stream: fix TransformStream race on cancel with pending write

[marcopiraccini]

Fixes: #62036

• Fix a race condition in TransformStream where a late writer.write() racing with reader.cancel() could throw an internal TypeError: controller[kState].transformAlgorithm is not a function
• The race occurs when cancel/abort/close clears the controller's algorithms via transformStreamDefaultControllerClearAlgorithms while a pending write reaches transformStreamDefaultControllerPerformTransform
• Added a guard in transformStreamDefaultControllerPerformTransform to check if transformAlgorithm is still callable before invoking it

Race sequence

1. reader.read() releases backpressure
2. reader.cancel() triggers transformStreamDefaultSourceCancelAlgorithm, which calls transformStreamDefaultControllerClearAlgorithms — sets transformAlgorithm = undefined
3. writer.write() enters transformStreamDefaultSinkWriteAlgorithm and calls transformStreamDefaultControllerPerformTransform
4. performTransform tries to invoke transformAlgorithm() which is now undefined → TypeError

Fix

Guard transformStreamDefaultControllerPerformTransform so that if transformAlgorithm has been cleared (stream is shutting down), the write returns silently rather than throwing an internal error. The writable side's existing error handling surfaces the appropriate stream-level error to the caller.

Spec note

The WHATWG streams reference implementation has the same unguarded call in TransformStreamDefaultControllerPerformTransform. The race is latent in the spec but rarely surfaces in browsers due to WebIDL callback wrapping adding an extra promise tick that changes the interleaving order (see whatwg/streams#1296). Node.js hits it consistently because it lacks that extra indirection layer.

Test plan

• New test test/parallel/test-whatwg-transformstream-cancel-write-race.js reproduces the race.

[mcollina]

lgtm

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/71496/

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.62%. Comparing base (35d3bc8) to head (398e700).
⚠️ Report is 17 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #62040      +/-   ##
==========================================
- Coverage   89.65%   89.62%   -0.03%     
==========================================
  Files         676      676              
  Lines      206231   206244      +13     
  Branches    39505    39502       -3     
==========================================
- Hits       184898   184851      -47     
- Misses      13463    13518      +55     
- Partials     7870     7875       +5     

Files with missing lines	Coverage Δ
lib/internal/webstreams/transformstream.js	99.57% <100.00%> (+<0.01%)	⬆️

... and 36 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/71504/

[nodejs-github-bot]

Commit Queue failed

- Loading data for nodejs/node/pull/62040
✔  Done loading data for nodejs/node/pull/62040
----------------------------------- PR info ------------------------------------
Title      stream: fix TransformStream race on cancel with pending write (#62040)
Author     Marco <marco.piraccini@gmail.com> (@marcopiraccini)
Branch     marcopiraccini:fix-transform-stream-race -> nodejs:main
Labels     author ready, web streams
Commits    2
 - stream: fix TransformStream race on cancel with pending write
 - linting fixup
Committers 1
 - marcopiraccini <marco.piraccini@gmail.com>
PR-URL: https://github.com/nodejs/node/pull/62040
Fixes: https://github.com/nodejs/node/issues/62036
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
------------------------------ Generated metadata ------------------------------
PR-URL: https://github.com/nodejs/node/pull/62040
Fixes: https://github.com/nodejs/node/issues/62036
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
--------------------------------------------------------------------------------
   ℹ  This PR was created on Sat, 28 Feb 2026 13:15:07 GMT
   ✔  Approvals: 2
   ✔  - Matteo Collina (@mcollina) (TSC): https://github.com/nodejs/node/pull/62040#pullrequestreview-3870446976
   ✔  - Paolo Insogna (@ShogunPanda) (TSC): https://github.com/nodejs/node/pull/62040#pullrequestreview-3871584746
   ✔  Last GitHub CI successful
   ℹ  Last Full PR CI on 2026-02-28T21:40:44Z: https://ci.nodejs.org/job/node-test-pull-request/71504/
- Querying data for job/node-test-pull-request/71504/
✔  Build data downloaded
   ✔  Last Jenkins CI successful
--------------------------------------------------------------------------------
   ✔  No git cherry-pick in progress
   ✔  No git am in progress
   ✔  No git rebase in progress
--------------------------------------------------------------------------------
- Bringing origin/main up to date...
From https://github.com/nodejs/node
 * branch                  main       -> FETCH_HEAD
✔  origin/main is now up-to-date
- Downloading patch for 62040
From https://github.com/nodejs/node
 * branch                  refs/pull/62040/merge -> FETCH_HEAD
✔  Fetched commits as a6e9e3217833..398e70014ef6
--------------------------------------------------------------------------------
[main b5306f06be] stream: fix TransformStream race on cancel with pending write
 Author: marcopiraccini <marco.piraccini@gmail.com>
 Date: Sat Feb 28 14:09:57 2026 +0100
 2 files changed, 60 insertions(+), 2 deletions(-)
 create mode 100644 test/parallel/test-whatwg-transformstream-cancel-write-race.js
[main bb247edd45] linting fixup
 Author: marcopiraccini <marco.piraccini@gmail.com>
 Date: Sat Feb 28 14:23:30 2026 +0100
 1 file changed, 2 insertions(+), 1 deletion(-)
   ✔  Patches applied
There are 2 commits in the PR. Attempting autorebase.
(node:368) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
(Use `node --trace-deprecation ...` to show where the warning was created)
Rebasing (2/4)
Executing: git node land --amend --yes
--------------------------------- New Message ----------------------------------
stream: fix TransformStream race on cancel with pending write
Signed-off-by: marcopiraccini <marco.piraccini@gmail.com>

PR-URL: #62040

Fixes: #62036

Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Reviewed-By: Paolo Insogna <paolo@cowtech.it>
[detached HEAD 8894af0046] stream: fix TransformStream race on cancel with pending write

Author: marcopiraccini <marco.piraccini@gmail.com>

Date: Sat Feb 28 14:09:57 2026 +0100

2 files changed, 60 insertions(+), 2 deletions(-)

create mode 100644 test/parallel/test-whatwg-transformstream-cancel-write-race.js

Rebasing (3/4)

Rebasing (4/4)

Executing: git node land --amend --yes

--------------------------------- New Message ----------------------------------

linting fixup
Signed-off-by: marcopiraccini <marco.piraccini@gmail.com>

PR-URL: #62040

Fixes: #62036

Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Reviewed-By: Paolo Insogna <paolo@cowtech.it>
[detached HEAD 10c6a05a0c] linting fixup

Author: marcopiraccini <marco.piraccini@gmail.com>

Date: Sat Feb 28 14:23:30 2026 +0100

1 file changed, 2 insertions(+), 1 deletion(-)

Successfully rebased and updated refs/heads/main.
ℹ  Add commit-queue-squash label to land the PR as one commit, or commit-queue-rebase to land as separate commits.

https://github.com/nodejs/node/actions/runs/22577662568