util.inspect: freeze builtInObjects to Node's 47-name bootstrap set

src/js/internal/util/inspect.js

@@ -344,12 +344,22 @@ function isURL(value) {
 
 const SymbolToPrimitive = Symbol.toPrimitive;
 
-const builtInObjects = new SafeSet(
-  ArrayPrototypeFilter(
-    ObjectGetOwnPropertyNames(globalThis),
-    e => RegExpPrototypeExec(/^[A-Z][a-zA-Z0-9]+$/, e) !== null,
-  ),
-);
+// In Node.js this set is computed at bootstrap before any Node/Web globals (Buffer,
+// URL, Request, ...) are installed on globalThis, so it only contains ECMAScript
+// language built-ins. Bun installs those globals before this module loads, so we
+// hardcode the language-level names to match Node's observable `%s` behavior.
+// prettier-ignore
+const builtInObjects = new SafeSet([
+  "AggregateError", "Array", "ArrayBuffer", "AsyncDisposableStack", "Atomics",
+  "BigInt", "BigInt64Array", "BigUint64Array", "Boolean", "DataView", "Date",
+  "DisposableStack", "Error", "EvalError", "FinalizationRegistry", "Float16Array",
+  "Float32Array", "Float64Array", "Function", "Infinity", "Int16Array", "Int32Array",
+  "Int8Array", "Intl", "Iterator", "JSON", "Map", "Math", "NaN", "Number", "Object",
+  "Promise", "Proxy", "RangeError", "ReferenceError", "Reflect", "RegExp", "Set",
+  "SharedArrayBuffer", "String", "SuppressedError", "Symbol", "SyntaxError",
+  "TypeError", "URIError", "Uint16Array", "Uint32Array", "Uint8Array",
+  "Uint8ClampedArray", "WeakMap", "WeakRef", "WeakSet",
+]);
 
 // https://tc39.es/ecma262/#sec-IsHTMLDDA-internal-slot
 const isUndetectableObject = v => typeof v === "undefined" && v !== undefined;

test/js/node/util/node-inspect-tests/parallel/util-format.test.js

@@ -238,6 +238,24 @@ test("no assertion failures", () => {
     assert.strictEqual(util.format("%s", { __proto__: null }), "[Object: null prototype] {}");
   }
 
+  // `%s` with values whose inherited `toString` comes from a non-ECMAScript
+  // built-in (Buffer, URL, ...) must call `String(value)`, not inspect it.
+  assert.strictEqual(util.format("%s", Buffer.from("ab")), "ab");
+  assert.strictEqual(util.format("%s", Buffer.from([0xe2, 0x82, 0xac])), "\u20ac");
+  assert.strictEqual(util.format("%s", new URL("http://a/b")), "http://a/b");
+  assert.strictEqual(util.format("%s", new URLSearchParams("a=1&b=2")), "a=1&b=2");
+  {
+    class MyBuffer extends Buffer {}
+    const sub = new MyBuffer(2);
+    sub[0] = 0x68;
+    sub[1] = 0x69;
+    assert.strictEqual(util.format("%s", sub), "hi");
+  }
+  // Uint8Array inherits toString from %TypedArray%.prototype, not Buffer.
+  assert.strictEqual(util.format("%s", new Uint8Array([65])), "65");
+  // ECMAScript built-ins with their own toString still take the inspect path.
+  assert.strictEqual(util.format("%s", [1, 2]), "[ 1, 2 ]");
+
   // JSON format specifier
   assert.strictEqual(util.format("%j"), "%j");
   assert.strictEqual(util.format("%j", 42), "42");