stream: fix async iteration of undefined chunks

The hand-rolled async iterator introduced in
#64447 unwraps thenable chunks
before delivering them, but guards the `then` access with
`chunk !== null` while the dereference itself requires `chunk != null`.
An object mode stream carrying an `undefined` chunk therefore threw

  TypeError: Cannot read properties of undefined (reading 'then')

Because the throw happens in a microtask rather than rejecting the
iterator's promise, it surfaces as an uncaught exception that
terminates the process instead of a catchable stream error.

`undefined` is a legal chunk value: doc/api/stream.md documents object
mode chunks as "any JavaScript value other than `null`" and reserves
`null` as the end-of-stream sentinel. `readable.push(undefined)`
returns true in object mode, so the stream accepts the value and then
crashes on the way out.

Read `then` with optional chaining at both sites so that `undefined` is
delivered as a value while `null` keeps signalling end-of-stream.
`then` is still read at most once, so a getter cannot observe a second
access.

Refs: #64447
Assisted-by: a closed-source coding agent
Signed-off-by: Caleb ツ Everett <calebev@amazon.com>
PR-URL: #65969
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Author: everett1992

lib/internal/streams/readable.js

@@ -1522,8 +1522,9 @@ function createAsyncIterator(stream, options) {
     const chunk = stream.destroyed ? null : stream.read();
     if (chunk !== null) {
       // Read `then` only once so that a getter cannot observe (or throw
-      // on) a second access.
-      const then = chunk.then;
+      // on) a second access. `undefined` is a valid chunk value, so it must
+      // not be dereferenced here.
+      const then = chunk?.then;
       if (typeof then === 'function') {
         FunctionPrototypeCall(then, chunk, (value) => {
           inFlight = false;
@@ -1595,8 +1596,9 @@ function createAsyncIterator(stream, options) {
         const chunk = stream.destroyed ? null : stream.read();
         if (chunk !== null) {
           // Read `then` only once so that a getter cannot observe (or
-          // throw on) a second access.
-          const then = chunk.then;
+          // throw on) a second access. `undefined` is a valid chunk value,
+          // so it must not be dereferenced here.
+          const then = chunk?.then;
           if (typeof then === 'function') {
             inFlight = true;
             return FunctionPrototypeCall(

test/parallel/test-stream-readable-async-iterators.js

@@ -989,5 +989,43 @@ async function tests() {
   })().then(common.mustCall());
 }
 
+{
+  // An `undefined` chunk is a value, not end-of-stream. Here it is already
+  // buffered, so it is read on the synchronous fast path.
+  (async () => {
+    const r = new Readable({ objectMode: true, read() {} });
+    r.push(undefined);
+    r.push(null);
+
+    const it = r[Symbol.asyncIterator]();
+    assert.deepStrictEqual(await it.next(), { done: false, value: undefined });
+    assert.strictEqual((await it.next()).done, true);
+  })().then(common.mustCall());
+}
+
+{
+  // An `undefined` chunk pushed after next() is delivered once it arrives.
+  (async () => {
+    const r = new Readable({ objectMode: true, read() {} });
+    const it = r[Symbol.asyncIterator]();
+    const next = it.next();
+    setImmediate(() => {
+      r.push(undefined);
+      r.push(null);
+    });
+
+    assert.deepStrictEqual(await next, { done: false, value: undefined });
+    assert.strictEqual((await it.next()).done, true);
+  })().then(common.mustCall());
+}
+
+{
+  // Readable.from() delivers `undefined` values.
+  (async () => {
+    assert.deepStrictEqual(await Readable.from([undefined]).toArray(),
+                           [undefined]);
+  })().then(common.mustCall());
+}
+
 // To avoid missing some tests if a promise does not resolve
 tests().then(common.mustCall());