util: fix .format() not always calling toString when it should be

This makes sure that `util.format('%s', object)` will always call
a user defined `toString` function. It was formerly not the case
when the object had the function declared on the super class.
At the same time this also makes sure that getters won't be
triggered accessing the `constructor` property.
Backport-PR-URL: #31431
PR-URL: #30343Fixes: #30333
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Denys Otrishko <shishugi@gmail.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>

Author: BridgeAR

lib/internal/util/inspect.js

@@ -1645,6 +1645,30 @@ function format(...args) {
 returnformatWithOptions(undefined, ...args);
 }
 
+functionhasBuiltInToString(value){
+// Count objects that have no `toString` function as built-in.
+if(typeofvalue.toString!=='function'){
+returntrue;
+}
+
+// The object has a own `toString` property. Thus it's not not a built-in one.
+if(ObjectPrototypeHasOwnProperty(value,'toString')){
+returnfalse;
+}
+
+// Find the object that has the `toString` property as own property in the
+// prototype chain.
+letpointer=value;
+do{
+pointer=ObjectGetPrototypeOf(pointer);
+}while(!ObjectPrototypeHasOwnProperty(pointer,'toString'));
+
+// Check closer if the object is a built-in.
+constdescriptor=ObjectGetOwnPropertyDescriptor(pointer,'constructor');
+returndescriptor!==undefined&&
+typeofdescriptor.value==='function'&&
+builtInObjects.has(descriptor.value.name);
+}
 
 constfirstErrorLine=(error)=>error.message.split('\n')[0];
 letCIRCULAR_ERROR_MESSAGE;
@@ -1692,29 +1716,17 @@ function formatWithOptions(inspectOptions, ...args) {
 tempStr=formatNumber(stylizeNoColor,tempArg);
 }elseif(typeoftempArg==='bigint'){
 tempStr=`${tempArg}n`;
+}elseif(typeoftempArg!=='object'||
+tempArg===null||
+!hasBuiltInToString(tempArg)){
+tempStr=String(tempArg);
 }else{
-letconstr;
-if(typeoftempArg!=='object'||
-tempArg===null||
-(typeoftempArg.toString==='function'&&
-// A direct own property.
-(ObjectPrototypeHasOwnProperty(tempArg,'toString')||
-// A direct own property on the constructor prototype in
-// case the constructor is not an built-in object.
-((constr=tempArg.constructor)&&
-!builtInObjects.has(constr.name)&&
-constr.prototype&&
-ObjectPrototypeHasOwnProperty(constr.prototype,
-'toString'))))){
-tempStr=String(tempArg);
-}else{
-tempStr=inspect(tempArg,{
- ...inspectOptions,
-compact: 3,
-colors: false,
-depth: 0
-});
-}
+tempStr=inspect(tempArg,{
+ ...inspectOptions,
+compact: 3,
+colors: false,
+depth: 0
+});
 }
 break;
 case106: // 'j'

test/parallel/test-util-format.js

@@ -160,6 +160,66 @@ assert.strictEqual(util.format('%s', () => 5), '() => 5');
 util.format('%s',newFoobar(5)),
 'Foobar [ <5 empty items>, aaa: true ]'
 );
+
+// Subclassing:
+classBextendsFoo{}
+
+functionC(){}
+C.prototype.toString=function(){
+return'Custom';
+};
+
+functionD(){
+C.call(this);
+}
+D.prototype=Object.create(C.prototype);
+
+assert.strictEqual(
+util.format('%s',newB()),
+'Bar'
+);
+assert.strictEqual(
+util.format('%s',newC()),
+'Custom'
+);
+assert.strictEqual(
+util.format('%s',newD()),
+'Custom'
+);
+
+D.prototype.constructor=D;
+assert.strictEqual(
+util.format('%s',newD()),
+'Custom'
+);
+
+D.prototype.constructor=null;
+assert.strictEqual(
+util.format('%s',newD()),
+'Custom'
+);
+
+D.prototype.constructor={name: 'Foobar'};
+assert.strictEqual(
+util.format('%s',newD()),
+'Custom'
+);
+
+Object.defineProperty(D.prototype,'constructor',{
+get(){
+thrownewError();
+},
+configurable: true
+});
+assert.strictEqual(
+util.format('%s',newD()),
+'Custom'
+);
+
+assert.strictEqual(
+util.format('%s',Object.create(null)),
+'[Object: null prototype] {}'
+);
 }
 
 // JSON format specifier