Creating a TransformStream accesses Object.prototype.type

[KhafraDev]

Version

v19.5.0

Platform

No response

Subsystem

webstreams

What steps will reproduce the bug?

Object.defineProperty(Object.prototype, 'type', {
 get () {
 throw new Error('accessed type')
 }
})

const transformStream = new TransformStream({
 transform (chunk, controller) {
 controller.enqueue(chunk)
 },
 flush (controller) {
 controller.terminate()
 }
})

How often does it reproduce? Is there a required condition?

No response

What is the expected behavior?

It shouldn't access Object.prototype.type.

What do you see instead?

file:///C:/Users/khafra/Documents/test.mjs:3
 throw new Error('accessed type')
 ^

Error: accessed type
 at Object.get (file:///C:/Users/khafra/Documents/test.mjs:3:11)
 at new WritableStream (node:internal/webstreams/writablestream:157:22)
 at initializeTransformStream (node:internal/webstreams/transformstream:360:20)
 at new TransformStream (node:internal/webstreams/transformstream:154:5)
 at file:///C:/Users/khafra/Documents/test.mjs:7:25
 at ModuleJob.run (node:internal/modules/esm/module_job:193:25)

Additional information

This can be fixed by adding type: undefined to the WritableStream and ReadableStream options that TransformStream creates. Or making it a null prototype (via __proto__: null) should also probably work.

[KhafraDev]

There's a WPT for this at https://raw.githubusercontent.com/web-platform-tests/wpt/master/fetch/api/basic/stream-safe-creation.any.js although it relies on fetch things. There might be one for webstreams only but I haven't looked.