Creating a TransformStream accesses Object.prototype.type

[KhafraDev]

Version

v19.5.0

Platform

No response

Subsystem

webstreams

What steps will reproduce the bug?

Object.defineProperty(Object.prototype, 'type', {
  get () {
    throw new Error('accessed type')
  }
})

const transformStream = new TransformStream({
  transform (chunk, controller) {
    controller.enqueue(chunk)
  },
  flush (controller) {
    controller.terminate()
  }
})

How often does it reproduce? Is there a required condition?

No response

What is the expected behavior?

It shouldn't access Object.prototype.type.

What do you see instead?

file:///C:/Users/khafra/Documents/test.mjs:3
    throw new Error('accessed type')
          ^

Error: accessed type
    at Object.get (file:///C:/Users/khafra/Documents/test.mjs:3:11)
    at new WritableStream (node:internal/webstreams/writablestream:157:22)
    at initializeTransformStream (node:internal/webstreams/transformstream:360:20)
    at new TransformStream (node:internal/webstreams/transformstream:154:5)
    at file:///C:/Users/khafra/Documents/test.mjs:7:25
    at ModuleJob.run (node:internal/modules/esm/module_job:193:25)

Additional information

This can be fixed by adding type: undefined to the WritableStream and ReadableStream options that TransformStream creates. Or making it a null prototype (via __proto__: null) should also probably work.

[KhafraDev]

There's a WPT for this at https://raw.githubusercontent.com/web-platform-tests/wpt/master/fetch/api/basic/stream-safe-creation.any.js although it relies on fetch things. There might be one for webstreams only but I haven't looked.