@@ -149,8 +149,8 @@ function refreshCompositeSignal(signal) {
       continue;
     }
 
-    if (sourceSignal.aborted) {
-      abortSignal(signal, sourceSignal.reason);
+    if (sourceSignal[kAborted]) {
+      abortSignal(signal, sourceSignal[kReason]);
       return;
     }
   }
@@ -170,8 +170,8 @@ function followCompositeSignal(signal) {
       continue;
     }
 
-    if (sourceSignal.aborted) {
-      abortSignal(signal, sourceSignal.reason);
+    if (sourceSignal[kAborted]) {
+      abortSignal(signal, sourceSignal[kReason]);
       return;
     }
 
@@ -217,6 +217,14 @@ function setWeakAbortSignalTimeout(weakRef, delay) {
 }
 
 class AbortSignal extends EventTarget {
+  #brand;
+
+  static {
+    converters.AbortSignal = createInterfaceConverter(
+      'AbortSignal',
+      (value) => typeof value === 'object' && value !== null && #brand in value,
+    );
+  }
 
   /**
    * @param {symbol | undefined} dontThrowSymbol
@@ -337,8 +345,9 @@ class AbortSignal extends EventTarget {
         gcPersistentSignals.add(signal);
       }
 
-      if (signal.aborted) {
-        abortSignal(resultSignal, signal.reason);
+      refreshCompositeSignal(signal);
+      if (signal[kAborted]) {
+        abortSignal(resultSignal, signal[kReason]);
         return resultSignal;
       }
 
@@ -348,20 +357,15 @@ class AbortSignal extends EventTarget {
       } else if (!signal[kSourceSignals]) {
         continue;
       } else {
-        refreshCompositeSignal(signal);
-        if (signal.aborted) {
-          abortSignal(resultSignal, signal.reason);
-          return resultSignal;
-        }
         for (const sourceSignalWeakRef of signal[kSourceSignals]) {
           const sourceSignal = sourceSignalWeakRef.deref();
           if (!sourceSignal) {
             continue;
           }
           assert(!sourceSignal[kComposite]);
 
-          if (sourceSignal.aborted) {
-            abortSignal(resultSignal, sourceSignal.reason);
+          if (sourceSignal[kAborted]) {
+            abortSignal(resultSignal, sourceSignal[kReason]);
             return resultSignal;
           }
 
@@ -470,7 +474,6 @@ class AbortSignal extends EventTarget {
   }
 }
 
-converters.AbortSignal = createInterfaceConverter('AbortSignal', AbortSignal.prototype);
 converters['sequence<AbortSignal>'] = createSequenceConverter(converters.AbortSignal);
 
 function ClonedAbortSignal() {
 
@@ -19,10 +19,10 @@ const {
   isInt32,
   isUint32,
 } = require('internal/validators');
-const { CryptoKey } = require('internal/crypto/webcrypto');
 const {
   getCryptoKeyAlgorithm,
   getCryptoKeyType,
+  isCryptoKey,
 } = require('internal/crypto/keys');
 const {
   bigIntArrayToUnsignedInt,
@@ -649,7 +649,7 @@ converters.AesCtrParams = createDictionaryConverter(
   ]);
 
 converters.CryptoKey = createInterfaceConverter(
-  'CryptoKey', CryptoKey.prototype);
+  'CryptoKey', isCryptoKey);
 
 converters.EcdhKeyDeriveParams = createDictionaryConverter(
   'EcdhKeyDeriveParams', [
 
@@ -21,7 +21,6 @@ const {
   NumberMAX_SAFE_INTEGER,
   NumberMIN_SAFE_INTEGER,
   ObjectPrototypeHasOwnProperty,
-  ObjectPrototypeIsPrototypeOf,
   SafeArrayIterator,
   SafeSet,
   String,
@@ -863,13 +862,13 @@ function createSequenceConverter(converter) {
  * Creates a converter for a Web IDL interface type.
  * @see https://webidl.spec.whatwg.org/#js-interface
  * @param {string} name Interface identifier.
- * @param {object} prototype Interface prototype object.
+ * @param {(value: any) => boolean} brandCheck Interface brand predicate.
  * @returns {Converter}
  */
-function createInterfaceConverter(name, prototype) {
+function createInterfaceConverter(name, brandCheck) {
   return (V, options = kEmptyObject) => {
     // Web IDL interface conversion step 1: return V if it implements I.
-    if (ObjectPrototypeIsPrototypeOf(prototype, V)) {
+    if (brandCheck(V)) {
       return V;
     }
     // Step 2: otherwise throw.
 
@@ -1,7 +1,7 @@
 // Flags: --expose-internals
 'use strict';
 
-require('../common');
+const common = require('../common');
 const assert = require('assert');
 const vm = require('vm');
 const webidl = require('internal/webidl');
@@ -544,10 +544,16 @@ for (const [prototype, value] of [
 }
 
 {
-  class Example {}
+  class Example {
+    #brand;
+
+    static is(value) {
+      return typeof value === 'object' && value !== null && #brand in value;
+    }
+  }
   const converter = webidl.createInterfaceConverter(
     'Example',
-    Example.prototype);
+    Example.is);
   const example = new Example();
 
   assert.strictEqual(converter(example), example);
@@ -556,6 +562,42 @@ for (const [prototype, value] of [
     code: 'ERR_INVALID_ARG_TYPE',
     message: 'Prefix: Context is not of type Example.',
   });
+  assertInvalidArgType(() => converter({ __proto__: Example.prototype }));
+  assertInvalidArgType(() => converter(new Proxy(example, {})));
+  Object.setPrototypeOf(example, null);
+  assert.strictEqual(converter(example), example);
+}
+
+{
+  const signal = AbortSignal.abort('reason');
+  for (const value of [
+    Object.create(AbortSignal.prototype, { aborted: { value: false } }),
+    { __proto__: signal },
+    Object.create(AbortSignal.prototype, Object.getOwnPropertyDescriptors(signal)),
+    new Proxy(signal, {}),
+  ]) {
+    assertInvalidArgType(() => converters.AbortSignal(value));
+    assertInvalidArgType(() => AbortSignal.any([value]));
+  }
+
+  Object.setPrototypeOf(signal, null);
+  assert.strictEqual(converters.AbortSignal(signal), signal);
+  const composite = AbortSignal.any([signal]);
+  assert.strictEqual(composite.aborted, true);
+  assert.strictEqual(composite.reason, 'reason');
+}
+
+{
+  const controller = new AbortController();
+  Object.defineProperties(controller.signal, {
+    aborted: { get: common.mustNotCall('Unexpected aborted getter') },
+    reason: { get: common.mustNotCall('Unexpected reason getter') },
+  });
+  const composite = AbortSignal.any([controller.signal]);
+  assert.strictEqual(composite.aborted, false);
+  controller.abort('reason');
+  assert.strictEqual(composite.aborted, true);
+  assert.strictEqual(composite.reason, 'reason');
 }
 
 {
 
@@ -54,6 +54,7 @@ const { subtle } = globalThis.crypto;
   assert.strictEqual(Object.getPrototypeOf(internalProto), CryptoKey.prototype);
 
   const invalidThis = { code: 'ERR_INVALID_THIS', name: 'TypeError' };
+  const invalidArgType = { code: 'ERR_INVALID_ARG_TYPE', name: 'TypeError' };
 
   // Plain object receiver.
   Object.entries(getters).forEach(([, getter]) => {
@@ -94,10 +95,10 @@ const { subtle } = globalThis.crypto;
   assert.strictEqual(isCryptoKey(spoofed), false);
   await assert.rejects(
     subtle.sign('HMAC', spoofed, Buffer.from('payload')),
-    invalidThis);
+    invalidArgType);
   await assert.rejects(
     subtle.exportKey('jwk', spoofed),
-    invalidThis);
+    invalidArgType);
 
   // Subvert `instanceof CryptoKey` via Symbol.hasInstance, then
   // invoke the native getters on a forged object. The C++ tag
 
@@ -0,0 +1,38 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const { subtle } = globalThis.crypto;
+const { CryptoKey } = require('internal/crypto/keys');
+const { converters } = require('internal/crypto/webidl');
+
+async function main() {
+  const bytes = new Uint8Array(16);
+  const key = await subtle.importKey('raw', bytes, 'AES-GCM', true, ['encrypt']);
+
+  for (const value of [
+    { __proto__: CryptoKey.prototype },
+    { __proto__: key },
+    Object.create(CryptoKey.prototype, Object.getOwnPropertyDescriptors(key)),
+    new Proxy(key, {}),
+  ]) {
+    assert.throws(() => converters.CryptoKey(value), {
+      name: 'TypeError',
+      code: 'ERR_INVALID_ARG_TYPE',
+    });
+    await assert.rejects(subtle.exportKey('raw', value), {
+      name: 'TypeError',
+      code: 'ERR_INVALID_ARG_TYPE',
+    });
+  }
+
+  Object.setPrototypeOf(key, null);
+  assert.strictEqual(converters.CryptoKey(key), key);
+  assert.deepStrictEqual(new Uint8Array(await subtle.exportKey('raw', key)), bytes);
+}
+
+main().then(common.mustCall());
Original file line number	Diff line number	Diff line change
`@@ -149,8 +149,8 @@ function refreshCompositeSignal(signal) {`
`149`	`149`	`continue;`
`150`	`150`	`}`
`151`	`151`
`152`		`- if (sourceSignal.aborted) {`
`153`		`- abortSignal(signal, sourceSignal.reason);`
	`152`	`+ if (sourceSignal[kAborted]) {`
	`153`	`+ abortSignal(signal, sourceSignal[kReason]);`
`154`	`154`	`return;`
`155`	`155`	`}`
`156`	`156`	`}`
`@@ -170,8 +170,8 @@ function followCompositeSignal(signal) {`
`170`	`170`	`continue;`
`171`	`171`	`}`
`172`	`172`
`173`		`- if (sourceSignal.aborted) {`
`174`		`- abortSignal(signal, sourceSignal.reason);`
	`173`	`+ if (sourceSignal[kAborted]) {`
	`174`	`+ abortSignal(signal, sourceSignal[kReason]);`
`175`	`175`	`return;`
`176`	`176`	`}`
`177`	`177`
`@@ -217,6 +217,14 @@ function setWeakAbortSignalTimeout(weakRef, delay) {`
`217`	`217`	`}`
`218`	`218`
`219`	`219`	`class AbortSignal extends EventTarget {`
	`220`	`+ #brand;`
	`221`	`+`
	`222`	`+ static {`
	`223`	`+ converters.AbortSignal = createInterfaceConverter(`
	`224`	`+ 'AbortSignal',`
	`225`	`+ (value) => typeof value === 'object' && value !== null && #brand in value,`
	`226`	`+ );`
	`227`	`+ }`
`220`	`228`
`221`	`229`	`/**`
`222`	`230`	`* @param {symbol \| undefined} dontThrowSymbol`
`@@ -337,8 +345,9 @@ class AbortSignal extends EventTarget {`
`337`	`345`	`gcPersistentSignals.add(signal);`
`338`	`346`	`}`
`339`	`347`
`340`		`- if (signal.aborted) {`
`341`		`- abortSignal(resultSignal, signal.reason);`
	`348`	`+ refreshCompositeSignal(signal);`
	`349`	`+ if (signal[kAborted]) {`
	`350`	`+ abortSignal(resultSignal, signal[kReason]);`
`342`	`351`	`return resultSignal;`
`343`	`352`	`}`
`344`	`353`
`@@ -348,20 +357,15 @@ class AbortSignal extends EventTarget {`
`348`	`357`	`} else if (!signal[kSourceSignals]) {`
`349`	`358`	`continue;`
`350`	`359`	`} else {`
`351`		`- refreshCompositeSignal(signal);`
`352`		`- if (signal.aborted) {`
`353`		`- abortSignal(resultSignal, signal.reason);`
`354`		`- return resultSignal;`
`355`		`- }`
`356`	`360`	`for (const sourceSignalWeakRef of signal[kSourceSignals]) {`
`357`	`361`	`const sourceSignal = sourceSignalWeakRef.deref();`
`358`	`362`	`if (!sourceSignal) {`
`359`	`363`	`continue;`
`360`	`364`	`}`
`361`	`365`	`assert(!sourceSignal[kComposite]);`
`362`	`366`
`363`		`- if (sourceSignal.aborted) {`
`364`		`- abortSignal(resultSignal, sourceSignal.reason);`
	`367`	`+ if (sourceSignal[kAborted]) {`
	`368`	`+ abortSignal(resultSignal, sourceSignal[kReason]);`
`365`	`369`	`return resultSignal;`
`366`	`370`	`}`
`367`	`371`
`@@ -470,7 +474,6 @@ class AbortSignal extends EventTarget {`
`470`	`474`	`}`
`471`	`475`	`}`
`472`	`476`
`473`		`-converters.AbortSignal = createInterfaceConverter('AbortSignal', AbortSignal.prototype);`
`474`	`477`	`converters['sequence<AbortSignal>'] = createSequenceConverter(converters.AbortSignal);`
`475`	`478`
`476`	`479`	`function ClonedAbortSignal() {`