Summary

Fixes #62199

When using Duplex.fromWeb() or Writable.fromWeb() with cork()/uncork(), writes are batched into _writev(). If destroy() is called in the same microtask (after uncork()), the underlying WritableStream writer gets aborted, causing SafePromiseAll() to reject with a non-array value (e.g. an AbortError or null).

The done() callback in _writev() of both newStreamDuplexFromReadableWritablePair and newStreamWritableFromWritableStream unconditionally called error.filter(), assuming the value was always an array from SafePromiseAll. This caused a TypeError: Cannot read properties of null (reading 'filter') that became an unhandled rejection, crashing the process.

Root cause

done was used as both the resolve and reject handler for SafePromiseAll:

PromisePrototypeThen(SafePromiseAll(chunks, ...), done, done);

• Resolve path: done([undefined, undefined, ...]) — array, .filter() works
• Reject path: done(abortError) or done(null) — non-array, .filter() throws

Fix

Separate the resolve and reject handlers of SafePromiseAll. Promise.all resolving means all writes succeeded — there is no error to report. Promise.all rejecting passes a single error value directly.

PromisePrototypeThen(SafePromiseAll(chunks, ...), () => done(), done);

• () => done() — resolve path: all writes succeeded, call callback with no error
• done — reject path: single error passed directly to callback

The same fix is applied to both newStreamDuplexFromReadableWritablePair and newStreamWritableFromWritableStream.

Test

Added test/parallel/test-webstreams-duplex-fromweb-writev-unhandled-rejection.js with the exact reproduction from the issue report (cork → write → write → uncork → destroy).