See streams/decode-bad-chunks.any.js. We get the following V8 assertion:

external/v8/src/api/api-inl.h:163; message = v8::internal::ValueHelper::IsEmpty(that) || IsJSArrayBufferView(v8::internal::Tagged<v8::internal::Object>( v8::internal::ValueHelper::ValueAsAddress(that)))

This indicates that we are lacking in input validation somewhere before this gets to V8. We should fix this soon.