ DataViewPrototypeGetByteLength,
+ DataViewPrototypeGetByteOffset,
  FunctionPrototypeCall,
  MathMax,
  NumberIsNaN,
  PromisePrototypeThen,
  PromiseReject,
  PromiseResolve,
- ReflectGet,
  Symbol,
+ TypedArrayPrototypeGetBuffer,
+ TypedArrayPrototypeGetByteLength,
+ TypedArrayPrototypeGetByteOffset,
  Uint8Array,
 }=primordials;
 
@@ -41,6 +46,10 @@ const {
 
 constassert=require('internal/assert');
 
+const{
+ isDataView,
+}=require('internal/util/types');
+
 const{
  validateFunction,
 }=require('internal/validators');
@@ -93,20 +102,29 @@ function customInspect(depth, options, name, data) {
 return`${name}${inspect(data,opts)}`;
 }
 
-// These are defensive to work around the possibility that
-// the buffer, byteLength, and byteOffset properties on
-// ArrayBuffer and ArrayBufferView's may have been tampered with.
+// These use the original prototype getters so that user tampering with
+// the buffer, byteLength, and byteOffset properties on ArrayBuffer and
+// ArrayBufferView's is not observed. They run once or more per chunk on
+// every byte-stream path, so they must not go through a reflective get
+// (the previous view.constructor.prototype lookup was both slower and
+// spoofable via a user-defined .constructor).
 
 functionArrayBufferViewGetBuffer(view){
-returnReflectGet(view.constructor.prototype,'buffer',view);
+returnisDataView(view) ?
+DataViewPrototypeGetBuffer(view) :
+TypedArrayPrototypeGetBuffer(view);
 }
 
 functionArrayBufferViewGetByteLength(view){
-returnReflectGet(view.constructor.prototype,'byteLength',view);
+returnisDataView(view) ?
+DataViewPrototypeGetByteLength(view) :
+TypedArrayPrototypeGetByteLength(view);
 }
 
 functionArrayBufferViewGetByteOffset(view){
-returnReflectGet(view.constructor.prototype,'byteOffset',view);
+returnisDataView(view) ?
+DataViewPrototypeGetByteOffset(view) :
+TypedArrayPrototypeGetByteOffset(view);
 }
 
 functioncloneAsUint8Array(view){

lib/internal/webstreams/readablestream.js

@@ -497,6 +497,12 @@ class ReadableStream {
 current: undefined,
 };
 letstarted=false;
+// A single reusable read request: at most one read is ever in flight
+// (next() chains through state.current), and the request is consumed
+// before the next read starts, so only its promise record changes
+// per read.
+// eslint-disable-next-line no-use-before-define
+constreadRequest=newReadableStreamAsyncIteratorReadRequest(reader,state,undefined);
 
 // The nextSteps function is not an async function in order
 // to make it more efficient. Because nextSteps explicitly
@@ -515,8 +521,8 @@ class ReadableStream {
 }
 constpromise=PromiseWithResolvers();
 
-// eslint-disable-next-line no-use-before-define
-readableStreamDefaultReaderRead(reader,newReadableStreamAsyncIteratorReadRequest(reader,state,promise));
+readRequest.promise=promise;
+readableStreamDefaultReaderRead(reader,readRequest);
 returnpromise.promise;
 }
 
@@ -570,28 +576,38 @@ class ReadableStream {
 }
 // No read is in flight. Mirror the buffered fast path of
 // ReadableStreamDefaultReader.read(): when data is already queued
-// in a default controller, resolve immediately without allocating
-// a read request. The result settles synchronously, so leaving
+// in the controller, resolve immediately without allocating a
+// read request. The result settles synchronously, so leaving
 // state.current undefined matches the state the slow path reaches
 // once its read request callbacks have settled.
 conststream=reader[kState].stream;
-if(!state.done&&stream!==undefined){
+if(!state.done&&stream!==undefined&&
+stream[kState].state==='readable'){
 constcontroller=stream[kState].controller;
-if(stream[kState].state==='readable'&&
-isReadableStreamDefaultController(controller)&&
-controller[kState].queue.length>0){
-stream[kState].disturbed=true;
-constchunk=dequeueValue(controller);
-
-if(controller[kState].closeRequested&&
-!controller[kState].queue.length){
-readableStreamDefaultControllerClearAlgorithms(controller);
-readableStreamClose(stream);
-}else{
-readableStreamDefaultControllerCallPullIfNeeded(controller);
+if(isReadableStreamDefaultController(controller)){
+if(controller[kState].queue.length>0){
+stream[kState].disturbed=true;
+constchunk=dequeueValue(controller);
+
+if(controller[kState].closeRequested&&
+!controller[kState].queue.length){
+readableStreamDefaultControllerClearAlgorithms(controller);
+readableStreamClose(stream);
+}else{
+readableStreamDefaultControllerCallPullIfNeeded(controller);
+}
+
+returnPromiseResolve({done: false,value: chunk});
 }
+}elseif(controller[kState].queueTotalSize>0){
+// Byte controller with buffered data: same shape as above via
+// the queue-filled arm of the byte controller's pull steps.
+stream[kState].disturbed=true;
+returnPromiseResolve({
+done: false,
 
-returnPromiseResolve({done: false,value: chunk});
+value: readableByteStreamControllerDequeueChunk(controller),
+});
 }
 }
 state.current=nextSteps();
@@ -914,24 +930,36 @@ class ReadableStreamDefaultReader {
 conststream=this[kState].stream;
 constcontroller=stream[kState].controller;
 
-// Fast path: if data is already buffered in a default controller,
+// Fast path: if data is already buffered in the controller's queue,
 // return a resolved promise immediately without creating a read request.
 // This is spec-compliant because read() returns a Promise, and
 // Promise.resolve() callbacks still run in the microtask queue.
-if(stream[kState].state==='readable'&&
-isReadableStreamDefaultController(controller)&&
-controller[kState].queue.length>0){
-stream[kState].disturbed=true;
-constchunk=dequeueValue(controller);
+if(stream[kState].state==='readable'){
+if(isReadableStreamDefaultController(controller)){
+if(controller[kState].queue.length>0){
+stream[kState].disturbed=true;
+constchunk=dequeueValue(controller);
+
+if(controller[kState].closeRequested&&!controller[kState].queue.length){
+readableStreamDefaultControllerClearAlgorithms(controller);
+readableStreamClose(stream);
+}else{
+readableStreamDefaultControllerCallPullIfNeeded(controller);
+}
 
-if(controller[kState].closeRequested&&!controller[kState].queue.length){
-readableStreamDefaultControllerClearAlgorithms(controller);
-readableStreamClose(stream);
-}else{
-readableStreamDefaultControllerCallPullIfNeeded(controller);
+returnPromiseResolve({done: false,value: chunk});
+}
+}elseif(controller[kState].queueTotalSize>0){
+// Byte controller with buffered data: mirror the queue-filled arm
+// of its pull steps (which never consults pendingPullIntos) minus
+// the read request.
+stream[kState].disturbed=true;
+returnPromiseResolve({
+done: false,
+
+value: readableByteStreamControllerDequeueChunk(controller),
+});
 }
-
-returnPromiseResolve({value: chunk,done: false});
 }
 
 // Slow path: create request and go through normal flow
@@ -3040,9 +3068,23 @@ function readableByteStreamControllerEnqueue(controller, chunk) {
 }
 }
 
-if(readableStreamHasDefaultReader(stream)){
-readableByteStreamControllerProcessReadRequestsUsingQueue(controller);
-if(!readableStreamGetNumReadRequests(stream)){
+// Single consolidated pass over the reader state. The spec routes this
+// through HasDefaultReader / ProcessReadRequestsUsingQueue /
+// GetNumReadRequests / FulfillReadRequest, which would re-run the same
+// reader brand check and re-load the read request list four times on
+// this per-chunk path.
+const{ reader }=stream[kState];
+if(reader!==undefined&&
+reader[kState]!==undefined&&
+reader[kType]==='ReadableStreamDefaultReader'){
+const{ readRequests }=reader[kState];
+if(readRequests.length&&controller[kState].queueTotalSize>0){
+// Only possible when data was enqueued while the stream was not
+// being read; read requests otherwise never coexist with a
+// non-empty queue.
+readableByteStreamControllerProcessReadRequestsUsingQueue(controller);
+}
+if(!readRequests.length){
 readableByteStreamControllerEnqueueChunkToQueue(
 controller,
 transferredBuffer,
@@ -3056,7 +3098,8 @@ function readableByteStreamControllerEnqueue(controller, chunk) {
 }
 consttransferredView=
 newUint8Array(transferredBuffer,byteOffset,byteLength);
-readableStreamFulfillReadRequest(stream,transferredView,false);
+constreadRequest=ArrayPrototypeShift(readRequests);
+readRequest[kChunk](transferredView);
 }
 }elseif(readableStreamHasBYOBReader(stream)){
 readableByteStreamControllerEnqueueChunkToQueue(
@@ -3391,22 +3434,28 @@ function readableByteStreamControllerCancelSteps(controller, reason) {
 returnresult;
 }
 
-functionreadableByteStreamControllerFillReadRequestFromQueue(controller,readRequest){
-const{
- queue,
- queueTotalSize,
-}=controller[kState];
-assert(queueTotalSize>0);
+// Dequeues the first chunk of the byte queue as a Uint8Array view,
+// handling queue drain (close-on-empty or pull) before the view is
+// created. This is the [[queueTotalSize]] > 0 arm of the byte
+// controller's pull steps; it is also called directly from the
+// buffered fast paths in ReadableStreamDefaultReader.read() and the
+// async iterator, which resolve with the view without allocating a
+// read request.
+functionreadableByteStreamControllerDequeueChunk(controller){
+assert(controller[kState].queueTotalSize>0);
 const{
  buffer,
  byteOffset,
  byteLength,
-}=ArrayPrototypeShift(queue);
+}=ArrayPrototypeShift(controller[kState].queue);
 
 controller[kState].queueTotalSize-=byteLength;
 readableByteStreamControllerHandleQueueDrain(controller);
-constview=newUint8Array(buffer,byteOffset,byteLength);
-readRequest[kChunk](view);
+returnnewUint8Array(buffer,byteOffset,byteLength);
+}
+
+functionreadableByteStreamControllerFillReadRequestFromQueue(controller,readRequest){
+readRequest[kChunk](readableByteStreamControllerDequeueChunk(controller));
 }
 
 functionreadableByteStreamControllerProcessReadRequestsUsingQueue(controller){

lib/internal/webstreams/util.js

@@ -7,14 +7,19 @@ const {
  ArrayPrototypePush,
  ArrayPrototypeShift,
  AsyncIteratorPrototype,
+ DataViewPrototypeGetBuffer,
+ DataViewPrototypeGetByteLength,
+ DataViewPrototypeGetByteOffset,
  FunctionPrototypeCall,
  MathMax,
  NumberIsNaN,
  PromisePrototypeThen,
  PromiseReject,
  PromiseResolve,
- ReflectGet,
  Symbol,
+ TypedArrayPrototypeGetBuffer,
+ TypedArrayPrototypeGetByteLength,
+ TypedArrayPrototypeGetByteOffset,
  Uint8Array,
 }=primordials;
 
@@ -41,6 +46,10 @@ const {
 
 constassert=require('internal/assert');
 
+const{
+ isDataView,
+}=require('internal/util/types');
+
 const{
  validateFunction,
 }=require('internal/validators');
@@ -93,20 +102,29 @@ function customInspect(depth, options, name, data) {
 return`${name}${inspect(data,opts)}`;
 }
 
-// These are defensive to work around the possibility that
-// the buffer, byteLength, and byteOffset properties on
-// ArrayBuffer and ArrayBufferView's may have been tampered with.
+// These use the original prototype getters so that user tampering with
+// the buffer, byteLength, and byteOffset properties on ArrayBuffer and
+// ArrayBufferView's is not observed. They run once or more per chunk on
+// every byte-stream path, so they must not go through a reflective get
+// (the previous view.constructor.prototype lookup was both slower and
+// spoofable via a user-defined .constructor).
 
 functionArrayBufferViewGetBuffer(view){
-returnReflectGet(view.constructor.prototype,'buffer',view);
+returnisDataView(view) ?
+DataViewPrototypeGetBuffer(view) :
+TypedArrayPrototypeGetBuffer(view);
 }
 
 functionArrayBufferViewGetByteLength(view){
-returnReflectGet(view.constructor.prototype,'byteLength',view);
+returnisDataView(view) ?
+DataViewPrototypeGetByteLength(view) :
+TypedArrayPrototypeGetByteLength(view);
 }
 
 functionArrayBufferViewGetByteOffset(view){
-returnReflectGet(view.constructor.prototype,'byteOffset',view);
+returnisDataView(view) ?
+DataViewPrototypeGetByteOffset(view) :
+TypedArrayPrototypeGetByteOffset(view);
 }
 
 functioncloneAsUint8Array(view){

lib/internal/webstreams/readablestream.js

@@ -497,6 +497,12 @@ class ReadableStream {
 current: undefined,
 };
 letstarted=false;
+// A single reusable read request: at most one read is ever in flight
+// (next() chains through state.current), and the request is consumed
+// before the next read starts, so only its promise record changes
+// per read.
+// eslint-disable-next-line no-use-before-define
+constreadRequest=newReadableStreamAsyncIteratorReadRequest(reader,state,undefined);
 
 // The nextSteps function is not an async function in order
 // to make it more efficient. Because nextSteps explicitly
@@ -515,8 +521,8 @@ class ReadableStream {
 }
 constpromise=PromiseWithResolvers();
 
-// eslint-disable-next-line no-use-before-define
-readableStreamDefaultReaderRead(reader,newReadableStreamAsyncIteratorReadRequest(reader,state,promise));
+readRequest.promise=promise;
+readableStreamDefaultReaderRead(reader,readRequest);
 returnpromise.promise;
 }
 
@@ -570,28 +576,38 @@ class ReadableStream {
 }
 // No read is in flight. Mirror the buffered fast path of
 // ReadableStreamDefaultReader.read(): when data is already queued
-// in a default controller, resolve immediately without allocating
-// a read request. The result settles synchronously, so leaving
+// in the controller, resolve immediately without allocating a
+// read request. The result settles synchronously, so leaving
 // state.current undefined matches the state the slow path reaches
 // once its read request callbacks have settled.
 conststream=reader[kState].stream;
-if(!state.done&&stream!==undefined){
+if(!state.done&&stream!==undefined&&
+stream[kState].state==='readable'){
 constcontroller=stream[kState].controller;
-if(stream[kState].state==='readable'&&
-isReadableStreamDefaultController(controller)&&
-controller[kState].queue.length>0){
-stream[kState].disturbed=true;
-constchunk=dequeueValue(controller);
-
-if(controller[kState].closeRequested&&
-!controller[kState].queue.length){
-readableStreamDefaultControllerClearAlgorithms(controller);
-readableStreamClose(stream);
-}else{
-readableStreamDefaultControllerCallPullIfNeeded(controller);
+if(isReadableStreamDefaultController(controller)){
+if(controller[kState].queue.length>0){
+stream[kState].disturbed=true;
+constchunk=dequeueValue(controller);
+
+if(controller[kState].closeRequested&&
+!controller[kState].queue.length){
+readableStreamDefaultControllerClearAlgorithms(controller);
+readableStreamClose(stream);
+}else{
+readableStreamDefaultControllerCallPullIfNeeded(controller);
+}
+
+returnPromiseResolve({done: false,value: chunk});
 }
+}elseif(controller[kState].queueTotalSize>0){
+// Byte controller with buffered data: same shape as above via
+// the queue-filled arm of the byte controller's pull steps.
+stream[kState].disturbed=true;
+returnPromiseResolve({
+done: false,
 
-returnPromiseResolve({done: false,value: chunk});
+value: readableByteStreamControllerDequeueChunk(controller),
+});
 }
 }
 state.current=nextSteps();
@@ -914,24 +930,36 @@ class ReadableStreamDefaultReader {
 conststream=this[kState].stream;
 constcontroller=stream[kState].controller;
 
-// Fast path: if data is already buffered in a default controller,
+// Fast path: if data is already buffered in the controller's queue,
 // return a resolved promise immediately without creating a read request.
 // This is spec-compliant because read() returns a Promise, and
 // Promise.resolve() callbacks still run in the microtask queue.
-if(stream[kState].state==='readable'&&
-isReadableStreamDefaultController(controller)&&
-controller[kState].queue.length>0){
-stream[kState].disturbed=true;
-constchunk=dequeueValue(controller);
+if(stream[kState].state==='readable'){
+if(isReadableStreamDefaultController(controller)){
+if(controller[kState].queue.length>0){
+stream[kState].disturbed=true;
+constchunk=dequeueValue(controller);
+
+if(controller[kState].closeRequested&&!controller[kState].queue.length){
+readableStreamDefaultControllerClearAlgorithms(controller);
+readableStreamClose(stream);
+}else{
+readableStreamDefaultControllerCallPullIfNeeded(controller);
+}
 
-if(controller[kState].closeRequested&&!controller[kState].queue.length){
-readableStreamDefaultControllerClearAlgorithms(controller);
-readableStreamClose(stream);
-}else{
-readableStreamDefaultControllerCallPullIfNeeded(controller);
+returnPromiseResolve({done: false,value: chunk});
+}
+}elseif(controller[kState].queueTotalSize>0){
+// Byte controller with buffered data: mirror the queue-filled arm
+// of its pull steps (which never consults pendingPullIntos) minus
+// the read request.
+stream[kState].disturbed=true;
+returnPromiseResolve({
+done: false,
+
+value: readableByteStreamControllerDequeueChunk(controller),
+});
 }
-
-returnPromiseResolve({value: chunk,done: false});
 }
 
 // Slow path: create request and go through normal flow
@@ -3040,9 +3068,23 @@ function readableByteStreamControllerEnqueue(controller, chunk) {
 }
 }
 
-if(readableStreamHasDefaultReader(stream)){
-readableByteStreamControllerProcessReadRequestsUsingQueue(controller);
-if(!readableStreamGetNumReadRequests(stream)){
+// Single consolidated pass over the reader state. The spec routes this
+// through HasDefaultReader / ProcessReadRequestsUsingQueue /
+// GetNumReadRequests / FulfillReadRequest, which would re-run the same
+// reader brand check and re-load the read request list four times on
+// this per-chunk path.
+const{ reader }=stream[kState];
+if(reader!==undefined&&
+reader[kState]!==undefined&&
+reader[kType]==='ReadableStreamDefaultReader'){
+const{ readRequests }=reader[kState];
+if(readRequests.length&&controller[kState].queueTotalSize>0){
+// Only possible when data was enqueued while the stream was not
+// being read; read requests otherwise never coexist with a
+// non-empty queue.
+readableByteStreamControllerProcessReadRequestsUsingQueue(controller);
+}
+if(!readRequests.length){
 readableByteStreamControllerEnqueueChunkToQueue(
 controller,
 transferredBuffer,
@@ -3056,7 +3098,8 @@ function readableByteStreamControllerEnqueue(controller, chunk) {
 }
 consttransferredView=
 newUint8Array(transferredBuffer,byteOffset,byteLength);
-readableStreamFulfillReadRequest(stream,transferredView,false);
+constreadRequest=ArrayPrototypeShift(readRequests);
+readRequest[kChunk](transferredView);
 }
 }elseif(readableStreamHasBYOBReader(stream)){
 readableByteStreamControllerEnqueueChunkToQueue(
@@ -3391,22 +3434,28 @@ function readableByteStreamControllerCancelSteps(controller, reason) {
 returnresult;
 }
 
-functionreadableByteStreamControllerFillReadRequestFromQueue(controller,readRequest){
-const{
- queue,
- queueTotalSize,
-}=controller[kState];
-assert(queueTotalSize>0);
+// Dequeues the first chunk of the byte queue as a Uint8Array view,
+// handling queue drain (close-on-empty or pull) before the view is
+// created. This is the [[queueTotalSize]] > 0 arm of the byte
+// controller's pull steps; it is also called directly from the
+// buffered fast paths in ReadableStreamDefaultReader.read() and the
+// async iterator, which resolve with the view without allocating a
+// read request.
+functionreadableByteStreamControllerDequeueChunk(controller){
+assert(controller[kState].queueTotalSize>0);
 const{
  buffer,
  byteOffset,
  byteLength,
-}=ArrayPrototypeShift(queue);
+}=ArrayPrototypeShift(controller[kState].queue);
 
 controller[kState].queueTotalSize-=byteLength;
 readableByteStreamControllerHandleQueueDrain(controller);
-constview=newUint8Array(buffer,byteOffset,byteLength);
-readRequest[kChunk](view);
+returnnewUint8Array(buffer,byteOffset,byteLength);
+}
+
+functionreadableByteStreamControllerFillReadRequestFromQueue(controller,readRequest){
+readRequest[kChunk](readableByteStreamControllerDequeueChunk(controller));
 }
 
 functionreadableByteStreamControllerProcessReadRequestsUsingQueue(controller){

lib/internal/webstreams/util.js

@@ -7,14 +7,19 @@ const {
  ArrayPrototypePush,
  ArrayPrototypeShift,
  AsyncIteratorPrototype,
+ DataViewPrototypeGetBuffer,
+ DataViewPrototypeGetByteLength,
+ DataViewPrototypeGetByteOffset,
  FunctionPrototypeCall,
  MathMax,
  NumberIsNaN,
  PromisePrototypeThen,
  PromiseReject,
  PromiseResolve,
- ReflectGet,
  Symbol,
+ TypedArrayPrototypeGetBuffer,
+ TypedArrayPrototypeGetByteLength,
+ TypedArrayPrototypeGetByteOffset,
  Uint8Array,
 }=primordials;
 
@@ -41,6 +46,10 @@ const {
 
 constassert=require('internal/assert');
 
+const{
+ isDataView,
+}=require('internal/util/types');
+
 const{
  validateFunction,
 }=require('internal/validators');
@@ -93,20 +102,29 @@ function customInspect(depth, options, name, data) {
 return`${name}${inspect(data,opts)}`;
 }
 
-// These are defensive to work around the possibility that
-// the buffer, byteLength, and byteOffset properties on
-// ArrayBuffer and ArrayBufferView's may have been tampered with.
+// These use the original prototype getters so that user tampering with
+// the buffer, byteLength, and byteOffset properties on ArrayBuffer and
+// ArrayBufferView's is not observed. They run once or more per chunk on
+// every byte-stream path, so they must not go through a reflective get
+// (the previous view.constructor.prototype lookup was both slower and
+// spoofable via a user-defined .constructor).
 
 functionArrayBufferViewGetBuffer(view){
-returnReflectGet(view.constructor.prototype,'buffer',view);
+returnisDataView(view) ?
+DataViewPrototypeGetBuffer(view) :
+TypedArrayPrototypeGetBuffer(view);
 }
 
 functionArrayBufferViewGetByteLength(view){
-returnReflectGet(view.constructor.prototype,'byteLength',view);
+returnisDataView(view) ?
+DataViewPrototypeGetByteLength(view) :
+TypedArrayPrototypeGetByteLength(view);
 }
 
 functionArrayBufferViewGetByteOffset(view){
-returnReflectGet(view.constructor.prototype,'byteOffset',view);
+returnisDataView(view) ?
+DataViewPrototypeGetByteOffset(view) :
+TypedArrayPrototypeGetByteOffset(view);
 }
 
 functioncloneAsUint8Array(view){

lib/internal/webstreams/readablestream.js

@@ -497,6 +497,12 @@ class ReadableStream {
 current: undefined,
 };
 letstarted=false;
+// A single reusable read request: at most one read is ever in flight
+// (next() chains through state.current), and the request is consumed
+// before the next read starts, so only its promise record changes
+// per read.
+// eslint-disable-next-line no-use-before-define
+constreadRequest=newReadableStreamAsyncIteratorReadRequest(reader,state,undefined);
 
 // The nextSteps function is not an async function in order
 // to make it more efficient. Because nextSteps explicitly
@@ -515,8 +521,8 @@ class ReadableStream {
 }
 constpromise=PromiseWithResolvers();
 
-// eslint-disable-next-line no-use-before-define
-readableStreamDefaultReaderRead(reader,newReadableStreamAsyncIteratorReadRequest(reader,state,promise));
+readRequest.promise=promise;
+readableStreamDefaultReaderRead(reader,readRequest);
 returnpromise.promise;
 }
 
@@ -570,28 +576,38 @@ class ReadableStream {
 }
 // No read is in flight. Mirror the buffered fast path of
 // ReadableStreamDefaultReader.read(): when data is already queued
-// in a default controller, resolve immediately without allocating
-// a read request. The result settles synchronously, so leaving
+// in the controller, resolve immediately without allocating a
+// read request. The result settles synchronously, so leaving
 // state.current undefined matches the state the slow path reaches
 // once its read request callbacks have settled.
 conststream=reader[kState].stream;
-if(!state.done&&stream!==undefined){
+if(!state.done&&stream!==undefined&&
+stream[kState].state==='readable'){
 constcontroller=stream[kState].controller;
-if(stream[kState].state==='readable'&&
-isReadableStreamDefaultController(controller)&&
-controller[kState].queue.length>0){
-stream[kState].disturbed=true;
-constchunk=dequeueValue(controller);
-
-if(controller[kState].closeRequested&&
-!controller[kState].queue.length){
-readableStreamDefaultControllerClearAlgorithms(controller);
-readableStreamClose(stream);
-}else{
-readableStreamDefaultControllerCallPullIfNeeded(controller);
+if(isReadableStreamDefaultController(controller)){
+if(controller[kState].queue.length>0){
+stream[kState].disturbed=true;
+constchunk=dequeueValue(controller);
+
+if(controller[kState].closeRequested&&
+!controller[kState].queue.length){
+readableStreamDefaultControllerClearAlgorithms(controller);
+readableStreamClose(stream);
+}else{
+readableStreamDefaultControllerCallPullIfNeeded(controller);
+}
+
+returnPromiseResolve({done: false,value: chunk});
 }
+}elseif(controller[kState].queueTotalSize>0){
+// Byte controller with buffered data: same shape as above via
+// the queue-filled arm of the byte controller's pull steps.
+stream[kState].disturbed=true;
+returnPromiseResolve({
+done: false,
 
-returnPromiseResolve({done: false,value: chunk});
+value: readableByteStreamControllerDequeueChunk(controller),
+});
 }
 }
 state.current=nextSteps();
@@ -914,24 +930,36 @@ class ReadableStreamDefaultReader {
 conststream=this[kState].stream;
 constcontroller=stream[kState].controller;
 
-// Fast path: if data is already buffered in a default controller,
+// Fast path: if data is already buffered in the controller's queue,
 // return a resolved promise immediately without creating a read request.
 // This is spec-compliant because read() returns a Promise, and
 // Promise.resolve() callbacks still run in the microtask queue.
-if(stream[kState].state==='readable'&&
-isReadableStreamDefaultController(controller)&&
-controller[kState].queue.length>0){
-stream[kState].disturbed=true;
-constchunk=dequeueValue(controller);
+if(stream[kState].state==='readable'){
+if(isReadableStreamDefaultController(controller)){
+if(controller[kState].queue.length>0){
+stream[kState].disturbed=true;
+constchunk=dequeueValue(controller);
+
+if(controller[kState].closeRequested&&!controller[kState].queue.length){
+readableStreamDefaultControllerClearAlgorithms(controller);
+readableStreamClose(stream);
+}else{
+readableStreamDefaultControllerCallPullIfNeeded(controller);
+}
 
-if(controller[kState].closeRequested&&!controller[kState].queue.length){
-readableStreamDefaultControllerClearAlgorithms(controller);
-readableStreamClose(stream);
-}else{
-readableStreamDefaultControllerCallPullIfNeeded(controller);
+returnPromiseResolve({done: false,value: chunk});
+}
+}elseif(controller[kState].queueTotalSize>0){
+// Byte controller with buffered data: mirror the queue-filled arm
+// of its pull steps (which never consults pendingPullIntos) minus
+// the read request.
+stream[kState].disturbed=true;
+returnPromiseResolve({
+done: false,
+
+value: readableByteStreamControllerDequeueChunk(controller),
+});
 }
-
-returnPromiseResolve({value: chunk,done: false});
 }
 
 // Slow path: create request and go through normal flow
@@ -3040,9 +3068,23 @@ function readableByteStreamControllerEnqueue(controller, chunk) {
 }
 }
 
-if(readableStreamHasDefaultReader(stream)){
-readableByteStreamControllerProcessReadRequestsUsingQueue(controller);
-if(!readableStreamGetNumReadRequests(stream)){
+// Single consolidated pass over the reader state. The spec routes this
+// through HasDefaultReader / ProcessReadRequestsUsingQueue /
+// GetNumReadRequests / FulfillReadRequest, which would re-run the same
+// reader brand check and re-load the read request list four times on
+// this per-chunk path.
+const{ reader }=stream[kState];
+if(reader!==undefined&&
+reader[kState]!==undefined&&
+reader[kType]==='ReadableStreamDefaultReader'){
+const{ readRequests }=reader[kState];
+if(readRequests.length&&controller[kState].queueTotalSize>0){
+// Only possible when data was enqueued while the stream was not
+// being read; read requests otherwise never coexist with a
+// non-empty queue.
+readableByteStreamControllerProcessReadRequestsUsingQueue(controller);
+}
+if(!readRequests.length){
 readableByteStreamControllerEnqueueChunkToQueue(
 controller,
 transferredBuffer,
@@ -3056,7 +3098,8 @@ function readableByteStreamControllerEnqueue(controller, chunk) {
 }
 consttransferredView=
 newUint8Array(transferredBuffer,byteOffset,byteLength);
-readableStreamFulfillReadRequest(stream,transferredView,false);
+constreadRequest=ArrayPrototypeShift(readRequests);
+readRequest[kChunk](transferredView);
 }
 }elseif(readableStreamHasBYOBReader(stream)){
 readableByteStreamControllerEnqueueChunkToQueue(
@@ -3391,22 +3434,28 @@ function readableByteStreamControllerCancelSteps(controller, reason) {
 returnresult;
 }
 
-functionreadableByteStreamControllerFillReadRequestFromQueue(controller,readRequest){
-const{
- queue,
- queueTotalSize,
-}=controller[kState];
-assert(queueTotalSize>0);
+// Dequeues the first chunk of the byte queue as a Uint8Array view,
+// handling queue drain (close-on-empty or pull) before the view is
+// created. This is the [[queueTotalSize]] > 0 arm of the byte
+// controller's pull steps; it is also called directly from the
+// buffered fast paths in ReadableStreamDefaultReader.read() and the
+// async iterator, which resolve with the view without allocating a
+// read request.
+functionreadableByteStreamControllerDequeueChunk(controller){
+assert(controller[kState].queueTotalSize>0);
 const{
  buffer,
  byteOffset,
  byteLength,
-}=ArrayPrototypeShift(queue);
+}=ArrayPrototypeShift(controller[kState].queue);
 
 controller[kState].queueTotalSize-=byteLength;
 readableByteStreamControllerHandleQueueDrain(controller);
-constview=newUint8Array(buffer,byteOffset,byteLength);
-readRequest[kChunk](view);
+returnnewUint8Array(buffer,byteOffset,byteLength);
+}
+
+functionreadableByteStreamControllerFillReadRequestFromQueue(controller,readRequest){
+readRequest[kChunk](readableByteStreamControllerDequeueChunk(controller));
 }
 
 functionreadableByteStreamControllerProcessReadRequestsUsingQueue(controller){

lib/internal/webstreams/util.js

@@ -7,14 +7,19 @@ const {
  ArrayPrototypePush,
  ArrayPrototypeShift,
  AsyncIteratorPrototype,
+ DataViewPrototypeGetBuffer,
+ DataViewPrototypeGetByteLength,
+ DataViewPrototypeGetByteOffset,
  FunctionPrototypeCall,
  MathMax,
  NumberIsNaN,
  PromisePrototypeThen,
  PromiseReject,
  PromiseResolve,
- ReflectGet,
  Symbol,
+ TypedArrayPrototypeGetBuffer,
+ TypedArrayPrototypeGetByteLength,
+ TypedArrayPrototypeGetByteOffset,
  Uint8Array,
 }=primordials;
 
@@ -41,6 +46,10 @@ const {
 
 constassert=require('internal/assert');
 
+const{
+ isDataView,
+}=require('internal/util/types');
+
 const{
  validateFunction,
 }=require('internal/validators');
@@ -93,20 +102,29 @@ function customInspect(depth, options, name, data) {
 return`${name}${inspect(data,opts)}`;
 }
 
-// These are defensive to work around the possibility that
-// the buffer, byteLength, and byteOffset properties on
-// ArrayBuffer and ArrayBufferView's may have been tampered with.
+// These use the original prototype getters so that user tampering with
+// the buffer, byteLength, and byteOffset properties on ArrayBuffer and
+// ArrayBufferView's is not observed. They run once or more per chunk on
+// every byte-stream path, so they must not go through a reflective get
+// (the previous view.constructor.prototype lookup was both slower and
+// spoofable via a user-defined .constructor).
 
 functionArrayBufferViewGetBuffer(view){
-returnReflectGet(view.constructor.prototype,'buffer',view);
+returnisDataView(view) ?
+DataViewPrototypeGetBuffer(view) :
+TypedArrayPrototypeGetBuffer(view);
 }
 
 functionArrayBufferViewGetByteLength(view){
-returnReflectGet(view.constructor.prototype,'byteLength',view);
+returnisDataView(view) ?
+DataViewPrototypeGetByteLength(view) :
+TypedArrayPrototypeGetByteLength(view);
 }
 
 functionArrayBufferViewGetByteOffset(view){
-returnReflectGet(view.constructor.prototype,'byteOffset',view);
+returnisDataView(view) ?
+DataViewPrototypeGetByteOffset(view) :
+TypedArrayPrototypeGetByteOffset(view);
 }
 
 functioncloneAsUint8Array(view){